55951759e05c2ca5e0d2a0659dd6b2097f1db16e19bc4b24f63052aadad02abd

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 3.0MB
Sample260930-cskvvavx7r
SHA256 55951759e05c2ca5e0d2a0659dd6b2097f1db16e19bc4b24f63052aadad02abd
MD5 4368b165ca951b9e05caeccd35746fde
SHA1 284d86216b14ad10c0f181e5ed7b4c8e661996ff
SHA512 2b79671c994ede3d4b6d7cbfe811014627a0e05b7950cbcb4cbc9ffd105b951446ca8fcc63c540574be68bcfb81d60638e8099889e8c2d4cbc2f56dc78b13d98
SSDEEP 49152:ZdF72dZhxSMmT8oWgBCaXFZt5TkFyAnh1EVRkhxSMmT8oWgBCaX:ZdF7G+M4FHX15Tk0AnMA+M4FHX
TLSH
T1F9E522207783C836E467513ACDBAD7295A5BBD300B5252D77B883A6DAF309D35A38307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3272	alg.exe
1484	DiagnosticsHub.StandardCollector.Service.exe
2636	fxssvc.exe
5360	elevation_service.exe
6040	elevation_service.exe
3040	maintenanceservice.exe
3812	msdtc.exe
5992	OSE.EXE
2744	PerceptionSimulationService.exe
1060	perfhost.exe
5164	locator.exe
3236	SensorDataService.exe
1236	snmptrap.exe
3704	spectrum.exe
1492	ssh-agent.exe
4356	TieringEngineService.exe
3804	AgentService.exe
1940	vds.exe
1188	vssvc.exe
2988	wbengine.exe
3344	WmiApSrv.exe
2760	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
\??\F:\	alg.exe
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d524a8844bb6346b.bin	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000064fb3a4f8250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb75f34e8250dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000098d6144f8250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb92b44f8250dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e601e4f8250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014d4334f8250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008a36364f8250dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
4736	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
4736	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
4736	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
4736	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
4736	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
4736	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
4736	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
4736	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
4736	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
4736	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
1484	DiagnosticsHub.StandardCollector.Service.exe
1484	DiagnosticsHub.StandardCollector.Service.exe
1484	DiagnosticsHub.StandardCollector.Service.exe
1484	DiagnosticsHub.StandardCollector.Service.exe
1484	DiagnosticsHub.StandardCollector.Service.exe
1484	DiagnosticsHub.StandardCollector.Service.exe
1484	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4736	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeAuditPrivilege	2636	fxssvc.exe
Token: SeRestorePrivilege	4356	TieringEngineService.exe
Token: SeManageVolumePrivilege	4356	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3804	AgentService.exe
Token: SeBackupPrivilege	1188	vssvc.exe
Token: SeRestorePrivilege	1188	vssvc.exe
Token: SeAuditPrivilege	1188	vssvc.exe
Token: SeBackupPrivilege	2988	wbengine.exe
Token: SeRestorePrivilege	2988	wbengine.exe
Token: SeSecurityPrivilege	2988	wbengine.exe
Token: 33	2760	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2760	SearchIndexer.exe
Token: SeDebugPrivilege	3272	alg.exe
Token: SeDebugPrivilege	3272	alg.exe
Token: SeDebugPrivilege	3272	alg.exe
Token: SeDebugPrivilege	1484	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 5412	2760	SearchIndexer.exe	111
PID 2760 wrote to memory of 5924	2760	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4736

