5fb89a69eca347e7b59e0a03a12fde0255df40e0f197c03f7391f843902c4c80

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_294d95e171678000cb41cc3c86799cb7_elex_redline-stealer_rhadamanthys_stop.exe
Size 1.3MB
Sample260930-ejlrwsvgpf
SHA256 5fb89a69eca347e7b59e0a03a12fde0255df40e0f197c03f7391f843902c4c80
MD5 294d95e171678000cb41cc3c86799cb7
SHA1 195bbb6851ee4e0ac7115836f1dff84a61fc5b49
SHA512 27fb70f2f6a3e6a3d5e500a28ac39f13d236e3f9b3d420ff481412f390b66e4588acec48ad04b937bfd7057570494d4b7b2029d64f468b6acc2322e458c13c1f
SSDEEP 12288:R68GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:Y8nQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1F75522647950E473D91B04B54842C6A1AB3F0C913BB5DB8BBB89177F8B383D05A6B389
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
2220	alg.exe
1252	DiagnosticsHub.StandardCollector.Service.exe
4484	elevation_service.exe
3660	elevation_service.exe
4276	maintenanceservice.exe
4888	OSE.EXE
1728	msdtc.exe
4724	PerceptionSimulationService.exe
4164	perfhost.exe
1928	locator.exe
1676	SensorDataService.exe
3264	snmptrap.exe
4348	spectrum.exe
2636	ssh-agent.exe
4468	TieringEngineService.exe
3316	AgentService.exe
4552	vds.exe
4656	vssvc.exe
2528	wbengine.exe
4344	WmiApSrv.exe
3112	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe
\??\F:\	elevation_service.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-29_294d95e171678000cb41cc3c86799cb7_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b2257161c665fbf6.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_294d95e171678000cb41cc3c86799cb7_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-29_294d95e171678000cb41cc3c86799cb7_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_294d95e171678000cb41cc3c86799cb7_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_294d95e171678000cb41cc3c86799cb7_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3288	3776	WerFault.exe	86

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_294d95e171678000cb41cc3c86799cb7_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000001fe072c9050dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0d23e2c9050dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004035412c9050dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083d6002c9050dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000063cf9b2c9050dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000086b5232d9050dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000063cf9b2c9050dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1252	DiagnosticsHub.StandardCollector.Service.exe
1252	DiagnosticsHub.StandardCollector.Service.exe
1252	DiagnosticsHub.StandardCollector.Service.exe
1252	DiagnosticsHub.StandardCollector.Service.exe
1252	DiagnosticsHub.StandardCollector.Service.exe
1252	DiagnosticsHub.StandardCollector.Service.exe
1252	DiagnosticsHub.StandardCollector.Service.exe
4484	elevation_service.exe
4484	elevation_service.exe
4484	elevation_service.exe
4484	elevation_service.exe
4484	elevation_service.exe
4484	elevation_service.exe
4484	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3776	2026-09-29_294d95e171678000cb41cc3c86799cb7_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeDebugPrivilege	1252	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4484	elevation_service.exe
Token: SeRestorePrivilege	4468	TieringEngineService.exe
Token: SeManageVolumePrivilege	4468	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3316	AgentService.exe
Token: SeBackupPrivilege	4656	vssvc.exe
Token: SeRestorePrivilege	4656	vssvc.exe
Token: SeAuditPrivilege	4656	vssvc.exe
Token: SeBackupPrivilege	2528	wbengine.exe
Token: SeRestorePrivilege	2528	wbengine.exe
Token: SeSecurityPrivilege	2528	wbengine.exe
Token: 33	3112	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3112	SearchIndexer.exe
Token: SeDebugPrivilege	4484	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 3448	3112	SearchIndexer.exe	133
PID 3112 wrote to memory of 4464	3112	SearchIndexer.exe	134

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-29_294d95e171678000cb41cc3c86799cb7_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_294d95e171678000cb41cc3c86799cb7_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 452
  2⤵
  - Program crash
  PID:3288

