83109e5420ef632e6fce1dd3f55fa6c9ded990afd4a9e38d4221f1aa0c8d3417

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 03:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
Size 1.8MB
Sample260930-d78e5azvcv
SHA256 83109e5420ef632e6fce1dd3f55fa6c9ded990afd4a9e38d4221f1aa0c8d3417
MD5 2e28fe01a2b24afc42a8581ef35adbc0
SHA1 7bc27d90e1b58f03f02b75c13b6b0e0b2785d521
SHA512 fa98f573a009e72069e2eb7680168798c0bdc484e69066916780c72e20f8caa3acf56feb4bb6febedaf1fd1bc19676ae7f1c5daca8a1a1de959c1930e52fdcc6
SSDEEP 24576:GnscoyyhMbB/OrhiJSTfwUnQ/tbw/2Mkjy6Fr7g0o4:GnygA/YUQ/lFTjN4
TLSH
T1C285C010B710D03AD9BB72F94EAE526DB51CAED0175151CB62C83AFE8B382F07D3525A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3776	alg.exe
2616	DiagnosticsHub.StandardCollector.Service.exe
5792	fxssvc.exe
6084	elevation_service.exe
5920	elevation_service.exe
2896	maintenanceservice.exe
3464	msdtc.exe
2316	OSE.EXE
5424	PerceptionSimulationService.exe
3532	perfhost.exe
4336	locator.exe
5808	SensorDataService.exe
1528	snmptrap.exe
5316	spectrum.exe
956	ssh-agent.exe
5928	TieringEngineService.exe
1364	AgentService.exe
2720	vds.exe
3660	vssvc.exe
1120	wbengine.exe
316	WmiApSrv.exe
5804	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe
\??\F:\	elevation_service.exe

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\43e899054bb6346b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7b069748d50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ce5ff748d50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b2a41748d50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf3ddb758d50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002901e0758d50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a5f8f3748d50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000049d473768d50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000773b73748d50dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a9c37c748d50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000531a96758d50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2616	DiagnosticsHub.StandardCollector.Service.exe
2616	DiagnosticsHub.StandardCollector.Service.exe
2616	DiagnosticsHub.StandardCollector.Service.exe
2616	DiagnosticsHub.StandardCollector.Service.exe
2616	DiagnosticsHub.StandardCollector.Service.exe
2616	DiagnosticsHub.StandardCollector.Service.exe
2616	DiagnosticsHub.StandardCollector.Service.exe
6084	elevation_service.exe
6084	elevation_service.exe
6084	elevation_service.exe
6084	elevation_service.exe
6084	elevation_service.exe
6084	elevation_service.exe
6084	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4852	2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
Token: SeAuditPrivilege	5792	fxssvc.exe
Token: SeRestorePrivilege	5928	TieringEngineService.exe
Token: SeManageVolumePrivilege	5928	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1364	AgentService.exe
Token: SeBackupPrivilege	3660	vssvc.exe
Token: SeRestorePrivilege	3660	vssvc.exe
Token: SeAuditPrivilege	3660	vssvc.exe
Token: SeBackupPrivilege	1120	wbengine.exe
Token: SeRestorePrivilege	1120	wbengine.exe
Token: SeSecurityPrivilege	1120	wbengine.exe
Token: 33	5804	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5804	SearchIndexer.exe
Token: SeDebugPrivilege	2616	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	6084	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5804 wrote to memory of 2056	5804	SearchIndexer.exe	114
PID 5804 wrote to memory of 3844	5804	SearchIndexer.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_2e28fe01a2b24afc42a8581ef35adbc0_amadey_dharma_elex_icedid_smoke-loader_stop.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3776