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3272

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4308

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2636

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:6040

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3040

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3812

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5992

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2744

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1060

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5164

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3236

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1236

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3704

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3392

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4356

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3804

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1940

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1188

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2988

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3344

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5412
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 77cb795ca227812c2ab8f539d8948a21c26362be1bf720bffe405f7dcc5fcf66
MD5 da476b3ab6a9f0cef8de02c8c9fd5f59
SHA1 12394d23e74416ed1d2967328e32509bb1828f9b
SHA512 ab933a26ebc36de44051f9001619e0ac36470f1a86682caa07e1d373300bc0fec1ecb8d46142e72b03020b466ade16b3488f064d7e2d1c22937151e2dafad11c
SSDEEP 49152:pb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnIhxSMmT8oWgBCaX:/3q6HjBp+M4FHX
TLSH
T1FAD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 6a01d1cd6cd393d1fdbe3461847b15ed6ea32a6cf04fda7003b23227cdfbc211
MD5 46262452e9527bb7bfddc387c6ce2a10
SHA1 f35513336fb83f4c9ebb8ffb84780fab69d11348
SHA512 7dff15fbfe4f839951e8679833c04fc39bb8a17afe73c5700b7d94347836ec5df28694460a337bf120b49ccfaf1da03aef955027cc7dd4bd47c930a54c6d30d8
SSDEEP 24576:DXYfDtczAirKhxr+EHNmT8oW4ll1JCrLKXI:GtcKhxSMmT8oWgBCaX
TLSH
T1F085F12877D508F9EC67823CCCA28512EA737C954360E79B03B49A691F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 9500d872d1b1613472d3947d238e8826360ed024f96bb8f731de9b62ea1e1a55
MD5 86c33ae7e990c7ec1dbb009e97e9143f
SHA1 d20eafc34f840d575f0469b201c8c57be65896e9
SHA512 6782489b412a59042d2736ca7479c421487e32e3283386fa0d811ecd88d4e81bc8e2665859781cc99309a3c90e76aa15edaddee035d553671828fa4ca563197c
SSDEEP 24576:F0Le5ji0hmxYrMprKhxr+EHNmT8oW4ll1JCrLKXI:FPji0A2ThxSMmT8oWgBCaX
TLSH
T16295AE26F6748335D073C0B9C5D2A68AED71308657308ACB4296D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c9e07d93046276178f98aa487878d7b40b8b2da8596d4ff7c975615f0035d375
MD5 81919f784d282a6b78e0c85e1bb33606
SHA1 bde16eb201ba32f7713545f36ee286cc37413ce9
SHA512 4ab2abe8d538b188a3e852826f6e694be2bf131a5e4d6824d9b56169587f1ecd2ba7eb874161be5b5376c17975e4020b11af135833af34577fbb92f5eec3984e
SSDEEP 24576:Oa7/ezSC6vUyD/aqgrvWE6q8wyurrKhxr+EHNmT8oW4ll1JCrLKXI:J/ezSC6vUzPvxHjyfhxSMmT8oWgBCaX
TLSH
T15D756C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f43a574bf3e0c89d5b922898ba4923912efd61db59c5f562e72721b4c222e36c
MD5 8f2ee0df177c65f496508da92bf85d8f
SHA1 dfea9dbc87f31adbe6b90de516bbda61a3a83be5
SHA512 8770cf9db08929b23cc1c1b6f4f86b52967aa7297b11694c44b676c0bd702c72a33e7b2354eb8904ca26ff5fa66687ea91e4f81c2b5f81e36a3291a0dd2d3da9
SSDEEP 24576:gVbqPb88hv/l+62rKhxr+EHNmT8oW4ll1JCrLKXI:gVO88hXl+shxSMmT8oWgBCaX
TLSH
T13F559E66F6748331D073C07AC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 2a1a40dfeb4a6828deb50bd9bf29b030bf378fe9657b247ee2d27161e2839b00
MD5 c75f1898e00bf92ebdc833e5f4950368
SHA1 c04160be26bb9f1c999a8614899213288841b446
SHA512 46139d3de02c16b6693856259e3e7fa243b355acfe6f81e00c85248a6f3861e3eb160a94e8d9315555ddd2cfdd4fe6b9a2c3eaeff2723bf9754e65945e73bd4f
SSDEEP 12288:iH7JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:iH9rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1A26523759F0D64ABEE3B8335F872572299990DDCD1411E3B9F3A3FAC3934C1A9152212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 6dfe991b3a3f6280c9189162d9d2165feea324c9cb73831e59fde6599cafe375
MD5 6d0c8dff09c2cc90069f036c82af6868
SHA1 7843579a0f3fb3f17da4097005d512dc25aebe9b
SHA512 c8f73ca6e70bcd47e3b4a02c1702476a2e3dfdf173f3635aea32a618013ce0722e02ea7ecd2c7e58b0878e508cf0c48b920ba735d262e70cd6c07ba6163310dd
SSDEEP 12288:XeBNUbTVO86U+JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:XJIUerKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T16985CF3BEE28FCD2C67A8D785A918700D7B278704B52A3CBD175830D9E235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f7ae2bab05273337ec18670a4b1f8e9c212dba801005665256719f77c9f37220
MD5 4311d5010480201ebc34715bbe364bf5
SHA1 b169cbb7dec76e1eb2cc11003e0854a81e3c4a14
SHA512 68a7dcbb4e4141a2f614bf082866ac2e08b4cd2d92150b388dfc24b4f685787f74f4d72fd86b1de63ba07ae5f20da4f7e9fc0006e7c20cb8faf5b315018c74b6
SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THE:sQvGAdlCEL8c/yRNw5Cq+M4FHX
TLSH
T1B3266C656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 92bbeaa5283e83e02085917d9d48b81d1b988384da4f3227e8cc563f90ba75fb
MD5 0644862623ad96613bd481ca9b35e7bc
SHA1 46ee19bef7fb85d347fd7525d92bcbf14ca26f7a
SHA512 1a6f0e5757fd4c22f13a37567d2b0ce5b97faebbb92a3a59fcc1fb53d41e0d3ed5c222d3a67c2aa9c5a33781a9a7bd93e412066e9a88830a97956b974465f6c9
