9293ae915b966ef635f2f126ffeef08f2934a0c983efc371f8b5a1d2e19bc202

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_30ee6fa8308d7344953ec964b22380da_amadey_elex_redline-stealer_smoke-loader_stop.exe
Size 1.4MB
Sample260930-2fn46stbma
SHA256 9293ae915b966ef635f2f126ffeef08f2934a0c983efc371f8b5a1d2e19bc202
MD5 30ee6fa8308d7344953ec964b22380da
SHA1 292a46b196ddce460f34a5aa448f2ee60ff15f63
SHA512 7b9de4d4561004f55571013ab30dee3ebbeb9d031b0d6962908da644f073e06853ec19b96a288874871a61c7bb2b3f60e5a5ea78b81db3b795bb352e7d234b4f
SSDEEP 12288:pvy2bxw/cmpmhnlcSkfLuwH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:pFQchQSkjIgu5sdLvK9OV+umJXeetXY
TLSH
T1BD65F12177E0C833D267227A49A9977866AAF8705F6191C3B7D01FBE8F702D15E34386
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3808	alg.exe
4688	DiagnosticsHub.StandardCollector.Service.exe
2408	fxssvc.exe
4368	elevation_service.exe
1792	elevation_service.exe
728	maintenanceservice.exe
2436	OSE.EXE
5908	msdtc.exe
5632	PerceptionSimulationService.exe
3484	perfhost.exe
5736	locator.exe
2192	SensorDataService.exe
3528	snmptrap.exe
3040	spectrum.exe
5728	ssh-agent.exe
2324	TieringEngineService.exe
4596	AgentService.exe
5732	vds.exe
5124	vssvc.exe
4668	wbengine.exe
5600	WmiApSrv.exe
3848	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe
\??\F:\	elevation_service.exe

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a45ec81e4bb6346b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_30ee6fa8308d7344953ec964b22380da_amadey_elex_redline-stealer_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_30ee6fa8308d7344953ec964b22380da_amadey_elex_redline-stealer_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_30ee6fa8308d7344953ec964b22380da_amadey_elex_redline-stealer_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-29_30ee6fa8308d7344953ec964b22380da_amadey_elex_redline-stealer_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-29_30ee6fa8308d7344953ec964b22380da_amadey_elex_redline-stealer_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_30ee6fa8308d7344953ec964b22380da_amadey_elex_redline-stealer_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_30ee6fa8308d7344953ec964b22380da_amadey_elex_redline-stealer_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aff9c4b62b51dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008fbc23b52b51dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac1d45b52b51dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d64eeb52b51dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002197fdb42b51dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000089951cb52b51dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000061725eb62b51dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000851e26b52b51dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005bec16b62b51dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009ea7f4b62b51dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9b907b72b51dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4688	DiagnosticsHub.StandardCollector.Service.exe
4688	DiagnosticsHub.StandardCollector.Service.exe
4688	DiagnosticsHub.StandardCollector.Service.exe
4688	DiagnosticsHub.StandardCollector.Service.exe
4688	DiagnosticsHub.StandardCollector.Service.exe
4688	DiagnosticsHub.StandardCollector.Service.exe
4368	elevation_service.exe
4368	elevation_service.exe
4368	elevation_service.exe
4368	elevation_service.exe
4368	elevation_service.exe
4368	elevation_service.exe
4368	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1272	2026-09-29_30ee6fa8308d7344953ec964b22380da_amadey_elex_redline-stealer_smoke-loader_stop.exe
Token: SeAuditPrivilege	2408	fxssvc.exe
Token: SeDebugPrivilege	4688	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4368	elevation_service.exe
Token: SeRestorePrivilege	2324	TieringEngineService.exe
Token: SeManageVolumePrivilege	2324	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4596	AgentService.exe
Token: SeBackupPrivilege	5124	vssvc.exe
Token: SeRestorePrivilege	5124	vssvc.exe
Token: SeAuditPrivilege	5124	vssvc.exe
Token: SeBackupPrivilege	4668	wbengine.exe
Token: SeRestorePrivilege	4668	wbengine.exe
Token: SeSecurityPrivilege	4668	wbengine.exe
Token: 33	3848	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3848	SearchIndexer.exe
Token: SeDebugPrivilege	4368	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 3684	3848	SearchIndexer.exe	136
PID 3848 wrote to memory of 1312	3848	SearchIndexer.exe	137

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-29_30ee6fa8308d7344953ec964b22380da_amadey_elex_redline-stealer_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_30ee6fa8308d7344953ec964b22380da_amadey_elex_redline-stealer_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1272