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3228

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5792

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5920

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2896

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3464

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2316

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5424

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3532

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4336

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5808

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1528

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5316

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:956

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2192

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1364

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2720

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3660

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1120

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:316

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5804
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2056
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a5197af8452cef303e50bfc30ed26096de4df103770f655c7ba926757b6d6a49
MD5 a36c2b1219e60c27b9c3139b6a762223
SHA1 884abb81d9edb9c5e2e4f44d004391efc4b88108
SHA512 671b3b50f7aec8aec014341ea51733beaca77bd7454b28bd5cc92e59a44e2c38942e30f9a0de63e667e2a957294dbb4b9b841cc999644beb397928eba92ad76c
SSDEEP 49152:sb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn4Q/lFTjN4:W3q6HjBYLm
TLSH
T146D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 3877337179de4d4713be59f1acf950c228f02cde4b22345ca9795009457b26eb
MD5 1a4cdb58a2e2c860736a117d608083e1
SHA1 7858751887054071cac336914ad853f58ac46adf
SHA512 0f4de1fa143c80409f16a79459f8af1dd8f6407d74eb1267bf6c46bb8dfc9d92353131054c8341088f54824aaf11b6b1530334fdff33a12560fba82943e4113b
SSDEEP 12288:o1XLsswWkxy2lRq2czAHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:OXYfDtczAnnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T15E65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 437dc7d3ec4a4c62889876961814617e06d812229f35b3197ac16fbc4b6e574f
MD5 50d36349536d54807fbdfef2dd866d77
SHA1 9b0f6f095490e8146e56da9eb115d8da5893c93b
SHA512 d729cebf906f9050de3f6ffc814e8440fa0f9c08e0c6a5fb006cfc5d2f35d355f4cd69630fdcc479d51d8116474e3ce28ff4fd7dac6fefd0ea1ff701bca3f9da
SSDEEP 24576:Z0Le5ji0hmxLrMQnQ/tbw/2Mkjy6Fr7g0oN:ZPji0AlJQ/lFTjN4
TLSH
T107859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1fbe22e25f83e39e68fb577172e0b9c3df23806a80990f28fce2b5e879c9b10e
MD5 dd970df0209a7d98df23dbefca519535
SHA1 aac5d65f96105bf9f9125c157070366cba779a4b
SHA512 d78e10c6b061427fe5b5feaf9e6174bdb482e1425d60a41252115ac214aafa82794e9dae21829f5953b657366725d328c85696aeaf001fb4ee4deebf83d3b2ad
SSDEEP 24576:Ka7/ezSC6vUyD/aqgrvWE6q8wyu+nQ/tbw/2Mkjy6Fr7g0oj:9/ezSC6vUzPvxHjy9Q/lFTjN4
TLSH
T11F755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 56945b8fefccb3bfda7026a8026b1e45fd95271e7aba19d08d00892ce5e0d24c
MD5 5944e834544fd998ba134c8c9f9c50fc
SHA1 fdc405d5551719468c1a87eb7d6889320207c630
SHA512 1a3a0ce55126188cb995e5e876f6d97c017250d5ef69b5859441faa1d03fdcb6ddbc3aee2ed7bf1aea576f1e045789715e6d90b018e73d735afe77d4043b1ffc
SSDEEP 24576:0VbqPb88hv/l+6jnQ/tbw/2Mkjy6Fr7g0oY:0VO88hXl+EQ/lFTjN4
TLSH
T18C559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2c250397afe65f599b97b5b03aa03e37e71b3422810ecd41d777bf7cc92d89e3
MD5 ef784a846eeb1d7d32214bf91b6ff026
SHA1 6150bd837cf95f2f465648d75a2cdfb6fceb301a
SHA512 8f8213140aa05132fb62c5d0b663b0f0b267a216fc5004ceb3080442e27d8c4bb449486f31bc07b516023ee5980eae87356ecea11222d0c2c8273fb8e47b4779
SSDEEP 12288:czsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:czsnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T15F5523796A14F897FF2B06B15CC284826B7B0EC1BFD4AB4E6744322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 1067410b24ae164c30023d8834ee4440de7762b6452b6eedc61362203b323984
MD5 eb9d421ce94a3c6c001aa610200790fa
SHA1 5045ab67c9e2b5e23bd596a14b9df4ccdb699e91
SHA512 7309eeb9ef4f3564e0e07db8808f1aa0dbd3bccd861289b9ab299fbd8f888bb82c4038d3b3d2a15afc49624a6a1278344593c5a48cfba2be5bf507203d99e25b
SSDEEP 12288:heBNUbTVO86ULGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:hJIU7nQ/tbw/2Mkjy6Fr7g0oR
TLSH
T19375CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 427cd0774c06ea556bc923d35c9b9f01cb6efce7678e88a47d5a54efcc1cb0ec
MD5 6b8b9ab98d6bd8304a2229e41adbd697
SHA1 ed469f8723cc95262323b323da94b139d0ce55a6
SHA512 19f67d7f7f8492f25971b168a99135085748a3333ba1db62f8710be1f3686b8b01fdd6c9a695f0de2ee72a98b3ddf71d0b4fb1bbb5df9d360ec2aeef037fb0f5
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THb:jQvGAdlCEL8c/yRNw5CJLm
TLSH
T107267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 49ed595b240ff765692cb23a62a037afcba8035532cdc41a3bcdbb3cf0ceeb24
MD5 5e9fc1c509c8710fee6da36da798e4c4
SHA1 f3d4267f1320197fda84aca451db3c91f88221f7
SHA512 6a77a8c9899a06a7e77a18085b39fd5be3fb6a5ffb92c5f7d5fa3dc7c4244d4642f59ce2fa5160c77620a600d27bce7077eae01b044276e3cea7e8f94a8ea146