SSDEEP 24576:w7ewsAjwrKhxr+EHNmT8oW4ll1JCrLKXI:SljDhxSMmT8oWgBCaX
TLSH
T1F885E031FF74E036C67F0D766B36C716586C6A604B522AC3E3B88E9D59302D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 50399232485ed82fc56a325921e5c6635417fad571b8d907d6688aede47403ef
MD5 65d9627ac12b5ac75a018029acd4b874
SHA1 4cbad27238a5f4ada4ac314eebb1c11e40b1dbbb
SHA512 a190cb310488f2e7c9e3172cb6801b24a7075d36815fd68ac0cfe518e97bba8010b7fa9594b05aea0f5f94de9e18962b55388e8c470dba86019bcc6f6c197b40
SSDEEP 196608:GUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHP4:GUEtQevvqc2W1cpV2EI32P4
TLSH
T1DD474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9da9e6d3f6fc1195e149f3f76874a7287b255048d2c9cdc3220a4708afd123aa
MD5 ef50b589c3a5cf24e3d2b8bc3435581c
SHA1 28d118ab5e551202f7c4cac4a04de9a17fd1039c
SHA512 c82f582949902629aae2aeea65831b6b8fc753dbfc261ed7072f361d3b8370b23bffad981912409a3182a0c9ad2196fbfda0c8c2bee1a71df56ae2dc17a217be
SSDEEP 49152:WCbRquA/m2yL5zTfFiV+XenmE3/zjhxSMmT8oWgBCaX:boquVjnmG+M4FHX
TLSH
T11DD58D1976B8C1E4D1F6C37886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4ddb5eeeb8526a7bcfd862fe0e096f8babca03acd1f2093aef3cdc003e130205
MD5 0d5008dc984bb51feaa9fc4ff243e059
SHA1 baf1872f552425058aa01d8917d4adf633110a7b
SHA512 f6204c01a346d23b52d2c7a6af45334e03173e48be1f0f008af39f735024ce40b6524218d736ec6e12f37cbcf51fe0504baf6f9606c717dd8c79f28f9363c156
SSDEEP 24576:EAhGLJIFoiwtA5l7S53HrKhxr+EHNmT8oW4ll1JCrLKXI:EAMyFoiq52hxSMmT8oWgBCaX
TLSH
T18935AE80EBF955D4F5B3AA7899B68171EA76BCA95E31C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 b399b89d090afb3fde60c01c96bbdeca46907b5aea2f107dcbcbd0fdad9f27c9
MD5 3a1cde62fcd8ae932fa27a84c3fd0adf
SHA1 cfb684eda6d484aa0d64b04e650be9844ca7edca
SHA512 16537236572f47a956cb913352c31770d492d6312e1a69fdb98df11dd92ca9ba50f3fbaff3cb1a7814dbb3e156daf65fa0fc1ef3d3c4999c7c639a27f41d34b6
SSDEEP 24576:bwuSOWMrKhxr+EHNmT8oW4ll1JCrLKXI:bw9OChxSMmT8oWgBCaX
TLSH
T10985F14677A91CF9E9678238C557C136F7F2BC052621DB2F1770C65A6F33221AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 67e600c6cb2cceb55bc273ea6667af2d0451e17cc82a3958e3918b811d3c9288
MD5 84e0682fbd80be5f999968526d0244ac
SHA1 75d82c9fbcba8c50c8638647415c3ae350d46f50
SHA512 fe10e3b6264753fe7cb46e52d330cf1686328eb83ce17bf7777977cb7a362939f5af01da684dea8dad5d8925de144f4a45f77806f68d6603370660842125f41f
SSDEEP 12288:ZjZ1Iy0JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:lZuRrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T19475126A279870FAE967823CDCE14605D7B23899633143DF1A3547A92F33EC65D36322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8cf93f1770e6f591c0c7617b2fbbf65da09d01ad0389d03897ece302a93fab39
MD5 b5551437b448df4edf3d9b42c7ad9b41
SHA1 14214e9b2ebdf0d922c8956e2ccc0a2b2ab9d54c
SHA512 2d5641535ef2f21ca259a35ca8e409e46d6ee4667c62a51c4163362c1c3640007f4fe43e5179a537e3a25d7842e24b859ccac761aea8e6f1bbe09bc2dde3bc93
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uo:3QRQyi36YOcPQLvw2gAf+PN39+M4FHX
TLSH
T177667B13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 dce6fe6c8bf6ddf8910dd889a66745d58a9793ec7118217171e6b703b46c3428
MD5 b892455e17f69d56069c109d7ff8cc51
SHA1 1d22d9ba176aff5ece7d664c69e0836f9d89e122
SHA512 5adf45c523af4e5ef3c83f26850b3acc85b399f7852ab9df76214741bb92b7c72bd45a4b5c99be23bba1496d8e9aff84c96353fe92ca3c09620e21d0ab2a4e8e
SSDEEP 49152:ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uo:BQRQyi36YOcPQLvw2gAf+PN39+M4FHX
TLSH
T188667B13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5849bde33e1f0e500f59aea82fe73d0caa9f37116cf4a310c32087a0b941b0b7
MD5 99c7879c0309b215eca04c4e63311993
SHA1 974d70f46e44928b577920f494b619145b60bd09
SHA512 da9f84f4fe4550c61dfe6cef3b24c502ab630894d3ea1b214b76070de7ffaf943ad066c36581639d917ef9a951ee32a507633f2285fdb65b0349cb6acb8c3f02
SSDEEP 49152:568Qg55nhheWu7PNU3/ThxSMmT8oWgBCaX:HthWRc/T+M4FHX
TLSH
T1D5B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d9d2010e43b3dbee1b32cd5e307bc03c046bfbced821b126861053d3dd354fc4
MD5 1cfd93f8bc3d1eb088cb6ce3421b7292
SHA1 f1c29cb2d26321c32635baeda14d985850c17160
SHA512 2a5e24896b1a450a0203784b914dd78366285d25e85db1fa743a1526ccecc5cc82de94adbd61b717b813f734a25ac0cdc055e5bb718d55a50b773da8ca8dffa1
SSDEEP 49152:B3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99W:Ay5112gYy5azzVvL69nLKnhZE+M4FHX
TLSH
T159167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 10a0d89b6a6b25aacffd19ab3b196f16f3f6a1bd0c18a48b3f74c79df4766d71
MD5 cb5ac6ba4721fa21564829c41fe4c39e
SHA1 88eb81c2fbf8d806ab5411528e586114d83bd386
SHA512 2ea016b086bdc3a57dbe9f527e1f0e59ae855f7141dd8bb5a23bfc7561cc22b0eb690480fb19da3ed8a9e7cdf131e0864fc0b1f7e5e11884a3cec2cec5b4ab0a
SSDEEP 49152:uB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gllhxSMmT8oWgBCaX:8u6JmVxd2dl+M4FHX
TLSH
T176D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 91a8e57ff39889ab3b1a04c7ba2ed0d250d746bdeca707d1445134bb1f273fd8
MD5 9db2142242d41d64193ef3164f1c0a9a
SHA1 59235785b1c1b1619ca65b3f221b2530edecaf38
SHA512 027c32a6a39715cb23dc713f6cb111f294712efdd0e912bde042005c391f56d2da423dc4431ed47843aeeb9788f2dcb1074b2e2f1326caa9b4a352fd1ce5c548
SSDEEP 49152:t1hpsNoJpF1A6UU44CwH7R4xBhxSMmT8oWgBCaX:tmifPbRG+M4FHX
TLSH
T168B5BE13F2D900E8D06ED17887569632EA62BC450B34B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a9696d4965e5ecbc15609d32924dcd389fb9dfed9e0bf8315e7473d407288f50
MD5 d0f8567dc264a5d820e1428700ed3fce