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3808

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4920

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2408

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1792

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:728

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2436

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5908

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5632

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3484

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5736

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2192

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3528

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3040

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2532

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2324

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4596

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5732

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5124

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4668

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5600

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3684
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cddf30303288fa0735e7b6ce6a2a648978cda5095abc8844b508991fdbcaec46
MD5 c5537adea8a8c38e1dca9d814b90f33a
SHA1 edb15b5f1b4b4528894db95e63c4f1330617dce9
SHA512 6cc5ab850423859903c6e13769d314d14387c5d7dd38c60b6c90dca962d93787f7b3cd6717d7948e5307baf8749a2c9dbff2bf5308e5bc7bcc7df21883dd0d5f
SSDEEP 49152:qb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnSBZK9G+umJXD9:c3q6sjB7BZDoT
TLSH
T168D58D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 5a363f570a44cb34856efb2d49ea36c9ddc545c8672e8b9022106beefe66b895
MD5 2887ace0c1dadef44682d479326881fe
SHA1 805205171f3091113fdff972c709e1b81fbb8a05
SHA512 ebc82643dc9b160dd64b3a1dd605de3d7295018a6ad7bb097d0c0635b2d2343189a1dc6ad1be6ea6373e1483220f3b97b61223afae94ebee2e9e2040108becec
SSDEEP 12288:21XLsswWkxy2lRq2czAowH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:0XYfDtczAugu5sdLvK9OV+umJXeetXY
TLSH
T10465F129A3E408F9ED67827DC8B28511D673BC554760E6DB03E49A660F333D82E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 0ea8ea48dd6a710fa139754b4d516bdf4dae4da0d99747d8b176a05df26995b4
MD5 a56f6eab20a50de7acf506f8238cf293
SHA1 e3abab76229c82f3cb2915cec304e7d04e2e8359
SHA512 997a19f45b9f3e33c5e0fdc65fe5e5fdb1db264010bb1ce5e0c5f3c633294532d1f2092eda2c009a0f528562aa1497833ef8619568f8b853974fa789fd6c6872
SSDEEP 24576:e0Le5ji0hmxxrM9gu5sdLvK9OV+umJXeetXY:ePji0AjhBZK9G+umJXD9
TLSH
T1D885AE26F6748331D073C0B9C5D2A69EE97230865B3089CB4286D77C6F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e5fd662e6892cda7b540f49e353b49ff20345f10c5865a8ad46b8c789778ef8c
MD5 cfc0665c8e3da9bb7803d91a58cfe141
SHA1 7f06a7378dcaf062e67deae99f82688721b6d22e
SHA512 86beb1fe10b4875fafb92edf73379f546f0313989b95be2ffd5606a1a90177ac377ccdb659ef19db2475e226381a31c7006e954789dda4d1438e5f608e767149
SSDEEP 24576:Oa7/ezSC6vUyD/aqgrvWn6q8wyungu5sdLvK9OV+umJXeetXY:J/ezSC6vUzPveHjytBZK9G+umJXD9
TLSH
T1CB756D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6b3d8a365d4fa4252f1c77a5feaef79a95a0e94dd041c84932d62221a33358e8
MD5 296f572eb29ba3c37bebdca202c88f7e
SHA1 2c31fa49d142307c9df6c0041ccd727ab8e219cf
SHA512 d002d31b2dd4b6797062886a7f634f88b7b0a6c2cf8deaadad7f22a3a59207960302bb0687d3aa740b9b9af695d04887d11b223f9f045c997da8a98d4283ff8c
SSDEEP 24576:LVbqPb88hv/l+Yigu5sdLvK9OV+umJXeetXY:LVO88hXl+YBZK9G+umJXD9
TLSH
T184559E66F5B48331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C2F677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 9e48b1277cdd8c7531be035f4814737d4b7135158de3df3d3d27b60c3196275a
MD5 b072a8902316ee70ad9a433ad355f4c0
SHA1 498b51b6bbbcd9b431ddd6af04c7f44690ee0a1f
SHA512 16b86c1183813859128aace05377ca5d67979cd7691efabd8c65e2adea50b6066c31504c98aca3beb503d8fdd22166d16b7daa79ba3d6ec97882f5029ca21fe0
SSDEEP 12288:PLtwH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:PLxgu5sdLvK9OV+umJXeetXY
TLSH
T15445232AC5A864A3DB9B9777E1F54F158261DCAABC4184B342D2FFE347342907922323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 3df5772439fa789325088150d0622d36eef60ede6804f2fca2261c843e620c7b
MD5 78a4e0acb4093369b592599c38128bed
SHA1 0410f39389eefab251e89f83a9cdf913d3229616
SHA512 d72f9affc0e13b03c57993bb41a400154dc12fe277549b158e256c21b2a6ee164565ae4c66368151e03c67649eb5d7fc22ae780dc2f8a454561e977b55b42624
SSDEEP 12288:leBNUbTVO86UMwH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:lJIUagu5sdLvK9OV+umJXeetXY
TLSH
T12365CF3BEE28FCD2C27A8DB956918600D772B8714F5293CBD165834ECE235E01E76D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1c91b87d61a351988139a7198207a87c837726a8c6816b4950b23ded427d6052
MD5 608bc33b9174dc0fbea8150780f70ed2
SHA1 eaf21a51506b2844cdd5a612d636ef4bb11b691c
SHA512 236d635375b5adf73b69a6016ed37223a5eafa576bc2893c37f6d7ab6f736edac2071e6bc573e92e991ca330a81a26b24b65296a379e9dc9e94189047c89e95a
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THw:IQvGAdlCEL8c/DRNw5CQBZDoT
TLSH
T1C3267C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 0d9a529b13de9d87cf17a8b045958fe4b6d337932b3dc271804c89c0cbef5192
MD5 b10f35f3f07de2011bdf73410e32f6ea