SSDEEP 12288:nAwSfxL/2Dc39DLLmt0LDQewsAjpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgJ:AQewsAj5nQ/tbw/2Mkjy6Fr7g0o3
TLSH
T13B75E031FE74E436C77F0DB21B22C706593D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3caf97fa9e27521462cf6da732fd90ef7abe49bc3af91b5c02d6532065aab1b9
MD5 e0cec1e5991b131c95779f303aaf4099
SHA1 09537c61c4526074cb075d03458cc1a10d188139
SHA512 48a94cb940c20c8db0f90566b610f3ef793efef214ac42b443ea778f0fde05faf5c9d420be67c0dd61dc1a0261d1a11a3e9424aa7e46f74941f78aeeb2850b09
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHGL:7UEtQevvqc2W1cpV2EI32
TLSH
T158474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f72f2211a1a0505377317c60e8cd417fe6538944ff9d9a68b944117705902666
MD5 408a4ca2362728f98329b498bd0e1152
SHA1 ae65dc40dd01f6e1fc64230ae6c8659f09daf2a1
SHA512 fbcbca92f6332a4daa07c7c6546723b6adc9a1f0b6118ec9e84d0a28ee4447236889bcc367675ef2a7624b45355d0b25bbc83655353e469cd8de9eecbb2aabd1
SSDEEP 49152:SCbRquA/m2yL5zQfFiV+XenmE3/zZQ/lFTjN4:3oqtVjnmNLm
TLSH
T116D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 daff5fe0804c807d94029a24456c4854a37b3cd18c63581a60f9d181981940ce
MD5 3ecda878f2bc7ba94679c4e580a5a28d
SHA1 5efb3119d1b013dc3a50c7564631b5d3d58fedc8
SHA512 9e4956589997448a48bdfdccb0ec2fc7d77aac115348ba9531f402f2db3d3622418f61397f651f503394fecc393637b547a2fb46970edb66317fecf1ca519e80
SSDEEP 24576:cAhGLJIFoiwtA5l7S53inQ/tbw/2Mkjy6Fr7g0oA:cAMyFoiq5yQ/lFTjN4
TLSH
T1E135AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 a3aae0728e3f96b0994101106ec29e8e4d877302c94465265b71f2102e7184b4
MD5 9dc0f076219f1e7e9568b71b65da0920
SHA1 80c50dd55f480e54693ef144d392407abdc650f5
SHA512 211ecae1cfd134717cb68e2eefb5a27c74ccc75b4e6f4b3a29e724dc81180cfdb4d3e433076526fdbac8ff7bf1b37bad074fed2c76d23921bfc807fb8f5a3d2f
SSDEEP 12288:hmw5HEjsChN2BFgl0WDm+CeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMr:8wuHOWdnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T14A65F14A36A45CFAE96742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 daf62dee26d9d99ecb36a01b2a80ed7a733a4eb4371ed6576cf2a4897debab96
MD5 8be0c00c0f39eed366700002afd5bc03
SHA1 9bd33f8bef1878600bf2e0e6823dfa92562bb01c
SHA512 1c34f4fa0c4e3dbd495c3283890019ffe4cf1789bae5cc1dc01f87af2eab4b7f5d4be1d508c4ce40c7a47426bf5c47ff04296a21383af3aa908ad011ff73d585
SSDEEP 12288:OXZ1IyZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:eZuonQ/tbw/2Mkjy6Fr7g0oa
TLSH
T14955126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 02cccaba4e3b32e76f523a9ffa33c27301794e8ad2312b4071eb8c7622c13b06
MD5 ee4d099c1581000dca45535019c4fdc0
SHA1 468f3e77b6f09d1bc2a6558700f21ff7fe3aff17
SHA512 dcb7e4e0d275eb9ff35792d3e00384ac95711bc0475f122f8c7ad3d1f81a236362bcac673ad16c75efcfd98301191873aff0f391def5bb921451bb8160d57429
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UP:MQRQyi36YOcPQLvw2gAf+PN30Lm
TLSH
T1CD667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 bb298f1d59f20e48cf12fd38e564e4c7a9fffc17dfc1784d6881cdf2fdae12bb
MD5 367120593b235772db0e0cc46139181d
SHA1 c8870237458f560be8ae0878f8d3bd9c8e988e6f
SHA512 afd9411a96dae93c2b3dc2dfad66d4618bc1e3b1b28f12c3a0740e3000f3c00b934efcac6e828ffd16095cb0a61c195c4d7b51451d96de066b739283f1152cf1
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UP:1QRQyi36YOcPQLvw2gAf+PN30Lm
TLSH
T1AD667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 44b05b04a1be4f278782c9945c2539e580de186e06b61ce1cd8a4743b278749e
MD5 37298b8d678a8f7e12ac966b9734c128
SHA1 58da00622490358a8bd873eb85431578075757db
SHA512 03adc89009471e31728b2cf313415d993d3d1ac12c60d5f5c323abff7a8cc24b2be1829fde261b0ec9da3d1dd1d29265393dab08956ab73e1faafddfd911aaa3
SSDEEP 24576:ZwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL04nQ/tbw/2Mkjy6/:F68Qg55nhheWu7PNU3/JQ/lFTjN4
TLSH
T1C9B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d4a4ed98a1f91a08ece7347137c6e76a9b0d23e8e209dcae7642cad171da4c57
MD5 cb47d4e41f3744d7890b1f28491849d8
SHA1 9f96348c25d6cfd569bcfe042f148d099bc5d94b
SHA512 4c0817b77234dc1a37872a157eafccbc04d6d996db4340ba83f1cf8033038a23947455d06b5af8e17996c90d5b393f567d7c0a194efd204a73ddf2c4b6238f91
SSDEEP 49152:+3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99Z:/y5112gYy5azzVvL69nLKnhZPLm
TLSH
T1DB167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0e2278ac9d10cecb477b4e60db8492bde8d1d81aa1d899f60ca2a4c0079af183
MD5 64ae78943ffdb4b0001e8c769f506391
SHA1 6e68f7860234b3bb4375ab5a95fee005eb56d38c
SHA512 55a13a613abdbf584a7fe2bba8256492fc2d79b48588b4a0d08bd6f47f4c1a22c4964e833dc9b852da872d3e53fb30e90710222f9c2dfb9298293f6ca52641b7
SSDEEP 49152:bB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl3Q/lFTjN4:Nu6JmVxd2dcLm
TLSH
T1A0D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fde41f85730d8ad7e39a72447d6340490e6104e0ef9923aef96311a70ffb7dca
MD5 5ef72002d4dbc66d7b993049a0132946
SHA1 17df1073bbbb106c847ab8808053aad3ae735143
SHA512 205fcf69622c53f8c9530ee70310cca53fee8137392f511bd6dc7f3373a5ec3fb44295756deb39839eed5e7112d6f70efdabb5b3f349cc98b6564f2aacae8a73
SSDEEP 49152:m1hpsNoJpF1A6UU44CwH7R4xbQ/lFTjN4:mmifPbRNLm
TLSH
T1FEB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e2342b46290b0ee662575db45085be148eebec0c04da3a14e1a2ab71a8794be0