SHA1 b8d49dd2857bbc399dbe749238d68ce6ccc248af
SHA512 2bb9603df520ebb12335d5f3192a1f8d0b4ff09af09078d95578e940ce3af76a2f53871bc354c625ab2a6290b031226ac67ba72b128cbf0d1b24c81dd5882141
SSDEEP 49152:sSuZQIY0Be2KRRVtOnks6NMHq4hxSMmT8oWgBCaX:O5dKTi614+M4FHX
TLSH
T125C5AE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9e951822abd8f2e8c55519286b2e48a6d2479b6ad200b6367f3c2fd1456c6713
MD5 0c6edbc8e8e5212bc08cc1cb8104a6b0
SHA1 c157e733d9e3f2bf08994e8a1ea39518fd85a7b1
SHA512 8dd8fa096f39fd614d3f8b9279ff6d0e54912d538d7430feb06b34bd81659b000f4bf813c74905cf8d8040d4fd2a94aec635a6494adc928e9f466537396fa247
SSDEEP 49152:2htSn8EApI0figngiDn0AP5wVhxSMmT8oWgBCaX:XX2iyphi+M4FHX
TLSH
T13B95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 4a385f31593162fd42795575a7fa7a911fa7cfe5cd27c77a600053d59edea587
MD5 235b1c8c90eef9753afe28145b22fd62
SHA1 2ea9bcd4ac4a44c0a248a688893a39f7faf7da59
SHA512 55d7207f03b580abd349343f58d65392dab287015769b03c171d3e363d3e695a0edc53839f30d5643fedf40152c630e1b8aae94e774d0fc00ebcb408884d8c30
SSDEEP 12288:/jJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:/lrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1E2652375AF0F94EBED2AC335E8620716D99C0DDDF202163BAF3E2E683B31C5A1552611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 4e196a238d23a23d6abca015f1df086c74cb140aa9aa332a431441231f2b8fec
MD5 f77671853284085975ba3107dcd23e0e
SHA1 aeff62693b7362fe29bfa24154ae24bebc088389
SHA512 088eb77c2936141e261a561fa3f6787a8a9030675f93ef29a884ee3ba371549e39a5b2b5e820b76da96b2f87b01a8002856c2662a0d99195732f06842571cad0
SSDEEP 12288:+oJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:+krKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T13C652375AF0F54EBED2AC335E8620716D99C0DDDF202263BAF3E2E683B31C5A1552611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 a5d4805103d9c7dd0fc3eb4ca908090d06fcc0509bb6b2d36e046b9d9c193668
MD5 35a34f505bc92c75c81d1c9bcd4f3e0a
SHA1 6e3c5fef2e9a67225dca2c1a8526c8476859b27c
SHA512 592ee0b926a3aa210ab0d89f2f2c20be3094aeb6590137fd21011b32c458481b7af3b0d6d896725c32f5e50a4a330b27b69e96a3a5795578542c29237f78ad10
SSDEEP 12288:FGJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CXD:FmrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T17E652375AF0F94DBED2AC335E8620716D99C0DDDF202263FAF3E2E683A31C5A1552611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 e1772a94aa7d75748c1fa5b68cb6ca28779b9a08f8de826d90a284876da28326
MD5 2969123661ad7502fd7aaa07c796bd54
SHA1 7ac38af32b1ed79d8d9c885334340067984b5c16
SHA512 9c4e5d6c59da6937d976af08678bee55f23fc63c7614c38d41175a9d2cf21fb85819aced40e6feb11f1957cb5841e7b88b6fcfe1c00c29f0c57cea91e8d8b257
SSDEEP 12288:3VRJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:lrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T15D6523656B0E50DBEC27C339D8724212E6F93CDCE322177F9F251E682E31A996931B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 638c784055d98f89f6055d0a3d1cb4b476a34c134f5e933669c203ff92c1bfc8
MD5 ad2a7c19f591e6ec406fa9dd74f069d4
SHA1 3569a2256c3394568e0dccb403ab96864824e89b
SHA512 1af1897793867302af7ce5bc2e37975c8e6d4986ca49487aa1813f69b72a835739d84fa009e3820a78ba979feeef102669ca3c53f2bea393b7ed0c5799b90889
SSDEEP 12288:WJJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:WfrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1FC652375AF0F94DBED2A8335E8620316D99C0DDDF202263FAF3E2E683A31C5A1552611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 f14c0b5307e0877d3b2964fc3dc7735add2bba0690b532b61583460b7cd855d9
MD5 0a680563b5d3cf80d69fb163da9614ea
SHA1 8eda328fd4a391b546a9ad4609ad512abd37bace
SHA512 c0b0096a1bf9f05f03b29ddab2726d88017bc6beee4425bd43050ad82fadd220bee32bd69bc5a87ca35594767deddfbf2ceb85dff09d569f96f6940c93b177a4
SSDEEP 12288:wsJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:w4rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1EF652375AF0F54DBED2AC335E8620716D99C0DDDF202163FAF3E2E683A31C5A1552621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 14dc807e9ea17bd3c348acd19a5ee6f3e9be106ec7b5698d00fd25a301dcd22a
MD5 80fe4d881bc4e1d2684360888bf352a2
SHA1 6b110298442d8170799fe7acd37123e36532c65b
SHA512 4ad59c295c77bb773a0088afe01014a87cf8f6e6898dca5f5594daec6524b98040eaff01dd3b499c8e29f621c2a2050a6cdf926482c1461e8d32e844c06938ba
SSDEEP 12288:egJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:e8rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1A9652375AF0F549BED2A8335E8624725D99C0DDDF202263FAF3E2E683B31C1A1552621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 4bb22e1f3992808bbbdde578d6e917f8bc185137563cd4dc99a2407ab8cd47a8
MD5 a7cd1b796d6c0c877272213975823b4f
SHA1 bf46c786f52da3b483985b3b3f7a4a0470c95f93
SHA512 3f098976c09ca9b6f2f38d71e71d3abe24c5bbe230d48c75779b4e8e01b5eae01181da00306a5323e720e5d4c851c6ae07cadd2009f236362f5be9371d0fd1a7
SSDEEP 24576:XZMEzFVSOErKhxr+EHNmT8oW4ll1JCrLKXI:XZMEzf7hxSMmT8oWgBCaX
TLSH
T1A98502A5B35018F9EC67823ECD218906D6F27C594760C61F07B8366A6F337A11C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 057f80ad13531dbcf2d13a56ec6271a016620704a2f0fe1f5afb271c0fe38e02
MD5 6ad06a9f2bcb9209b80d4f3492da257a
SHA1 37027a5c355e9b7328c77fa8fe8a3a644b52df75
SHA512 b1bc1a5516ab1fdafe7e20b38fde8ff9c4b189cfaa5bc8690873cd0e106368e110368547070c97522d5f6cb38e9fa9fb41ae6749b00ca2d62c9abcc3444e8f73