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3776 -ip 3776
1⤵
PID:3824

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1252

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4484

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3660

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4276

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4888

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1728

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4724

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4164

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1928

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1676

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3264

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4348

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1984

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4468

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3316

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4552

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4656

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2528

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4344

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3448
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 46e25226bbb8d2d8dd989dab3206d2485680f33ef5c2dfdd20b2b064cf5633e5
MD5 7b2239f5f52b4c4eac723d4fe18b17fa
SHA1 6b4be8cc2389cc1651a1fc0936986af04522d967
SHA512 3ebf4eaa39cfdf554f743a8ca66262e8cef50036ae5e42f97fcef1c194d58b255a2b96a3208683e18e204c152950cfdd4a3ae8be5cb02c7215c87ef4ad35e2fb
SSDEEP 49152:ab+632BuPkFKRrdE6ohmstBhuXjfS4LWxn2Q/lFTjN4:M3q6HjBuLm
TLSH
T15DD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 823c0f23645cb2f7defffe183d600857d3d0cb4c5d1683c1cc338ced5cefec3a
MD5 69bc0e4769b58263bdbfd214ba7c0155
SHA1 945149c9e07370b8eedd5044883f72b6271c63c6
SHA512 af4f6fc3c132c9eb9d6612a1fe669776ddedda9f17d6daebd34020b8a1677acd6568c61f2a8b2768619eaf5b6ec763649b6202547ec914cfa90469595729d83b
SSDEEP 12288:U1XLsswWkxy2lRq2czAdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:yXYfDtczA9nQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1C265F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 b73426fa04a787ebd6001b8d6b60e29c55b4bc5e19b94f9d6ead7028e6d0a960
MD5 4224816f95201d3b58b5affb94f9f260
SHA1 7b76cb44afcee3d88eb117c4691434bea5264739
SHA512 9657d814fc08b65a1cba7918c75a6ccba9e3168e93e0e731ea47e5fe50ade56efeae8fc8ba851a5b444df0ab5de7aa20f4b3bbfa7c858544fbaa855ec9c48eef
SSDEEP 24576:F0Le5ji0hmxLrM+nQ/tbw/2Mkjy6Fr7g0oi:FPji0AlPQ/lFTjN4
TLSH
T1F7859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 58437ec2a0b667428df1cc01b5b61700effd32fc4b4489a67359abf37a2068a9
MD5 026eefac22151331fb7271f2a95560ba
SHA1 c9eb63d83ad76648260cb9ae22a6c12dfaf55622
SHA512 927fcc3c697de1e2f57dc769f51d6df7f64449c191d26b75524ede9c868c27f2846a74b1a1ecfc6217dc04baadbef05d6bcfd008fd4f093927c8c8cdc35e2180
SSDEEP 24576:ya7/ezSC6vUyD/aqgrvWE6q8wyucnQ/tbw/2Mkjy6Fr7g0os:V/ezSC6vUzPvxHjyDQ/lFTjN4
TLSH
T1C0755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 01c43e7eb15cc7b627ee44377ee39f44278c4931a520deab1319bd9265af49a3
MD5 73e35cbcbecb10bd42c59a30521978dd
SHA1 a548bafba6adacc08643207dac392ac30d4b3418
SHA512 f790c7d58c688193cb417dd013f2fddfcb3daae190a21d4aaf8d76dd5ce3f081e2e90b49a4245de3f809ff997d96a6459fea1c41cefabf206416cbabec5ecbeb
SSDEEP 24576:PVbqPb88hv/l+6pnQ/tbw/2Mkjy6Fr7g0o0:PVO88hXl+yQ/lFTjN4
TLSH
T1E5559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ec689b8be5d11d77bdeab3e6b16a3b213c99c682869a444dcfda7db2172e5ec6
MD5 377b95205130048a66d731d1b0ac55f8
SHA1 fa173950eaecb849c5c4bc8bd5fcd5bd957c5f56
SHA512 351ff509601ac2e75aa1e25fd117b6e141c63179dc04c9bd666a6e9418d0db1de2d85b3f7112a483cb70e0e6429f001156072484b81f50851fa1358f25e54143