MD5 cdd0bf7d66eb28426c0a8d632cdb1d68
SHA1 6ed1063ecad35b8770bcf9c0d8165cf836229b76
SHA512 ea3fd6237947530d4ad099dbb42bd37b8f134b9f271ea829c6e4651397b1f11448cf3023361c84007fa2a6af2c1733bc9a39ded78a76a9329858a95fc4aee6f1
SSDEEP 49152:fSuZQIY0Be2KRRVtOnks6NMHqoQ/lFTjN4:l5dKTi61LLm
TLSH
T190C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e5316be9dcf68cac4985da26fd90b9ee14d94372d3b8350f84b725774879abe9
MD5 ac1c7743cc31777b432088838d842f00
SHA1 a51c0054fed9c12e4777b52aafabbb15f62e9384
SHA512 3ab9a04dd2625a067e8c1cad3e8097c7b9735a7f7051ceee2daa5c7a6882f3f7847c97b86f3c3a7d4985e5bf4d4e692316e1b1ad4b47ca4bcba030a8c11839c3
SSDEEP 49152:JhtSn8EApI0figngiDn0AP5wnQ/lFTjN4:4X2iyphBLm
TLSH
T1B695BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 ea3687194c94940368a6d499ec6d340fcec3dee85ea86780ae26d6636619ceed
MD5 b3e0a3aaf46faf379bbfdd4fc85d57b0
SHA1 e069ad7c1d093aa358c32ddf91489fbb90687ed0
SHA512 7da647d766bd84a6b8692f946ff35d52aac6763bc12f256cc81c8da3db1f3941d936b89303b2eeaef3cbbcd156d5d587a7cf86f308f6ccaf3d7e2d34a558fde2
SSDEEP 12288:jkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:jEnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1525523697954F98BFA1706F18C8281829B7F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 4157911ed2daa2b1ff7af10199decdbee24d2dfa9ee8e8b1175cfe27d23e88df
MD5 bbb6e4d737939880a6a1af1d7bd3a881
SHA1 989d7d860fb33aba9d7b02e5c4f72572f4b36b8e
SHA512 54bf3cee465e6fac5184f3144fae47a0d8ca5c2b21f63da7785d8eba9b07d43aaf98dc8f17d477208b5018f0f479956f8136fe118969a79cd13aa574973d9ce1
SSDEEP 12288:KFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:KlnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1AE5523797965F98BFA1706F14C8281829B3B0EC6BFD1A38F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 35797c3b0d98bada358ae049beb6f14df7a0c8c9d34ce2d6f6de34feb4eed4bd
MD5 e20e665c9246c27b57702966aefa6102
SHA1 23b0e9b5ee7a61843aade3676af300defab2e0b3
SHA512 4ca263eff56c1ea77e675307c1f514bebb09ad0dfba8378d20ae96208d9fc3802650a34588f9bb5d1780826b358de8a6ccc48aa01e55350f918ed3903cfa7cb3
SSDEEP 12288:zDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:zznQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1BD5523697965F98BFA1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 c1dea0e13f48639a068fa3d2cdef816e615390378a11a087c447d444d5a1e1c6
MD5 cc3d719abb7525f209e0b5a7e0237f11
SHA1 d1cef045ba75e6ea72662ef4a62aafdb82ec7027
SHA512 12cbb35494742dc61850d7ed22ca13b5cd95e28379bac79f9dc95490422d7b041bc2ec552e590c1ba9cfdcb4781832ea13aaa57117278d0573571aa6155a34ff
SSDEEP 12288:EVCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:vnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1475523693B69F4C7F92742B4CC928142E77B3DC5BBA1A38F6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 8df74e472e6d42e4da2f78c8870f1026deb98a501ac89d937a05757ba86bb031
MD5 01299ce7dd9f530898c28b4f53c6a7da
SHA1 5491b25e1bf5c5b16eafa4057844b6dd729feb2b
SHA512 9a0560b15d33a0f8dd892915974d88eed595ef1b0324356b3ea3fddbffdd3654b06004cd4cf401e095de91bc27e27d984a37bccc70b746c054dca784dcfe41b2
SSDEEP 12288:OqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:OqnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1425523697964F98BFA1706F14C8381829B3B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 2ddfd42c960a42ebbf948dddbb7957d9c4469d3d661c2dfba5851ee6f0818055
MD5 c19d27533f88a9532e036e8d13430ef7
SHA1 0f84c0c1dcfaa8f0396c3f2e5ef2340845cbaa22
SHA512 ce9e59a9d9b5353bf962d0d5fbd6d933cbef6ffc3972f812e6ca6a3dd82573dc4afbe56747f6ef6ee712dd81dd2b55136c6255a4d5b55a49f90d411e79f1fb58
SSDEEP 12288:RBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:RRnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1D65523697964F98BFB1706F14C8281869B3B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 6589e68fe576416d738b8aadb7f31116b9bc62e6c98a8565f53ed5afbc2704dc
MD5 d7fb349a1ec9bf6fb3e7867c1260c5dc
SHA1 d076ef107bf19547b4b2d486dec4b2f7027c396e
SHA512 7bb60f0f30472f974e1dfc8d7a3ebc67f2ce974304db213aa9ab573cb8c364a02cf466bed115a289294dc1ea8c2c969d5cd5e6b3b801f48e83e89b23df19e915
SSDEEP 12288:6NGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:6tnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1095523797964F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 325b69c03592a535eedc140ad58d2f9952343ad69e381ddfd93e7537e9627a29
MD5 05b2fc188340da9ba4acab5857741e30
SHA1 e0e9717621b242c93591af5ca35eab90e59742e0
SHA512 d561b4f2cb42a42a9edfae9e764ec42136064a08348813989f48d26da1f5fb0824b12e2747aafc42dd3656777151052207ceccfc4dda7b76165acfd9c204a0de
SSDEEP 12288:6iZwbDzzFEoS2cPvylGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:dZM3zFVSOFnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1377501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b24995630d4fb06b7cbefc75ad97ace4e94bfaa8e4d07291df62403e549e3b4d
MD5 facb8748652db0e15cc86cbbf0d10ee1
SHA1 0e66f7206ddf245de496a6f02b53159f96ee1e34
SHA512 96d5ca0a78e9d7d6d731143670b64dfa292f8985164d740889e6cc522b29cddf7a27e71176360af4da934c0b6e516cadb99fc75856ba94bc516927ed9fd03ded
SSDEEP 12288:RYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:RYnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T14C5523697964F98BFA1706F54C8281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 197dad6588691153ccbb4bd827435f9bf12b6881c3fe43d3baeb4f58b63343c2