SSDEEP 12288:MfJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:MhrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T19F652375AF0F54DBED2A8339E8620716D99C0DDDF202263BAF3E2E683B35C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 e7b64f80134809dfb67b6f241929f9350f02e8d980fa4e20fbfbf51111c30684
MD5 08c6b0e53859a4d7971d8399454a2a20
SHA1 55b64c146cb21041f32cadda3ee8356dbc08a65e
SHA512 75a11bfb287c60088970c26a9d6d079fc298a01960961d30bdbd5749a001693439e956c75203fc7bcf18c3caa96488d6684d4b465ce8a5f3aaa1fdd98896320f
SSDEEP 12288:2rJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CXV:2NrKhxr+EHNmT8oW4ll1JCrLKXIV
TLSH
T174652375AF0F54DBED2A8335E9620716D99C0DDDF202263FAF3E2E683B35C1A1552221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 c13edd6b0cf4d37db0289732db08a0df2188ecdcaab764ac7e3248e222f22280
MD5 1da81788b5d3fe01b93f889c9c982465
SHA1 0d45d01dad805055fd32ebdbf69a3b1cee3f1a7c
SHA512 17bbe81b1199f3f24f8b31fabaa74a045ef4fe349a353bc2770cb77558053020a000216d1dde8b2040f9a39e904978eb799aeaefff2055422f8b2b36fba995b6
SSDEEP 12288:NyPz5L80JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:kzyArKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T197751257779630F9D5378238C8621A02F7B57C7A53208BAF5B64077A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 fc57dce2185fde8bd3e3ee22fc364d80f10d575414bc48b2318eb0f4078bdc06
MD5 786f54375e1e5daa0bbbe171b4bfd9b1
SHA1 97aadb5e53335fbe4f24475681e95f6cb82b50df
SHA512 034daa75f5b3f21d2c218c8de28674d59c2e114437b2094c660ff408a4178549409e0707ab571ca7ab5db97cf213749b29c70a9c1fc2143d18b8c1e915a559a0
SSDEEP 12288:nfJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:nhrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T102652375AF0F54DBED2A8339E8620716D99C0DDDF202263BEF3E2E683B35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 436189e35eb2ad3290b85400b1fe8b5023add8309adaabfc5633899486c27a9a
MD5 d4fca210abe5fe18e760a6fdebca3db1
SHA1 1f5cb0047325e94157f67cc4d4e5eeffe1504f97
SHA512 1ac982fe72ad7774ff3cf7fe21172fcdc147c065975dbd7920a8f5e7d525205c089a46db74192845bc4994562b94c4a8903028711c0ea3cebc705c1ffda3c850
SSDEEP 12288:afJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:ahrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T168652375AF0F54DBED2A8339E8620716D99C0DDDF202263BAF3E2E683B35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 355c132440f931e2293be97b8ebfb5a6c32709c31728644eb6852dc52c3fb493
MD5 567b18b9b1da88239a8df81e5a2be28e
SHA1 946e73022c636acacf43f4ea0b5307a26a696a9f
SHA512 731130c7a355b6153ad23c38878962177d9fb20c74dc6a060f90b6ed96d9c907f2b04a2d404076063947aa7986412cd6febc200cfcfe668c81036ad9319f22fc
SSDEEP 12288:XyPz5L80JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:azyArKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1D9751217779630F9D5378238C8620A02F7B57C7A53208BAF5B64077A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 9af6ca1507f0ab065627ae57ea8c9655aaeddb82aef3a18ebeee1facee9d4c8b
MD5 14234a919d96753e644e8dd09f51dd87
SHA1 bda81b8d75f200b4a01929a9aab9b3f0bed7d9fa
SHA512 9b67891522035c6d9b046e69ed01659b467bf7705290be38209d615d50238b97ec56595cc04d258486eef46ebded82f92bfad15e4a1a162e70b475a748b27638
SSDEEP 24576:1TdaLl3z0zDWrKhxr+EHNmT8oW4ll1JCrLKXI:1TwLlj6hxSMmT8oWgBCaX
TLSH
T1858502A5B35018F9EC67823ECC628916D6F27C5A4760C61F07B8366A5F333A11C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 395d124808f77c09545889293ef78c07a0c41c48d6498eb094d325f258aca387
MD5 6b7bce71618620d6d2139cc0275a18f5
SHA1 b4b46eb28503c28d7321c3eae10f0418d2d75f25
SHA512 2b0a6d877fe2f7e01339fd5a3ccb9033b783f85408e2a3c2595f87ee48cc0c3292355cc927fdf22e419234b20310d637a5abc7ad55278e378faf4ce6d9dcafa4
SSDEEP 24576:fcP4mcvIjkGOxhKP2l71SNKbrh/8KBZrKhxr+EHNmT8oW4ll1JCrLKXI:0P4m4IpOO67N8KqhxSMmT8oWgBCaX
TLSH
T1D965AE2DABDC0096D0BA913885658A4AFAB1742E1F3286CB1160937C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 98c0f5f0483db3d0f229d819b3655371380a59fb40f45234cfeabd08fe08920c
MD5 f55ac205a89b67fd78ae0b6cde31144f
SHA1 6d823c45b83e23094c54efb4c79b372603f872ce
SHA512 df23a06029a26ad6e2cd3a8089e4aae627f7775c883b858e70d167b14d1de0653035e9aab93601f6a2fe4b5a617cce0a6051015c864caea8644a017329188670
SSDEEP 12288:GzsfvJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:RRrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T16675F119D24801E9C46E9239CB524A01F7773C6993E193CB5BE0F93D2F36A945DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 fd6bafc525a4822152c404716b7b09c0b213ac84dfd3be3429c7361af6ac1d47
MD5 c22eec7bd957983fd8f98292a94aeb6b
SHA1 5538cfb603d14a81014ba6c866d01940922d61b4
SHA512 796bbea444875c9dd66f4581cd1eb663484d5d22185894e1ea6c9f02a40be2eaa64705734a2b9167553c5c6c4da79bb5723abb33eee2d148f68f5a5e86ad0fdf
SSDEEP 12288:LPJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:LxrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1B86523759B0D949BFD3A8334E8228335695D2DACE300556FFF2E2B683A30C565D62712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 e35f7ba3a78de0d357d90d5b34dabea113f7f43b24c8e9c144354d429993201a
MD5 a35920dd761c64fc785a1a67afe3fabe
SHA1 88839741908e1bc99d1ddd81c0c90f516e6a1c78
SHA512 4ed1bfa4112311a7a1a541f9413f78ab7048d40c30c80ac9ba122ce3191fc0793a8d59a56cf5839be1af61e93239a69b4c3d7ce9fd580664505898e6ad835e5e
SSDEEP 49152:Oa0h2GEkuAe73q3pp46zwwQehxSMmT8oWgBCaX:Oa0hNYG4Jwb+M4FHX
TLSH
T1AC85AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 e8dc8c504a06c26300706db7b384323c13be7a1c15defdfa36723cf18245277a
MD5 59c7d72c2d7bfa7241a2447d2146f518
SHA1 f42be39a5420fdcc69cdbf24cd7b0a6ce0d97110