SHA1 563f84197f5b799a299820eaee7cbbd473672426
SHA512 2296ff76268d81346e14c88c05360663b411be20f566dcee9d7512f44fd8be09bea08e5cf566364f7edead23c0d5f1d5e1d9f962c0b5e1266b9b06b500c58010
SSDEEP 12288:/AwSfxL/2Dc3RDLLmt0LDQewsAj6wH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeW:I0ewsAjcgu5sdLvK9OV+umJXeetXY
TLSH
T1D775E031EA74E432C7BB0EB61B36C716546DB9604F5119C3E3E89E9E4A302D22736B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 200729b5db0b1f32476512e0092f894e8380610a7ba1090b9a7cfff32ee8ff44
MD5 996c138c7a177dfd3bd65c771ebbfc68
SHA1 512f15a38356d32fb8ceabd2ba109b15f9aa0850
SHA512 56453acdf1ddd81660f3562f3ca64d39bca2db38a168988d6ad4dae6a840bfff8b7c8fe958044d0d830c412a790f3054dfd896869be5dde170c893f4492ad3af
SSDEEP 196608:4UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHpro:4UEtQevvqc2W1cpV2tI32pr
TLSH
T170474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e886d3607758a1a7f7fecfbce66bfc1d0e2d59cfa42afd6846d9329744a74584
MD5 1dfc8d1faf1c30f281f0209be8d5f56a
SHA1 69542ef4048e6a54891a15246fab8433cd500273
SHA512 b6a668d264380111112ce4100f465260c5abee7b481dc777e74e8e1daa4f16dde4bf924d1577f463ad73fdf2f0d65951628906e8c2c9c4bf3329274e8da05bfc
SSDEEP 49152:nCbRquA/m2yL5zQfFiV+XenmE3/zxBZK9G+umJXD9:woqtVjnm8BZDoT
TLSH
T17FD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 99f74e63460c9093b99d78d379dbbe0965423800efcfc47d878b412781b48f56
MD5 4dacf6b7f1f956eca35c7e8316d720d6
SHA1 e61136ba577c87f9a8f9156ea0022ca7c19fe4ac
SHA512 7b69699d5b8e853e2058c74f3a91ac6c3665823bbcacd98de3ae9d87cc264fc40df624ceaafbe3d96dce887ceb04e18f23cd74b3a2744adf5bb3a4cc2cdfe510
SSDEEP 24576:zAhGL3IFoiwtA5l7S53Tgu5sdLvK9OV+umJXeetXY:zAMUFoiq5sBZK9G+umJXD9
TLSH
T18E35AE81E7F955D4F5B3AB7899B68570EA76BCAA5E31C20F2150D21F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 5fabe2fa38cfd43c645909cf29deb9cb641eacc6e0c64098d554e3f540b712ab
MD5 4d906aab96287e696236f07fdfa905f7
SHA1 4c870fac5b78050db61620622f7b79baaede1194
SHA512 2a99709ea60e6843d804888bc9622b1b20c8a57f7f5c71201307d277985b8cce779669d232b599c80c86ccd224b7987ebe6a689eea1e984f1a1d4794f1cec676
SSDEEP 12288:mmw5HEjsChNVBFgl0WDm+C/wH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:/wu4OW4gu5sdLvK9OV+umJXeetXY
TLSH
T10165F14A66A41CF9EA678239C597C536E7F2BC162A21C71F03A0C75B5F373607D29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8ef995ff7dede2e90aceb58b0bb784610e7badaa913c9cdc632cc368729c5d14
MD5 7e9cf30cfadf2ca7e75138c0204cc481
SHA1 9e448f2b2c9dd7043df6e08e222b66b1503bd7c8
SHA512 6a61808d0765cf06e4ed782a0dfce5eb73c81fda0bc2f8efe1482ff63cd9b5619cf2fd171f69323568f4d3f3022d8e70c0f5d7cba90a29e1422fc12d08f43697
SSDEEP 12288:CeZ1IyqwH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:PZu1gu5sdLvK9OV+umJXeetXY
TLSH
T1F055125A62E420F6D2979379C9F14B05C372F8A6773243DF12A1A7A70F32AD12D35722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c81f49b923791957b817bc70c1a387a77ae3a8a225f9b70abebe3414b82ae506
MD5 275d836446e424f63994a71ab225905f
SHA1 ef33b3eeb730bb517e7f89ce378f67f2c37c2b0c
SHA512 5d834c8ff1ceb17c25222fd95ac1041cc8949b54ce80d457f34b30ed6ab8454c10305b2131e81214498b363546901acb144bf7d537cacd68b40d7ffdc0366244
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UE:CQRQyi36YOcPbLvw2gAf+PN3/BZDoT
TLSH
T1C9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7b02383c56ddf65647a8c3572ad06c15d5c2f9c88e5306e900b91747363e16c6
MD5 6d8bd780d6e5ac0fd4b720e5f587d089
SHA1 e6afa736b12a9eac19f49d26adcdf9cae61e304d
SHA512 4f3d883d874538a3db69e240d02fe54b07c08802a5acf0432d1dc38aaba763992d0a56991e1abb94dc9aafaace545767a4ba08e2ddf2e4398dea930270ebfedf
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UE:6QRQyi36YOcPbLvw2gAf+PN3/BZDoT
TLSH
T1DF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c252fc0a9181c4f7c776b6662d4f3a3e5df147b9350ea2e36945d9bfec2d8e6f
MD5 a4d6f78a7335f9884d5493349473c078
SHA1 0d25cf8a7c28539dbb064e9eef7676859b541b17
SHA512 9509c09aaf2dc8c0684ed3048b84aac7827bc1c9c11f3109bf6eb996790232aeb6988c8afad071f43f50d9b92187855b930f496a2234b4b938b206c963144293
SSDEEP 49152:a68Qg55nhceWu7PNU3/hBZK9G+umJXD9:IthLRc/hBZDoT
TLSH
T142B55933B2F600A9C44DE1769F4A873196D27C758FE0E3DB815172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5d24b55f62df5f70d5762df86677b9de1f5f6e912b6ace512517730e13123847
MD5 fb1901d55ca5c7cf15252a85e18b74d6
SHA1 95b2a5aeaa46f4e17321da56d04b62bdebe0878d
SHA512 ac95fbe9fe5a8d6805359b4fc8a279c09e94a9209d6cf0e2b62b6b268f9e76c0b6304cab4282a52f5305e5bff3a0dcce2f7aa9a82aa5e934d47d551c74b72f1c
SSDEEP 49152:C3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99y:Dy5112gYy5azzVvt69nLKnhZOBZDoT
TLSH
T134167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8ff54f209b043ebb05ea8b1a41031986b977af533bed9e09ccabdb0ef2cbadbe
MD5 45e90fc384c0e3aee99fcd1f35e8842e
SHA1 906d8de9316da401da0be6b9b994e61a951ac492
SHA512 0e97cb6d9ad5076085bffb07c44e0432ce0f519124d71d66ef9d9518e3e75b6c6fde8dc506bc2dd2aebed4e595f0eda2cf45a60f5c8d71d41f84adc92bc3e0e1
SSDEEP 49152:tB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glnBZK9G+umJXD9:zu6Jmdxd2dnBZDoT
TLSH
T17FD59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7b189c20251908b0b1b8c0d1eb49d7c1bda3c7781db82f26188345988eda6dd6
MD5 1c7bc96c1545e8a6916ad3015de80065
SHA1 9b554b2d7c292a8db9a39dd0c3b57e5c2f6242c6
SHA512 b65e64aa3ae22ac93812e6b6dd0b9762e7a820247a70d5e8b1a57c736cbb90ef607ba07da6259766f99b3533fa46005636284402402c41b8ca3112766b5d9586