MD5 856803346997b232ec73e4d476fe53d1
SHA1 8f1d5b1d95376dba65af04f5db365e065967d0f4
SHA512 801ff0871657ac027f10213752e4883539bb9ab27c3a8b4cd971cb551b21065cc9acf9a0cd24a25609c337a19c07260da2dcc1e08bce01e3b11105c89fab1a34
SSDEEP 12288:VcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:VcnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1265523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 e8fa86491bf7fc61f7dc582975f090e69afd1758bbac3b624dfc08c18bdd5c0b
MD5 94cf79e5f195db7bf40931d80d5903ed
SHA1 a36a20fec01924c861ba6904e513eced04208488
SHA512 05c7a107b84a1ee74053d3313745bca48a5385207779bbbd4cb47925d43459166028b0baa0fe15bc384bc46637cdf80029c2dd4a5f735464a50d04604b522c93
SSDEEP 12288:JyPz5L8ZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:ozypnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T10265021777A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 1604ccd582308bdb85ab66f98fe8e2aef251c5272d89c52f2c5bf2271e084300
MD5 191417c94b6ce37472e1cecab2c90352
SHA1 bc8a79d9ce6ac0e28da54e0fedeaeb13884da589
SHA512 7dcb7dde6a71c1eccbea5a440daec4bae2eb41aab4cb3e3121b3beeb85195df8ac51c8f6e6366a7f0e9982738e430d17194e3789eeaf3ee08d4d5fd0241396db
SSDEEP 12288:jYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:jYnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1465523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b89fd8b597afd95b4ab2887f5d9f76d2a63c2ef8415f2b172567a771d06f9e3a
MD5 cbaf00ffc0974e39294704ff4a53a4f2
SHA1 9b883381ea2b84d22f2e38dadd3ed7b01ccbb263
SHA512 afe9b58b28b887293b685e90d06c8b0c2191acf978a270c6b0b92240db4c80e4299098f53a65134daeefc377459b5dbfcc8c6f1add2ac6e6e6a79a732f8c994d
SSDEEP 12288:tYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:tYnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1015523697924F98BFB1706F54C8281869B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 d1de283391b3da71fcc15cec6e3a150438c697b5a8f466f915e991d05c04aebd
MD5 9d0a7461266ca703957206a345ee3442
SHA1 79e8d087b971935ad669751800fa9716b52e1542
SHA512 079cc9d3124ca7d5c8465994e41b6ef1d0e2f553c91cc3bd3bb63f2321d16a5ce9c0b61c05d46bb9ddffee78cd0462790dd481b13c800fe4ef5ea257067cfeda
SSDEEP 12288:lyPz5L8ZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:szypnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1EC65021777A170FAE537427888920A02F77678725B609BAF2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 461b0683fc48aba16db7dac0adc55d852fafa54092b4a2fe7358776ae2c1b059
MD5 fd8899eee1efada07768e7cf6f751bdc
SHA1 b647f61a65f425e57d70554cbbcec20196838134
SHA512 7a21a4e85389228c06cd3d4618448335bbef0f0708d38ab1bbce2174822593cdcc39f5c7b3865fa78d757bddbcd32073a63f649ab7c97750a842ccc1545a3a36
SSDEEP 24576:zT0aLl3z0zDDnQ/tbw/2Mkjy6Fr7g0on:zTDLlj+Q/lFTjN4
TLSH
T1B07501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 81275ffadc3a681ed35ca5ebfe163400b6740a54ac82666d0ef088c347cfb012
MD5 22c5359e1670b54379f91fbca90677f5
SHA1 23c13e2940bfae529d6e19309901fa1b057dc613
SHA512 a6baa06863441bf1f354c55f9787c3f1aa31b147cf192363de6a2b49f1215a071b7e3788ff6b1bea1d8577d9301902a890f3508f7d6d134565bc4ed14e1cd901
SSDEEP 24576:McP4mcvIjkGOxhKP2l71nNKbrh/8KBgnQ/tbw/2Mkjy6Fr7g0oe:nP4m4IpOO67W8KuQ/lFTjN4
TLSH
T16465AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 7a86f6c14d2b5e174d846258098950f3c8e6b15c0c127fcdc77ec743d5566fef
MD5 983aa555ab40e1402f30406f1dbd50b7
SHA1 8e33d48c20fb6e46890d2be93b8df4504253dc7f
SHA512 a8464ce0e02a8faa11c85f811f82953b6309ab2de3c0e173db0bffa9dd980e808fed29a5d45eb1111442b1ff91fe76ffdd5eec1da3b2d832bd5bbe853f556ffe
SSDEEP 12288:DssfoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:vonQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1B365F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 6b2353d606189189b29293469bdc5e3eca1ec8ccd7d5df8e40649da201355591
MD5 796b78f5fdacc059d29ec43af61c9933
SHA1 0920a9332733abad766472ab8c450a20e1ae6abb
SHA512 7e3045192b268aa302977104ea95652b787dfcc8dd261b4236239030e82100c6cd48d951bbdb966df16d4be4255770044759e0e578fc03c55a4172298046d9c3
SSDEEP 12288:pIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:pInQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1755523296768F94BFA3B06B05892C151673F0EC5BF90D78FB708222D967C3D00EAA745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 dc55d0bfa1c98883cd42b2031f566795c158689ba34ab0a608ba289ad9025b7e
MD5 0c62b34fe1bea3e194e08b41cb6e5c76
SHA1 84d0eb768c6acc01064ae896020ba2ba65cd58e1
SHA512 1fb34022dc2f3c560e858faab532d0dd985fe1d047043c759f8aff54825c77992879557101c9ab7ee5c2e5565bec796d962a7e8675d2bb2c03307829bac7e2d0
SSDEEP 49152:oa0h2GEkuAe73q3pp46zwwQqQ/lFTjN4:oa0hNYG4JwGLm
TLSH
T18F859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 9cd7b6c2a3bec0fc29f8559a1c682789f81ec2834a8ee32f05d6deeb02c52a05
MD5 0c9f3c475d5ed7d57a6b08f3937360e0
SHA1 025efb4931bd56e5a2e58737c07dbd09a22666ca
SHA512 2b921b07adea16c0f5b0f4f612dccb8438f1de19d13813cdee2ff2f5b27da925500864dabaea61ab59a66eee4205d1a75fba0c04413354cc7b5649a68baed3c9
SSDEEP 12288:+hbHjfXVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:+hbHjP1nQ/tbw/2Mkjy6Fr7g0of
TLSH