SHA512 aa91915580d25c5271ce4b493413294a0774f741a9116c0ecd8839b21e395ff63983752742ae0e588f3106e89d20fa3630c228738a16939ab6d44130e5059a77
SSDEEP 24576:fhbHjPUrKhxr+EHNmT8oW4ll1JCrLKXI:fhbHjPhxSMmT8oWgBCaX
TLSH
T16475017E279D20DAE932D23CD9528606C771BC691311A3EF27A682791F37DE81C35B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 8c38dbf233ed5d0d7e133e26c5f153eef44d6dd7553065e6ab9ddd545ca9034d
MD5 14ba75378823e44e187a85155ec2a17c
SHA1 5b04f54e94c6931017a4515ae7df1c464584bbbc
SHA512 00e85af5b978c4bd1bd34d455548d84a3195ad53e79902fc75b4a120a732177132b971db24b722fb0bfc3c4d009608ecb07631398de9dc25fec7b5f703cf5bd1
SSDEEP 24576:y3YgnJcRTk4yti+R5dpR/MrKhxr+EHNmT8oW4ll1JCrLKXI:yIgnaTk46ppR//hxSMmT8oWgBCaX
TLSH
T19445BF2DF3B910B9D8AAD236850147B5FB71782D1F209ACB0170C538AF1AEE85E35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 36845bb5134f6efdf470593ad0da5dcecc9f8e5282b2d852d3f9cdce624905b4
MD5 e9a34cfbed06bf4973481b95a65e12f0
SHA1 2eb3f64cf5a5debd68ca7deaf3638f11c5fc9d74
SHA512 57bf803eb8e885a1cb963afec1cb49f10843a53931937abcc709fb774ec3b6208d0312860b0a9baed4f26ccf00f5fb2957edebeba6fe38a2a3ba492b31076ac6
SSDEEP 12288:ObJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:OdrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1EC6523755B0E649BDD3AC339E863472599880D9CE30216FBAE3E2A683B35CDB1572311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 a5bae333286e53b7b2057bebc9c442bf0f9758146bd7c94a8296484a6dace657
MD5 b07f713fb8c986ef2d06d82e2fab3ac2
SHA1 c56d5dc55497f49150cadba73b2983574e78e365
SHA512 0bf0cb060b90a3f7ac8483c18aa32384efbe07a5a533869e6aa25164c7540e44acce76edbf3280108d91b184cb6103b1846e19df326d04596fe73941142396cc
SSDEEP 24576:KfL3UTirKhxr+EHNmT8oW4ll1JCrLKXI:KfL3UhhxSMmT8oWgBCaX
TLSH
T17395F155E79500F9ED7BC23CC9628A16E6B2789D0360E7EF07684B651F236E24E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 147a7c30bb9850c14928434378ccf6c70b18cb7e5d40db9a49561e32abbfc1ee
MD5 372939365e0ac440069cddcee605126a
SHA1 3a05f3ee93dcee14f7ee80bece28dc60da3709b1
SHA512 e8467516264570a125217976eaf5a6788e1aa64b7c76d8e76dffd45e81271d793fe09ccadfc728d3df6ffc5746198a55272a364c1a541b0b867a98b280524223
SSDEEP 12288:mpFtfOeJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:2O+rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T12F751229379D10E9E93A923CC9934309D7B17CA9531217EF46A085BD1F73EE86C3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c1989f984b37099ce49730f5dacde523f90b5f04648fdb1790a00233e74d94c5
MD5 6cc548792a86eb2af8e403e7264b159d
SHA1 3c985dfde55ecb699d0909580c2d82e4bb7f432d
SHA512 4909d925d02735a38a237e1d444d2be76d0d5ddda6a4a4adf1065747a974d0a9984b1dfabd5186f2339ecc6974e0665175fd3b90e43170115b1e5458c511c440
SSDEEP 24576:W7NM9YmZqmWMUkPjZM48Mv6bEhshrKhxr+EHNmT8oW4ll1JCrLKXI:W7cBWMpPjN8DbEhHhxSMmT8oWgBCaX
TLSH
T113659E2E6BAC81E5D477D13DC9A28206F6B1B4651B318ACF1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 84368c81af0ab80de9ae27c48272c57576d1c2d53c99087fa1c7286dc8ae5e36
MD5 8c4c66dee33fc15b4b4066ec79e07892
SHA1 7ca8b843a4a1b146a40fb8013c55193887f33ec9
SHA512 f200ece829ecfa0cbb43968e08ab7be8da0608a732d2085140238eeb5f697811a3552c2f0103cdbd996f9ed3558f1013cfe20f3984f23f7818ad9a3d2ef4bac2
SSDEEP 49152:bF2YuHNETovcvNYf8kmIhxSMmT8oWgBCaX:66tCf8kB+M4FHX
TLSH
T1ED858E2927ED80A4E0BBD27D85B7D246FAB2B8551B3056CF0255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 aebe40c91758b42f774d701edbb20e600e26bbece0d64f275f17d2714bf65066
MD5 6131d3f32d43cb7442b6ff6c939c203d
SHA1 76b188e3207dfb9f815233ec8a1c7976fa98f936
SHA512 36a6bb87d671e6d9946d69ee468e87ac9862b2ab5620673b831a495d6c21f3d834764a552e3c647c7ce30bfcb1296e96fcd23a4ac7b68412a7ec7e52b14cd452
SSDEEP 24576:ZAFs06+Omlf3NXEbToKrKhxr+EHNmT8oW4ll1JCrLKXI:eFs060lVXu+hxSMmT8oWgBCaX
TLSH
T18965AF3F66AC00D5D07ED17E8997C91AF6B1746703215ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 42be4d0f8a4504dfe3cb9e7358d0184ab7b63ad6374c9172a5cc793962b7341b
MD5 fe6483b34ae4a8d619bb8cc08e080549
SHA1 840354d3522539b12ea88946a027c7e061d04f15
SHA512 ecbc9d560b603ef071edfbd1bb345f871d196d310b609b71923dff30912c229d441e3991b74c61b7fe544611251ed928cde174696a14643557df642b62b4dda8
SSDEEP 24576:mJnJ5D3WL/rKhxr+EHNmT8oW4ll1JCrLKXI:mJnJ5DGL+hxSMmT8oWgBCaX
TLSH
T1B385D03DD2A810E8D4B7C374815A1B56FE72387D2B226ACB28B4D5353F12EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 78d04b1cba43a0d727e60143e5150d03a9fa851e41eff7f55db8afe57807eec2
MD5 b1561b4f19f59bba67ba9774b34c43c5
SHA1 85b044a62ad76c3d51f7db49dd6e231b805ae1c5
SHA512 a8e5f60955dda7c0ce41adf994114d3a0b3690de0f467d04d26af0f2032c5f83faff78ff86693d1d7b8c08d1fbc2446aaaa1412aa651ccbe1389290200f24ebf
SSDEEP 49152:Co06DIKdwc+eQnSt65aVshxSMmT8oWgBCaX:jS+M4FHX
TLSH
T140956C15BBEA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 7d00996b18770d36d9885cfa84d52ee4c87fcfe2a25e1a2e51ba36c4da1560d0
MD5 79e9d1e7b54bc29e40438bdc096443d7
SHA1 c5339116966f48d11b97aa683b702b26489eb882
SHA512 5a4825aca09ac2ad1c40aea03bcf6aef0f241d88718884ee50e49438b855e18702fed70aeabf0b77f5e1392b527ea0b039d43d06f5065f80016484d258a11d57
SSDEEP 12288:MEP3RBVJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:HBLrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T19575126D2B5D70EAD92A913DD4A18205D3B2F4B8631227FF5AA5823D4F33DE91D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 893bf9c3e9dcf2b264d2a2cce123afec35ac79df103289bd097eeae15cb62697
MD5 21444836e219084814924775b98feefe