SSDEEP 49152:U1hpsNoJpF1A63U44CwH7R4xTBZK9G+umJXD9:UmifPWR8BZDoT
TLSH
T196B5BE13F2D900E8D05ED17887569632EA62BC460B30B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d68a780cb7ba75bfd1645f59915a6505e04f6128949b0f76ef57a98f88afa748
MD5 92d9fb8fe0cb2e9f96a5992fb74db333
SHA1 716ad3d325930099aa0cad64318dc5d417a9a246
SHA512 0d3ff4c1d3faf89e2c7e5e8691f28afe2448a4b6b615a1db774a03882a3b3a9de6e06d0ab1502302b2501491ae57af07d9de49823fa5c530069ebc604c758aeb
SSDEEP 49152:TSuZQIY0Be2KcRVtOnks6NMHqCBZK9G+umJXD9:R5dKii61CBZDoT
TLSH
T17EC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5b78bff8d606f77e4d701013871bbaf0e1b4d8630e242b8805af6b601cb6d4bb
MD5 a994d1aef2d3415fb5366839e358bfa5
SHA1 c8f930a3ecb47dda8f52b3b8d10e640fbb51aa99
SHA512 5d0b1459897bafce5512b2ac28ce55f730932082da5399b98d34852aa70245e941b36aa006ef27cf23196e21d8a38eddbea765c177dc1308416219d524aa1468
SSDEEP 49152:0htSn8EApI0fig3giDn0AP5wXBZK9G+umJXD9:VX2imphIBZDoT
TLSH
T1C095BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 727c4fe1f599b6d8eaf6bf01c5d527a4e7004622755a27e7f789775879da904a
MD5 9beda06741fb7e841c13f47c39c9559d
SHA1 ed5079678afe5d6f40f957c9cf12d4c8776d7b59
SHA512 bac0230a3c438b0c24d327c4d103c99a1d7daf73acbcfc483b7e0c8de961e0cb4e235f8c39e3d904b776f02c573e493359e576f0ae8c48b2a9656d04fd224a10
SSDEEP 12288:G1wH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:Gpgu5sdLvK9OV+umJXeetXY
TLSH
T13345232AC4AA58A3D74797B7C1B14B15C265DCEFFD4240B353C6FBA38B742903922762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 de969566a02b356bcbd8163793b2e9628601e6877393529ae99e0f80ed8a50b2
MD5 5475c45dd9d8129888ef5a902ffd7d72
SHA1 b83286f70e62428fc3a99972fa608e03de2bd916
SHA512 5f3ec5cd9c6bf1bb7f50e7723eaac160f117e08ea7ebbc0223f9a7e7ea0b73545f3df73a94a2f653566e729b433d3f79ca64d1f8ae0bd1b37dabce8f509f59f4
SSDEEP 12288:TWwH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:Tggu5sdLvK9OV+umJXeetXY
TLSH
T1E545232AC8AA58A3C74797B7C1B14B55C265DCEFFD4240B353C6FBA387742903922762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ea2fb4d7acd837b3935273c1ec543de06f08bbabe217545d9960dd87ed22c418
MD5 c0be5f13d48d98fc70fae314fbc3ba76
SHA1 85d050460cecadafb719cd127a557cb24346ee46
SHA512 4e6de305ad71c3aede983b87b207e6ff61fcc55a10e9bd94c5091f77d6f688433a87a51106f08990347f4176676776fd6b701de7495b20ca6e0fff24b8346f4e
SSDEEP 12288:2UwH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:2Sgu5sdLvK9OV+umJXeetXY
TLSH
T1A745232AC4AA58A3C74797B7C1B14B55C265DCEFFD4240B393C6FBA347742903922762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 25e0586913b6232f2214be7566b83166a01de5378316cb3a01cbd8f73c25c720
MD5 18f67c14233d6169e79955a5a586c3ce
SHA1 860641de9563a02cedfd57780cdd075ec37a0744
SHA512 da4bac9243e9fc88b5a70302a018765d26c743276c7fc09bafb280d921616261b4c325471396a2e9d5a44a0cf4ec7c5ce5af610bbc78e02d68221a0337419561
SSDEEP 12288:jVDwH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:9gu5sdLvK9OV+umJXeetXY
TLSH
T1C545231A86A954D2DA57D3B6C5B14715C3B5FCEABA1290EB43C1BAA70F703D03D31B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 75e19c88f3e91d987b1871330d826cd9cce967ce2ee57eb9c3ff1c8cf87c4a52
MD5 b363a40fe9cc39e4a037248460c17eb5
SHA1 e9ffaea1c3de7e3ea6738aaf81881b3fde2959a0
SHA512 e6e36d2b3c88944a8555ae81c1a0b733b6abfca13bc9ce8c60e9ae072cb4fab1b277b725cbf55e433131d35485e161e06061718b9a29413608b82afa4e118a9c
SSDEEP 12288:w7wH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:wbgu5sdLvK9OV+umJXeetXY
TLSH
T10F45232AC4AA58A3C74797B7C1B14B55C265DCEFFD4240B393C6FBA34B742903922762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e206e1252209cddd715adca3bd9c9f2ba095e7c39179464f1cd22b9bbd70fe7f
MD5 490d014d4550e2944cb5711a31a4f292
SHA1 2ac3a7af32d6886e7e9f39c3d982c5d4b033eb3a
SHA512 f9481157ec95671e92df59bddebbde02c13eac67bfb00322d061f2f88fba079bfd9cdcbcd46f01ea0b34c0180a3fa1d34e6a1038299bc49a700675b4ccba7122
SSDEEP 12288:UiwH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:UUgu5sdLvK9OV+umJXeetXY
TLSH
T17F45232AC8AA58A3C74797B7C1B14B55C265DCEFFD4240B353C6FBA387742903922762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 518b832a3f2a1bec1ee10b79b3ff962da5294e8d742f06e7d3537666698ffcc7
MD5 960402bbb53311b1212566024a9f5ddf
SHA1 24b3c28b2d36232186fd14a471e59980a7f6b258
SHA512 cb9c092fe5937d4664b4720a358540e8eea3b16ddf6111a2917a6f3737f4f67c3f7e594fb88df218675d207179afc8c1d8f03f63a8c1d9daf003bc70170ada23
SSDEEP 12288:MOwH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:Mogu5sdLvK9OV+umJXeetXY
TLSH
T18F45232AC4AA58A3C74797B7C1B14B55C265DCEFFD4240B393C6FBA347742903922762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 accc600abf33499ffa7b30c4fe6e80417a5da9eee10fd2f3583c71ec443d4975
MD5 49090b795577309ac85db2ee09d35337
SHA1 62f2ac67a47c8f29b78150ded3802735def6d335
SHA512 947ea2ee53a3e3170f5211418f89048670631953b546771bb088cd565ef8a15ee8c5077f83a48486cb0ee163ae47d39053d833a74f6d258fd1a798f8e1c230f1
SSDEEP 12288:UiZwbVzzFEoS2cPvy2wH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:3ZMRzFVSOAgu5sdLvK9OV+umJXeetXY
TLSH
T189650255B39018F5DD67823EC9658A06C2B2BC6A5B60C65F03E437674F333A02D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 440d6fbb45896037e68eb8dd0b977532918b31a6876582df4104611c9c0de24d
MD5 382b33f821180415eca55d4a3efda2ca