T1BD55027D26AC30DAF63692BD88928546D7327C552B11A3DF2385423D4F3BBE40D7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 3620477158a2da987f4d9f408d9277658e22f5bffa5484bdf5533bad793e73a4
MD5 7fa04b28edb8ba580b5d0f833b9266d1
SHA1 df8283ccb2282a63a9b8df791b13dbbd3e6eeb2a
SHA512 a1f2db203171378d8056e3ec753fe9eeec6623d918650d52130abb55d05ceb02ef3d6a8e255296099f49130569042350f0b0b9cf1a7d02c07895b4ee590721cb
SSDEEP 24576:t3YgnJcRTk4yti+R5dBR/dnQ/tbw/2Mkjy6Fr7g0o9:tIgnaTk46pBR/dQ/lFTjN4
TLSH
T1C445BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 5e56a38a071f0f1d9a170e2d7bb87abb4825239ead76b2773538c3d9a2a3d161
MD5 0ab406ad50e854f9b61a6f1ff69d38c7
SHA1 364ad8cd22296f2a7bd84cc855c8c6286cf154f2
SHA512 8c397bd6a5c28ca0018c53ce55b039f3fe42e35bf225e93c466690324ec21950f077373590c23c50e55bc83f8212980176950b0db6c7a8c9e82b44bea5250dea
SSDEEP 12288:tMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:tMnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1ED5523686614F98BFA2706F54C838546673B0EC17F91A3CF7748222D967D3D41AFA780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 987fd02d49429f4b5f69f5d33c658a0e85f617039c3d52b25f01deb790f47ea9
MD5 991b3504381be1331b52778d09038f48
SHA1 faa1fc162ad27e615ff66d826c90340c7b52138a
SHA512 7c8c77f7678b71a242caad1a33fd5d468c0a1fad0b3e8bb6a07d8dd02a2bbdc491b3b3b17b43fd3ef92e1c6c49c9426909c761fea5c2787b9223d12093ca5b6c
SSDEEP 12288:pOb4A4LWOsvAYFTHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:ewL3UTnnQ/tbw/2Mkjy6Fr7g0os
TLSH
T12775F155F7A450F9E92B813CC8A28616E772789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 d41c036866ad349ae84832e16b34b77e55d881bda7ff546938089054b67e13f7
MD5 9d8daec182c09f1851d17c22153ced77
SHA1 bc68ff65a75e8086fcee2ff84a799bece5f18db1
SHA512 0c8444dd5f2072f0c76cd3713807f4cb4b14c13702057d264c225debdc93fe85c8e63abc7b84ddb8b985fcf9ee76ac70fba3900aa232d12c11582e78275e0278
SSDEEP 12288:jpFtCOrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:gObnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T13155022D36EC60E6E53A527C89838249D37278961B6253DF0780817E5F7BBF81C7AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9308d3ef8969fb16354f3f85f49d0e2a3ae080e7fa27c0b1738b4038dcf14d4b
MD5 7be7ffaf31d41a6e0ece483321b99bc5
SHA1 ec228dfba034bb7cc58c915af5727660c3270cc0
SHA512 3980872491ba05a28cefbdb111e3146004d0f6b17a78766a348db4aefa6cd1972d9669274ce9422979bc8374217839664544ed466252d9db74a84212e9f92a96
SSDEEP 24576:N7NM9YqZqmWMUkPjZM48Mv6bEhsYnQ/tbw/2Mkjy6Fr7g0ob:N7cBWMpPjN8DbEhVQ/lFTjN4
TLSH
T1AE659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 23ecb76074f9e8822e86df3d2e1843171d8bfc435d79f27d9327ad525a74d417
MD5 5d83dbf75071c50ef48ff5816a623118
SHA1 da8bac8b0bac4a686d62fb44dea03fe91fb4f356
SHA512 18e7c3dc0497e05ebea6dc3789680050eb28790bb7dbd5fa8f0dae46753c0e64649947b434a2284a35172c4b67e2aaecbaeed78d35b3c510268ac7be6301efe8
SSDEEP 24576:KW6BApg2YuyuNDYTabvcdvNYf8km1GnQ/tbw/2Mkjy6Fr7g0oZ:KF2YuHNETovAvNYf8km4Q/lFTjN4
TLSH
T111857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 038f7dbb09a082ed65f7e0ed7969c9a36ee16e1f9c1a14cc7d8c0a1ddae72372
MD5 93c867907729a6f60155e3f68a07881f
SHA1 8b94179a1cbc03b918ff960019d510ed8526bb50
SHA512 a0872a8b030b5cef2fcd3ecbfcdb16b9eaf92aa55f0cab1c70f432bf04853c5ba6bc903f4ad9e9cc7ae705af3ec9e4e4034e19ae9cd5863f6617491085db36a9
SSDEEP 24576:uAFs06+Omlf3NXEbTofnQ/tbw/2Mkjy6Fr7g0oJ:nFs060lVXuKQ/lFTjN4
TLSH
T19765AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 4e7644c08afb2077bef160482c51e5d8474f92b6e63f25ea46b1dc792a389b68
MD5 24fe1681ecb44c84d6a72585c75da357
SHA1 c423811e7edb4a47ef0fdef2ba8e7966d1b5285f
SHA512 021a3f2745bf1970c33be449c17f41f3acbc8ac415aa9cabc6dd7602b877afaeb25131c02f92526328d1fad625febca0ef1771f68b9fa5d5acfc4a2c5546382a
SSDEEP 12288:VCJnJ5D3Vkrqzx4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:MJnJ5D3WaKnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1DD75D03DD2A810E9E477C2B4819A1746FF72386D2F226ACB2864D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 bff1bd9ab56212431ad5278ac37910f31651601aaa8eb425f73f589965933b2a
MD5 82879716b07babd9a4eeb9c60d3e20c2
SHA1 76254bf3ddc3ea44e3ea7778d5beee3cff042155
SHA512 a3ef9dff85d0664146ad77fc596bae84de51babf8b0f586565fed9e587b91fc441003b39e91ff2157ff6fbace15f0c563177badaec63c5bf3e4ac3100cf70730
SSDEEP 24576:pEPghm6/7IIXdwcXrif7qQncjlP65i3VudnQ/tbw/2Mkjy6Fr7g0oM:Og06DIKdwc+eQnSt65aVEQ/lFTjN4
TLSH
T14A955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 6f6fe2935fd45b2f9351af140a8523faaea68e353800499fd61cd02e6277f1fd
MD5 f232ccc1bb9b69658521598ff4288d67
SHA1 dc6553f9a43c25582a2fc7a8e600ee45d5d8aa22
SHA512 ae3a042dde84db0ff060635fd7b2b4224d42dd67933694f34fc65a8b91b52829528f363181cb990197826f938ff84245b002ec0670e6fedf99abee59dc0da245
SSDEEP 12288:fEP3RSeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:kSenQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1A055126D37ACB0EAE52A517D88918145D373F4A16B5267EF2680823D4F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 f9c06fc8e2d741229df51adea1faae18be46c79826de80f3e5c9f5aaa8d886e2
MD5 96c6dc96d192dbccf8120317571bbde6
SHA1 e276d1f053634047637469863111ecef85a4d56c
SHA512 171c514bbb88b452eb4e9410d1d0f96b30ff9b2cda440cf28031c2f0fff676d42ba6cb010dbb719a6efc7d78936461af7694c99137224c4883a870a793c5e618