SHA1 d63dd7976a2884a25fc5200c05469cffada4b2dd
SHA512 41e682ae15bbf822a1743394a3d6fb17c39afa68c83483ff9b0082b40635523ed6fee642fc7c8c8d26f602bea98c2132ddf01767727931560cda45ed03f0e027
SSDEEP 12288:9jkyoJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:9IykrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T18F751214638860D9ED7A4338D97342619E74BC24AB1157EFA9A0FB3D6F32ED46C31B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 446c19083d4179902724683ab0c607d9eb995b07fd212b65ec7b52b7d9fdf2a5
MD5 c3493aa8ea3c31e385591340ca572a51
SHA1 61550fc44f8efa08abfde4451e39a4dfb282e356
SHA512 7ded71638212e7453a0d7023b8249e541616f504d7fd4c1b88c55da0bfbf8ecb3a65fdfff45815a3d9ccde7763655735a4e9494f647a8d752bd993e28d4f1e4b
SSDEEP 12288:hrOJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:JOrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1F465237C5B0E74DFED268338D932471195A82DBCA30129FF5EB9AA786F31CD61172A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 374dec1a15c2847669f71a80dc6d0a5818b1c2c245400a408dd27c7fc8be4452
MD5 acdb132982442f282217b18ce9e30fba
SHA1 4fd0690ecefea1345b8bf5e641cec14fe8695990
SHA512 84da26076c942dba0c7ffab289bdf138cc15a1f5484fc125fee99e20800b39d403857b0ae2ef041ad7036913658b2b39386358d735cb43b6f35d061f4212cee4
SSDEEP 24576:+Q9MxZKdcz97w3JrKhxr+EHNmT8oW4ll1JCrLKXIQ:+VKXwhxSMmT8oWgBCaXX
TLSH
T1CD558C2DABE9059AE177D239D5A250C3A673B4301B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 66a77dd9b726e32c49025302204dff545d16d19a0784e64ded54fe7e6514bea9
MD5 1d315e7d9ccd00dfe6045f2069f5e8bb
SHA1 ebd853588e0c678b00eae07a5f74b07a6be6ded4
SHA512 fc2612093d2f6af2484c56682f988726d877950e4249d15b5c7cc3e2f9ac7e742633d66c81fb79d61c06f0ec8ecb0260807c040e9058de045498bbe42e97cb34
SSDEEP 24576:MyocbApwrKhxr+EHNmT8oW4ll1JCrLKXI:xocbApDhxSMmT8oWgBCaX
TLSH
T15D85EF1FBB6E40A2E136823CC9818305E7B3B4745B6267DB6691C73D4E239E9BD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 67712c17ed54ae44a268dcf9e66ed6d1c1e39b777b7be82006678dc24c790a38
MD5 0de9b45bfaf72d5e907908d551ea078d
SHA1 16e90834f47daa43b084f72f21dd3b5a8cc1215f
SHA512 d1161b45bebef511ca5c841f5a19a6fac12fca209421d4bdb70d1f413c4074acaf1ade375a5ceab1ac95bceb2bbcbe9912a32d6bf147d61d7b666c2d3f75c05b
SSDEEP 49152:7WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKDhxSMmT8oWgBCaX:r0zuNIv+M4FHX
TLSH
T17DA57B3DA2BC00A9D8AAC375C5451366EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a4fec1b5e19c7ebaf5743d1857de2d46cff185e258deb37962e3958859d7390a
MD5 3573ae57dd5143d52caf5bf3c739d526
SHA1 b59414a49b0faff3040737081479f68919779e55
SHA512 40e07a307296c9a54db9361a3302060fdd6c3e988e2b639bdf77ba142776dd8f2b93804bb686ac67fd0c7406794f7b9663d59c6eb0bd940fbe46a23b95cee00d
SSDEEP 24576:F1QT7EcpfxR+N5AWAz3ooiYtjMqbLrKhxr+EHNmT8oW4ll1JCrLKXI:gTDxR+N5YzTfjMhhxSMmT8oWgBCaX
TLSH
T18855B02EA7F915E9D17EC5789A23C512FA727821033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 01b0844e6d30989925c231360963a73ffcfecb10e8e99741242daf0a052165d7
MD5 f035bbc5ab8dc0b10a6015183c318e55
SHA1 8895fcc64ca0c9e46ad48b4f7aff502ed88f9710
SHA512 488c4cc247906ba22f872cf0e235f4a64655af13870f41f475372662cf3594b425a2047edb3adea087219b527810ddb457fb0c28ec010c8257531e297370f10a
SSDEEP 24576:FTMdOz0FFS+kmSLnrKhxr+EHNmT8oW4ll1JCrLKXI:f0K+kmSLGhxSMmT8oWgBCaX
TLSH
T19885F17EA76D14E5E43BC23DDA538906E6723865032266DB06A0C17D3F67EE4393AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 e6a61668de72f4ad672a79757b38ce8b658fb0fce825bbe9b3892f05381d07cf
MD5 ee5825d7a47c11fb8f43a2038b5e5f0a
SHA1 ce25f3fa02408a59b6d2fdd4075f3c114d270c69
SHA512 fd632531532c081bdcd91302f469117380b877909d4db518a7d7e39cde2f93dfd905e33310b9b51d56f48feb8ea6ce6831b37853a44b7a37ca8a654a5c8b1a8d
SSDEEP 12288:K4pyJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:rirKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1A375122D27DC30D9F8368238DA32421686707C7963112AFF3AE5CA7D5F329D99935B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1060-376-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1188-212-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1188-218-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1188-384-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1236-154-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1236-379-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1484-34-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1484-370-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/1484-40-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1492-381-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/1492-169-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1492-175-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1940-383-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1940-202-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1940-208-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2636-44-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/2636-50-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/2636-82-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/2636-85-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2744-112-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/2744-118-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/2744-375-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/2760-275-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/2760-520-0x000000000D140000-0x000000000D148000-memory.dmp