SHA1 a342781eeadfb62a729307e2075c4afd33fae8f4
SHA512 480b9bc7e0590ac253b062c42fc7aabfea3a8dcb1095dce768541ed76287e1c9a2f55c9ee93b9d549e9f852269c7a6baf924984ff6797889ed691b4dbe7724e1
SSDEEP 12288:/JwH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:/Fgu5sdLvK9OV+umJXeetXY
TLSH
T1DF45232AC4AA58A3D74797B7C1B14B55C265DCEFFD4240B393C6FBA34B342903922762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 1934df0895bfe48ced0a99317370a1d34e1bf2a9f48f05abd986c8840d92c72b
MD5 f725792c9c7049959adb3b36974b10a0
SHA1 c746896877cf977db8bc17770a000166ca4088fe
SHA512 99ff83b3e54f1300c2b8fde18c0a29ca0286d06b17d030b2d186ef5d6f590270d5947ab2ffca51e7d5f437a508a206149885ae321d1a89c9cceabc8a4141f8e7
SSDEEP 12288:edwH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:eBgu5sdLvK9OV+umJXeetXY
TLSH
T18445232AC4AA58A3C70797B7C1B14B55C269DDEFFD4240B393C6FBA347742903922762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 8d4d27e052652b196bacd84a339b89d134edfaa7bcef03e94a8dad71a0edfbbb
MD5 c15b95dbd2f8baf830a202ee9a5cc5c8
SHA1 722666df50d5c1757b1ac10a106110bb054af591
SHA512 a1f7455c8d54c652666f17bdd9e2fd55d601c3cc58f30a82398d22863c7557f544525f46a4e6b8dbca9ee8c7cb1ed7e2e81681f272066d4d963c8e6fc22c7dba
SSDEEP 12288:5yPz5L8qwH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:4zysgu5sdLvK9OV+umJXeetXY
TLSH
T116550217A2A530F9D1679379C8A21A01E372FC765B1089AF13E057B71F372D06E3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 13e05e968f922b4fddd6cfbc073889b25fa665e2aaad82834a196e83406d0d88
MD5 f129d691729df44d0f4b04ca3564dc00
SHA1 fa0cd165de6744de9824d99f3c049e15deb3d908
SHA512 2dcc47d51ff8ddbb9c122a8b555bc887a22109e64b9a2b1adc3e16fdbeaf79201b868804a0e3c78c60ba4c61ba2daec3de18285bfc5978609a58cbffeebd030d
SSDEEP 12288:IJwH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:IFgu5sdLvK9OV+umJXeetXY
TLSH
T1C345232AC4A958A3D74797B7C1B14B55C269DCEFFD4240B393C6FBA387342903922762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 a75eff28ff926b0aff87bc2916cf28eb9928d9632721e2012bf15524e2dc3d59
MD5 7fce5b5957127902621841ad07d7c899
SHA1 988c18f688bf750be894abb34e1fc41e98713def
SHA512 2cbd40757af749ec544fa98ae0f715a4639cfe2489fd8cf23343a2f6072ac7771e0532776af66f9bc9bed0624c0e5fa569ccea356dfa62b2936834b2fa5d9f07
SSDEEP 12288:bJwH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:bFgu5sdLvK9OV+umJXeetXY
TLSH
T12245232AC4A958A3C74797B7C1B14B55C269DCEFFD4240B393C6FBA34B342903922762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 98593edac8c3930b686add22c7c9e977512a13ed6a01f10d3b8711252fd0f99f
MD5 ef2616ea67d8201823aad724f93c00ab
SHA1 bff8d9a42b777209cb020163717ddd9460af1c87
SHA512 25857f9aa24aafb9036bb248a314451766842fe9b2a91ab709c334199e7725f08edcfaf3e72b23999c59de659f81a0587d1763cdce8ed17970a21e8bb821e724
SSDEEP 12288:LyPz5L8qwH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:mzysgu5sdLvK9OV+umJXeetXY
TLSH
T137550217A2A530F9D1679379C8A21A02E371FC765B1089AF53E057B71F372D06E3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 a384f3e03f1530b5f1cb106c5f0ae2b7b231b20d567602a2396bc100fa07ad53
MD5 c97738d49c309677de2649ff6d35ea6a
SHA1 3aa8508f2dd231cb1c4fa74529c63cdd5a492190
SHA512 5c6a0a8537740b9d3b7063da3d6b859d20f543a6cf623117858ebdf8b1fd1d0f3a9c3d7970d94801f3a37e762ef8619fe65db90eab902ee085011f6be03e0f9d
SSDEEP 24576:gTDaLl3z0zDCgu5sdLvK9OV+umJXeetXY:gTuLljgBZK9G+umJXD9
TLSH
T196650265B39018F9DD67823EC9658A16C2B2BC6A5B60C55F03E437674F333A02C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 b033de8d30457f45f8a85efee766410eb46f0e484c32516533f056bb384d6741
MD5 eb4836eeb48fbace77f39c64f90be4fe
SHA1 702cc1f40c4a6552cb8d4531ea5fb160ca13b1cb
SHA512 80118a9a0c6bb84d3a3fe20c6caae9fd24b101ee9510f12f9f349f21a7141bf44bac22c58c9f31b05277eb96869954c6470229b285c0b81cb53d32f70474f092
SSDEEP 24576:93vd9CHKy7GZmgu5sdLvK9OV+umJXeetXY:dvd9CHKyaJBZK9G+umJXD9
TLSH
T16D75CF90F3E410E8F1B7DA35C9764511CAB6BC9A1B21CA8F03A4665A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 b3fc1d4af208b73ea10f2a0df5c6d21b5039ab5eb86ada7499b84711350744b1
MD5 c8330d4ccf41091fce293235e84e3a2a
SHA1 a39cc059809a1777eaa585e4d6462ba301669cb3
SHA512 6c3ecf052b6a91737cc5aa1ec5e039c61df8a60fbe324e21a7afccfc26603d4440e8af8f17cd0466ae76c18a60a3f391be7571dc22cb3ce0b528ceb206bf367e
SSDEEP 12288:G0wH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:Gygu5sdLvK9OV+umJXeetXY
TLSH
T10E45232AC4AA58A3C74797B7C1B14B55C265DCEFFD4240B393C6FBA34B742903922762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 6bd2b6fbce7d9c38455b3bfd166d7afc1bd90db18d1c6104448ebe8a7bd34cc0
MD5 bf455630315279c374469db3c84966c4
SHA1 efcc4a38d7154b0ad443a8e255a55e91130b8e25
SHA512 8a79c5e4cc771827b845bccf179ebc91c34d11ee3f045bf57c86457bdb0bda3d2381af3f1ba2a184e59fb7096ff3e3206bf8db53f5bc66bbdf5c6dd8ea1c5551
SSDEEP 12288:yKwH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:yMgu5sdLvK9OV+umJXeetXY
TLSH
T19345232AC4A958A3D74B97B7D1F54B15C265DCAFFD4240B393C2FBA34B742903922722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a6693bca0819ab70ad93cf1907b1463cf81c3901300b524b1df04fd78b28e026
MD5 3a17129ad05e0813d509d70b56d69de6
SHA1 d121ca6992a2ded6ed06171ca4144e785fed9215
SHA512 bd03827606ac5003307e6c14c801c2c047473d8ca926685e83b355ce5defed5af2968d6e02436cbf6acff6580a49346c891b1340adf9154caa369e18daf11e07