SSDEEP 12288:ajkyFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:aIylnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1986512186398F4C6FA7A06788DA381919B367C506F2193DF6280F23E9F3A3D46D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 42cbd266613e20d96391286281c152c59ad7d3c07203fb70ccbf203c2a2f5e53
MD5 b2ae50de265997cb6df90d86c0de3f3c
SHA1 bc6bdefccc9f88fcd7dcc9994c9289f8390e4bf1
SHA512 06d1aab3d401965ff5fe3b0bd687ebb73b6b423258fc1ac7c58ce0506f4f0cb41f27787dae8194c19883be7ad1c02bf03e9dca123915317112b78722156ad171
SSDEEP 12288:10bGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:yLnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T11355236C2625F89BFE2706F448928542973B09C17F9167EF36886239CB7D3D416F6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e04b2aeb1d5a7c36ec8fa5d45604ce4116dd8eb8a54e2ebbb97cde51731ef30c
MD5 72663bb93385be52d6cd6dbe8a6ef64f
SHA1 6ddc6f0cd631478bff0f124036b6ed51237d10a8
SHA512 e30abc09e1c78f6d17ece2aa381ac61dac63e296d97edd252b103d4ea3530fb94098c85a5b039c13ccfba29c9238f007edc0c168039686282d872d4d390495bf
SSDEEP 24576:nQ9MxZKdcz9dw3wnQ/tbw/2Mkjy6Fr7g0on:nVKZwQ/lFTjN4
TLSH
T1AC558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 38ca803cb54448e2d5af006acd5cea010589df72a139f3ef67f57ce94d2e3cdc
MD5 76a937e5111ca78d74b1854cc2c802dc
SHA1 efb12c50bffebafc948136e0bffa5acbcc64dff6
SHA512 04534349b054ebc0c10a9ea606024eb2c40daf119d15f575e3f90a674c017e267523fab5de7196bb507eed2dd119d955bcddcf91d5f248929ded2c3d86694989
SSDEEP 12288:ByoKo20Rple9ppGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:ByocSAp5nQ/tbw/2Mkjy6Fr7g0oP
TLSH
T18765E01FBB6990A2E136813C88818745E773B4706B6267CB6681C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 9fe279d24955186c878c2ca5e8d2f0b96ac9d0df75efe7ef0285e0577731d8ea
MD5 f95f2a9fb1eecdde69de160cc23f0030
SHA1 77a3c75e3af8e92d6130f878645bcebfb5bbcef3
SHA512 2e078fdc8060d39b645b305e852b6fbebf62d7cf81cee6d01f4a27c9595fc9d9a3fe365886a65614b9826070edc6764db5e2761f8c4f561a8f99ea285bcd52ab
SSDEEP 49152:vWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK5Q/lFTjN4:X0zuNIMLm
TLSH
T1E5A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 edf5d739466d5ffbfb74b591dfe5696eaf29bced8a4ebfa766b5801768c62b97
MD5 70017023a5af492221ce6a0fa511412b
SHA1 32b7247e64e7bfb30f8e34787bea83ee6c843012
SHA512 55e20b7d762f05b3326052114fabf00c352c930e0b71ef58fef7736053b5dca721bf0605a06ffb97238a2a99e640d18498a1ed99aac62de7b39f2497737e5549
SSDEEP 24576:J1QT7EcpfxR+N5AWAz3ooiYtjMqbenQ/tbw/2Mkjy6Fr7g0op:cTDxR+N5YzTfjM7Q/lFTjN4
TLSH
T18D55B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 d5f6e8b18ff6b84d72b7469eba2526287b8976d2d0d599163080526951ad9ff5
MD5 92f35b21c5d3514ab14b4fc422c830ce
SHA1 d7e066e96d3eaeb747cdbdebf3b7146f94767dbd
SHA512 2e6da47940edca5f1d1658f967d373a59e271779b5680cb0b49e86705a68290e5d0ad92f681f2c7854c4aaec92ce8d2e65690e17f6a54063a96613e75b7eb90a
SSDEEP 24576:vTMdOz0FFS+1mSLCnQ/tbw/2Mkjy6Fr7g0oW:t0K+1mSLCQ/lFTjN4
TLSH
T12D75E17E636D14E5E53BC27D9A438906E67334620321A6DB0690C17D2F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 07d6246de0f8a7e508fd1c8bea5aaf80d5edce8648199d27df6e4e95514a8601
MD5 1ceaec1d0b75c18ac6a5634b3c6cf9e8
SHA1 7a958d535a4cfa72803a495ee453b2b00c2eecc4
SHA512 3eae4d818e8d5f5382dcabdfdbf87e04bd2a97faf82739c5c898962d5a6aaffc9328a71c56467792f34c9e4d76b263771bd10cdbe1db7497250ba5f37bc1907e
SSDEEP 12288:Z4THGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:cnnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T16555122D23E8B4DAF93352B48962414697327CA2276167FF36C4C63E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/316-167-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/316-398-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/956-124-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/956-162-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/956-130-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1120-166-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1364-137-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1528-160-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2316-74-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2316-396-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2316-156-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2316-80-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2616-16-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/2616-17-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2616-208-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/2616-23-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2720-164-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2896-60-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/2896-54-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/2896-62-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2896-64-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/2896-66-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3464-395-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/3464-70-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/3532-97-0x00000000005F0000-0x0000000000656000-memory.dmp