Download

memory/2760-243-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2760-259-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/2760-588-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2760-291-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/2760-249-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2760-387-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2988-228-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2988-222-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2988-385-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3040-80-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3040-89-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3040-74-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3040-87-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3236-517-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3236-519-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3236-137-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3236-378-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3236-143-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3272-28-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3272-21-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3272-554-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/3272-27-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/3344-238-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3344-587-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/3344-386-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/3704-164-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3704-380-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3704-158-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3804-200-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3804-197-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3804-195-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3804-189-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3812-91-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3812-371-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/3812-97-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4356-185-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4356-179-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4356-382-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/4736-11-0x0000000000C10000-0x0000000000C77000-memory.dmp

Download

memory/4736-16-0x0000000002E50000-0x0000000002ED5000-memory.dmp

Download

memory/4736-0-0x0000000000400000-0x0000000000711000-memory.dmp

Download

memory/4736-414-0x0000000000400000-0x0000000000711000-memory.dmp

Download

memory/4736-365-0x0000000003750000-0x00000000037B7000-memory.dmp

Download

memory/4736-389-0x0000000003750000-0x00000000037B7000-memory.dmp

Download

memory/4736-1-0x0000000000C10000-0x0000000000C77000-memory.dmp

Download

memory/4736-8-0x0000000002E50000-0x0000000002ED5000-memory.dmp

Download

memory/4736-15-0x0000000002B80000-0x0000000002CC9000-memory.dmp

Download

memory/5164-133-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5164-377-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/5164-127-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5360-54-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5360-60-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5360-373-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5924-524-0x000001B387FF0000-0x000001B388000000-memory.dmp

Download

memory/5924-533-0x000001B387FF0000-0x000001B388000000-memory.dmp

Download

memory/5924-528-0x000001B387FF0000-0x000001B388000000-memory.dmp

Download

memory/5924-523-0x000001B387FF0000-0x000001B388000000-memory.dmp

Download

memory/5924-522-0x000001B387FF0000-0x000001B388000000-memory.dmp

Download

memory/5924-527-0x000001B387FF0000-0x000001B388000000-memory.dmp

Download

memory/5924-526-0x000001B387FF0000-0x000001B388000000-memory.dmp

Download

memory/5924-525-0x000001B387FF0000-0x000001B388000000-memory.dmp

Download

memory/5924-529-0x000001B387FF0000-0x000001B388000000-memory.dmp

Download

memory/5924-530-0x000001B387FF0000-0x000001B388000000-memory.dmp

Download

memory/5924-532-0x000001B387FF0000-0x000001B388000000-memory.dmp

Download

memory/5924-531-0x000001B387FF0000-0x000001B388000000-memory.dmp

Download

memory/5992-102-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5992-372-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5992-108-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/6040-374-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6040-64-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6040-70-0x0000000000890000-0x00000000008F0000-memory.dmp

Download