SSDEEP 12288:4XwH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:4vgu5sdLvK9OV+umJXeetXY
TLSH
T17545232AC4AA58A3C74797B7C1B14B55C265DCEFFD4240B393C6FBA34B742903922762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 24ff554c5b672c2b05b5dc15968861dfdaf158f71291ea6d34ba18f67b6b9f7b
MD5 e0bb6f8833ee67bddb6d49b7718ee677
SHA1 e791ba76945317387340c45c12af87e3a692720e
SHA512 3c0d5eebb15a0c2776f2a3d6d499b2277674d874b0b17114e3467b1a3f8ea014b057980294c0ba8f1ba7d715c7523ca9239442302646d70633c5a4edee7dca92
SSDEEP 12288:pbsfZwH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:E1gu5sdLvK9OV+umJXeetXY
TLSH
T1DA55F11AC29801E9C16EA276C7654A41F333BC6697E1D2CB53C0F67E0F356906DEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 ab75dd77009ca5622b28cc6a59ad0b1a2246706159a76bdb1c794eded7ab9186
MD5 c9b04a4b11923c85f81db6bb131382aa
SHA1 89feb930ef235278bcbfb453baff5f45dfe31a5b
SHA512 4afb6e39c99ec058534657c65e842628d020fc67c4e9eac5d4e84a9527c40a11be367ce15af996e486559d0acb71003fc51c4f958ee3e7db0e9de2bc6e5adaa0
SSDEEP 12288:3+wH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:34gu5sdLvK9OV+umJXeetXY
TLSH
T1E545232AC6A85857D7A79772D1B58724822AFDBABE0180E3A2C1F7E347345D03D32717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 4a1f3f4857d84dc98ffd65196efee9993bb2011b1bab8788118144c185dd87d9
MD5 4196b8b75b7bb79e4f9ff854fb233069
SHA1 cc5e75c19da03120df134a981bd57a357f9be9f2
SHA512 f053b0d5e94709eb3e2dd4534bf64c6a9fc8a75562b7f39be4f06bbbb5af879eb7b24c66eea9d54e5f0ba60247c78976917bf2dc65b9e4e924ff719effb34ac7
SSDEEP 49152:6a0h2GEkuAe73q3pp46zwwQ7BZK9G+umJXD9:6a0hNYG4JwCBZDoT
TLSH
T1A485AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1191853D3F37DE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 df19bb1b298f74339174ad29e1115fb68d753cf98489090c797dfabd79bdcd0d
MD5 81096fd776eeb1e83d3598f6b14b5802
SHA1 4017d8c6989cb926aad538eccce88c62f2724f21
SHA512 2f0ffa3a8deb20519d5d20cbeef8d6fce063f479bf9173ac639717035179f651c4ad0ac576f519c21d3554327d043ea93659a12206d5e26761625a6288d34abc
SSDEEP 12288:RhbHjfXSwH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:RhbHjPkgu5sdLvK9OV+umJXeetXY
TLSH
T1D755023E56AC20D5E672E27DC5A18606C331FC662B1193EF13D192BA4F36AE42C35F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 fd305cb372a9d932f7c461c88a3ba4af35d6983fb39ddd41cc8702ffc2c5602c
MD5 57e289b90f73b2daa82c593821e331bb
SHA1 7faa5d9336b364f694c863d60aef162ffe5dbcab
SHA512 b42d9bd3417c27a9334ae491cfa50c30f2085124d002dda3d20d6f3da187ad66e67cfe6e9611b83e4cf0efadc59697f9e3007861611d00f6355dc04a8f5e55b2
SSDEEP 24576:t3YgnJcRTk4yti+R5dBR/sgu5sdLvK9OV+umJXeetXY:tIgnaTk46pBR/BBZK9G+umJXD9
TLSH
T18C45B02DF2B910B9C8A6D236850147B5FB71782D1F209AC701B0C539AF1AEE85F35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 200f17df39ac31ec79e7f505db42b2889edb62eb155b1eb35048f78d9e905f5e
MD5 06643da9d35b99bbb632992ccd9f39d6
SHA1 61dd93c373a104a91d9b02d33b4772ce806eb434
SHA512 a7c29e04fe2c17f4e24cd0eddee6947e8398beeb30b06d0abb05f0a6c65d07cbf8297bcbaef7552ff0c789e6411a40fe613874b5d9544b6513a3b3bb4e3439ea
SSDEEP 12288:riwH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:rUgu5sdLvK9OV+umJXeetXY
TLSH
T1A545232AC19958A3C75797B7D1B68B158264EDAABF0240F352D2FBE347346E03D32712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 3033ae9dda9b2ba00b541c317f4fb1e548e472e9c6d275e1d12a654a4d97e9f7
MD5 96fd7bd7feccece637345becca57407e
SHA1 1140bb9af839bf49c1b64a584a8b9a4f08136aa7
SHA512 3f0978f106c77c7021b6ad9632c05f5d09f683071c56f6cde0c6389300647c9ec33a91dc87257356eae544f2a4835b123e8e107ed0c0db60c490fac0e856d921
SSDEEP 12288:hObfA4LWOsvAYFTbwH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:WbL3UT7gu5sdLvK9OV+umJXeetXY
TLSH
T1C9750115E7A400F5E967D23DC5B28A16D272B89D1760E7EF03A88B660F233E15E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 8fc4943279f23573b7dc36c540536e2b9a1a0d2a2d9da8da1e8c84c9a59ea067
MD5 e41e758a05b7d3b0d23c9fab30dd0149
SHA1 a650452a582f9bd2597ce15a3652da1b5e0062d6
SHA512 397e66a893f1b98209de6c71c36a7b09caa8fccc249f6ead08ac573b778a5af88ee20572ca9def99d78def0023abb25876f30d06bb4c1539e453852b69830059
SSDEEP 12288:NpFtIOfwH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:8Ongu5sdLvK9OV+umJXeetXY
TLSH
T10C55022A26ED10E5D576A27DC5A28709C371FC661B1253EF02D092BF4F63BE42C36B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cd70ac4d6d3ae66341e57151ec692c8215c16dbb2b4fdaa93482cbc385a96031
MD5 326e55b833e0ed68e00682628c1f8a8a
SHA1 2c6a15641432df9a73faf5badff33b8df36a3a91
SHA512 17851744fd3efa26453ef8f231b87d5774ea6900fcf2cae03e0da744d464c5a676f138afd5161fc8c17e15ebeda52ac91a354c8f9ac73cf898257e1fe8469942
SSDEEP 24576:E7NM9YqZqmWMUkPjZM48Mv6bEhsogu5sdLvK9OV+umJXeetXY:E7cBWMpPjN8DbEheBZK9G+umJXD9
TLSH
T19465AE2E6BEC81E5D577D13DC9E28205F2B2B4611B318ACB1162833E6F37AE45E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 82fbcd354755a355a0086d047f8787a87be834bf4d0e70888b2d3d94a6eab752
MD5 e8a408bc22d33cac6cd8bb4d901601a8
SHA1 a961fe500c5fdd8ca54e01aea40f0c20dd5f0f25
SHA512 1d7a8e8b7ead194147f382f12927d0a347cea10196e9b93b1ea7fc7a04a6ea9bb4d5d3152cf3e94a97a03454fa0afe3989cbda51f5d2c7976dd6e130af1a059a
SSDEEP 49152:GF2YuHNETovAvNYf8km9BZK9G+umJXD9:H6BCf8kgBZDoT
TLSH
T15C858E2927ED80A4E0BBD27D85B7D246FAB2B8511B3055CF0255862E1F33AF45D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 ef32fb6eabf94e95766234c3d24d0718b43daad2657c51be4be65ca9d36fb2d6