Download

memory/3532-102-0x00000000005F0000-0x0000000000656000-memory.dmp

Download

memory/3532-157-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3660-165-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3660-397-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3776-169-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/3776-13-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/3844-412-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-431-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-440-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-441-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-438-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-439-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-437-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-436-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-435-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-434-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-421-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-422-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-423-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-424-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-425-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-426-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-427-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-428-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-429-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-430-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-432-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-433-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-420-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-419-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-418-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-409-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-408-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-410-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-411-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-413-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-414-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-402-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-403-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-404-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-407-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-406-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-405-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-417-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-416-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/3844-415-0x000001E5DEA80000-0x000001E5DEA90000-memory.dmp

Download

memory/4336-158-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/4852-341-0x0000000000400000-0x00000000005C7000-memory.dmp

Download

memory/4852-69-0x0000000000400000-0x00000000005C7000-memory.dmp

Download

memory/4852-1-0x0000000002360000-0x00000000023C6000-memory.dmp

Download

memory/4852-8-0x0000000002360000-0x00000000023C6000-memory.dmp

Download

memory/4852-0-0x0000000000400000-0x00000000005C7000-memory.dmp

Download

memory/5316-161-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5316-113-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5316-119-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5424-86-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5424-93-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5424-170-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/5792-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5792-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5804-187-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/5804-400-0x000000000CEB0000-0x000000000CEB8000-memory.dmp

Download

memory/5804-399-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5804-171-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/5804-203-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/5804-168-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5808-159-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5808-381-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5920-49-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5920-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5920-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5920-365-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5928-163-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/6084-335-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6084-32-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/6084-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6084-38-0x0000000000510000-0x0000000000570000-memory.dmp

Download