MD5 86b3dea86e8fc78781bfa22b915b16b0
SHA1 8cbc65a1dd7de19d281f1786119eef5b49f5283d
SHA512 20f15303b1d6f9c36da48415f9d39bb8007b41f2a17bc0c1ab827744231ad09fa0d9279dfedbd05fa9282b9dd21ab195dc777f4b8007c7347aa7c324fe8cf2bf
SSDEEP 24576:kAFs06+OmlfkNXEbToTgu5sdLvK9OV+umJXeetXY:pFs060lwXubBZK9G+umJXD9
TLSH
T17865AF2F62AC00D5D07ED17E8997C91AF6B1746707215ACB0260C67E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 789a17eca99b94049568c20a94465b8795fad7f13e5ba5dab811d2d2c44f5bb1
MD5 941c553dc20ac8d60266aceb85fe8c23
SHA1 1616c8a0feff255d54cd35bc3abca375c2a9d0e4
SHA512 b3a6d58bb9843fda50a13a4228af8b70bf999d707ea5c32d81c5cba0c359ab80279750f70e4e05192b1b9de1df6db82b994cf1080b0f03519b056960a5abf74f
SSDEEP 12288:OCJnJ5D3VkrDzxuwH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:fJnJ5D3WXygu5sdLvK9OV+umJXeetXY
TLSH
T1F075D02DD2A810E8D4B7C3B4819A1B56FE72387D2F2269C724B4D5353F12EE0A979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a37ca64f283422cbcc5df4eee9d67a8643a2a830548ddb1c5bd2287d7820cf5d
MD5 98f4ccf0356815d9c9e15eb5229a3a73
SHA1 8f088c07c9f9f9bce44aa0c4326d23b5d98dbdbc
SHA512 9a7388facacdceab945060200af2fc76429d5681090588e98d40fc325136fdca96d9f32a0e2431b88a490f72e0f989bf0053e5a5cca84416fe2793981e22f840
SSDEEP 49152:9g06DIKdwc+eQnSt65aVhBZK9G+umJXD9:WvBZDoT
TLSH
T191956C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 6fb6913eb34c3e7ca5af4b944e53d2739ec652cd97adbb881e125c80c30a0bf8
MD5 ff93194714f88ad76e57b5ebd996a5e1
SHA1 9953bc49c7f25de620cd4c660a4e43f9710fb5ae
SHA512 66eb385ceb57989e667b9d7f95c26165a3a5cda7b0f703b7b57405530198b8d4a749d075457a8043181b86b0b091865e400b96b019d2aaff6c32a17eb993e4f9
SSDEEP 12288:pEP3RnvwH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:6nXgu5sdLvK9OV+umJXeetXY
TLSH
T16E55122E57AC60E6D226927EC1A18605C372F4B56B0227FF12D1D27F4F36AE42D39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 42bbf4f793d1aaeb661e6eac22c54e48ae37adb1630ff0204f312a91a0ba4d74
MD5 6927e50e05c362a00a88478b6c01530a
SHA1 271c90d6b3ab3550375e4a2e966a69c222dcd62a
SHA512 0b9f677898ddb7e091e7a09b7262e1b5b8e1c13c6b2a2bc3f714eaf5f60adda64d70beface9f08ec2908c2f71a6188079862ecdc77ba3b0b60b3434911a15329
SSDEEP 12288:HjkyNwH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:HIyRgu5sdLvK9OV+umJXeetXY
TLSH
T13855120993986095DAAA4779D5B282A48A35FC71AF1192EF51C0FB7F4F36BD03C31B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 93ab6d8a1e23f16bfce9adb2f75daaf99bcae71aba3806850a73df1faf368f26
MD5 37a145c85c34815175159c6f224cbc6f
SHA1 ff349b794a987324d92a67aa39520d588a034f70
SHA512 0730e01ba0fb66698dd8e7f7f6ea64645e6e9db4cee350689493be31307b7de69b37b471257ac6a4f51254019103f3bb139106088c0e86604515db012d78b3e3
SSDEEP 12288:QyPwH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:t3gu5sdLvK9OV+umJXeetXY
TLSH
T14545232E81A964A6DB5797B6C1B54B158270FCBA7F0250F712D1FBB38B342D03932B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 b097f3a9acf77a79b326153a16167c654d9f661cfedf117919401ff5caa4b5c6
MD5 e1d326651d0a1b8278e1c80d514bdfa0
SHA1 c7dc0e98f011dc636049a02f3fd9004c3e600e24
SHA512 6faee61ad9973f68245b1fddd750ede66214dfe53b7d0007e32ca93e2ebdd0f36eeb5bd0e5ad144fe5a0f9bba07408fa00371ca738d60d9b1628f10513d9b179
SSDEEP 24576:LQ9MxZKdcz9dw3Agu5sdLvK9OV+umJXeetXY:LVKZlBZK9G+umJXD9
TLSH
T1EE558C2DABE9059AE177D275D4A250C3A633B4311B31D6CF2448D03D4E7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 1e08534f464f136e52b28d0fceb1106192b1c3dbf33d8aeafc91cc6aca925615
MD5 a4beea742757521a637d71e98a495195
SHA1 c689a5ff88dc0e749b6c95d959d0ba8ad74d5e8a
SHA512 a3a7fe8d13d7183c9d1896e2558a9daab3d110ca8503720d0c1b142129c3c334f8315105c884db43ec0a2bdbde5a8446fa03ba72944d236c7758218742dc784a
SSDEEP 12288:RyoKo2JRple9phwH+dJ6Pu5sdLjrK9OV+R/XumpEz+sZBoXeeICOCY:RyocDApNgu5sdLvK9OV+umJXeetXY
TLSH
T16365E01FBBA940A2E166823CC9858745E773B4706B5253DB52D1C33E8F27AE87D34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ddb3d233032a0f08c6f07f423b340ee4022ced6a51321dc482cad5f3e1f38305
MD5 aca5a9f34de7be9d2decc2d144662954
SHA1 be417c7249a935c7ca17831430949b824afab241
SHA512 91cf6d8df168f6ef7f8e1d42a78a48e70f202e203f1f1535be39a90e6fe2fe4551153a52bfc7c2194aa08a292c5b3fa7fec32423f75a49764074750b9e6c951b
SSDEEP 49152:8WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKKBZK9G+umJXD9:20zuNI0BZDoT
TLSH
T195A57B3DA2BC00A9D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 079e5b18a75a562fc1463f35aa25e79d1174f6e9e70e98850e795d48e42f6c7b
MD5 a877f013ccad6ffec2113c6670563783
SHA1 75ba8bab0486422dcdd13a97326f71b93f5e2148
SHA512 3d042766b29dba45db2995417bf4d97d08a826f12815d9982674d29746a6b733c6b8ce8cfe2d2cba0dd30cf3f5874aab5aad8c6b93abbafaa0c51f41f101141f
SSDEEP 24576:f1QT7EcpfxR+N5AWAz3ooiYujMqbXgu5sdLvK9OV+umJXeetXY:iTDxR+N5YzT4jM7BZK9G+umJXD9
TLSH
T18755B02EA7F815E9D17EC6798A23C512FA727821073193CB42A0C17E0F6B5D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/728-72-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/728-69-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/728-66-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/728-64-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/728-58-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1272-0-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/1272-1-0x0000000002380000-0x00000000023E7000-memory.dmp

Download

memory/1272-8-0x0000000002380000-0x00000000023E7000-memory.dmp

Download

memory/1272-34-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/1312-418-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-431-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-415-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-435-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-436-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-437-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-438-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-414-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-439-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-441-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-445-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-447-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-448-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-417-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-449-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-450-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-451-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-452-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-453-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-454-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-446-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-442-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-443-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-444-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-416-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-440-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-432-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-433-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-434-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-413-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-419-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-424-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-426-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-430-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-420-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-429-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-427-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-428-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-425-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-423-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-422-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1312-421-0x000001B471A90000-0x000001B471AA0000-memory.dmp

Download

memory/1792-55-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1792-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1792-47-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1792-234-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2192-407-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2192-329-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2192-275-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2324-411-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/2324-305-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/2408-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2408-68-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2436-235-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2436-74-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/2436-82-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2436-80-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/3040-406-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3040-282-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3040-283-0x00000000005E0000-0x0000000000640000-memory.dmp

Download

memory/3040-289-0x00000000005E0000-0x0000000000640000-memory.dmp

Download

memory/3484-320-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3484-269-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3484-267-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/3484-262-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/3528-403-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3528-279-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3808-12-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3808-232-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3848-330-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3848-401-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/3848-340-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/3848-409-0x000000000C920000-0x000000000C928000-memory.dmp

Download

memory/3848-356-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/3848-528-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4368-45-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4368-42-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4368-233-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4368-36-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4596-312-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4596-309-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4668-492-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4668-323-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4688-24-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4688-16-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4688-25-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/5124-477-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5124-317-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5600-326-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/5600-511-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/5632-254-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5632-256-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/5632-316-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/5728-294-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/5728-300-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/5728-302-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/5728-408-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/5732-313-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5732-412-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5736-321-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/5736-274-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/5908-308-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/5908-244-0x0000000140000000-0x00000001401F8000-memory.dmp

Download