SSDEEP 12288:tzqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:tzqnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1475523696A24F89BFF2B06B15CC284826B7B0EC1BFD0E74E6744322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 f6b9c32fac8b7a9809d21ecfa98e74e6cbe91380208e9f415f6c77e12b749cbf
MD5 0079e3fd4f170e5ecef39c27bd1cd710
SHA1 541424268ad95b9e84f85be61465e9452ed92de0
SHA512 7d59c37ccf0743bf952ef602248497d5d6db919411b4cb4fb46df015fa83c32a607aa74420fe5fed82f6460f4a05c2c6dfd201f09efc4c0d0cd8d148460acfba
SSDEEP 12288:EeBNUbTVO86UBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:EJIURnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T15A75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a398d770c5b938bf47175e1cb46ced576e5a7f21ddebae1e82a9e56259ae0def
MD5 20cff7e53137a71ea489950b0a2b6f48
SHA1 30697faa62e26abf5ab9b606aa43bf48ee280375
SHA512 d165c0819ae675bbb5dc47567fb0fbc36a27813f22d2201ffbfc9a9e62b7c4d50fc56526288955b79daf85607fb95f6589228c4d5f889e9523c5e99efb99b75f
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THJ:TQvGAdlCEL8c/yRNw5CvLm
TLSH
T1D3267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 5f85ae4f315b01d876b309230efaa5405374e7652e802d8e9cda129a748af73e
MD5 f11174ca1f0a5c43f165a579555cf989
SHA1 d23b9afa5cacee44e2d69bf025910bb69b33a9cd
SHA512 96ab48993c2086ccdecb392e1877f61cb88b920eadaf68b84096f14294ea0a55424a34e480a0b60b898258a2cc4d122879c58274fd74b893ce9f776c9e7f3727
SSDEEP 12288:MAwSfxL/2Dc39DLLmt0LDQewsAjfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgb:xQewsAj/nQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T16A75E031FE74E436C77F0DB21B22C706593D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e2ac3a9ced2415272b5251b98999c6311aa91a9f16c2b990f1298c020ffad63a
MD5 ae22528c988d2bfdb68c659e812b8360
SHA1 9ca438898e90efb0c2a4515f10f81cfab1b4164f
SHA512 4f47f5eef43a9ad07b747b3addc4c6b2b4f9cf51e36e223a2f55981af9b041bb30b0cc658a0fe706e6da989dd07b9199d4c53c46d57508a25ed4fb1e7bd61d84
SSDEEP 196608:pUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHcL:pUEtQevvqc2W1cpV2EI32
TLSH
T190474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8f250115631fc21020863ee88c50444db06e9cb81f21825f5a5a3abf63c9936c
MD5 1beb7369350ef86801c72ab7659f4a7a
SHA1 7f62708fdd3227ed4cd033df9869bf888d58ef89
SHA512 97b63931ce5af8f35dad7a11ac9e42ddc4d64b3e23bf82c191a1fe81bdee7a5ef0b65b6a24dc536cfff02a8b40f2c185b4e107db300d113acace57953483e515
SSDEEP 49152:YCbRquA/m2yL5zQfFiV+XenmE3/zfQ/lFTjN4:RoqtVjnmzLm
TLSH
T1BDD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 380bb6233a76c8f68fdb15cade300cd770cf4c4f7623a0ddb35b93f4375931cc
MD5 ac441777bb489e09ecde26b9e827da42
SHA1 0dc45be97ea1cafa856ebb40f47e88713f586814
SHA512 7803e9486fe93a68c5192d9621ecce78c116212a16fff96fc4954c32b8265b379d943d73b8167d059382e63ef9b0c45b0648e144d7d280d07fe86675a0e445b4
SSDEEP 24576:zAhGLJIFoiwtA5l7S53AnQ/tbw/2Mkjy6Fr7g0ob:zAMyFoiq5QQ/lFTjN4
TLSH
T19A35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 c37b558f18a97e91873ed3409aa4e18078b7d2674011de89d9610b61f39ff089
MD5 3deac2894414b237a87324fc8ceb880c
SHA1 65faff158e1b487e8f07c69e86bfa2665556fb28
SHA512 93f14e0187d23318af79b19b9d20db70f5c68963d637d8012fd24e55d3085e5f6ea5c76d206267d3e79b2f72cb5d4d06ea9cb5ef5486e7b93a1db534740a27d0
SSDEEP 12288:4mw5HEjsChN2BFgl0WDm+C8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMB:1wuHOWjnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T13A65F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 c5f0c2ca9b7e4ee770ad46e1284b7a6778b044d283b625c286e9c6a5bfcad88a
MD5 dafd3a4756edd8db1d90c2d8676d4e5f
SHA1 d7322418be8dad09e8a9b392444b280bfec39cf6
SHA512 1d6e680c44f18849322d2062718390ce2ff6722af22c6b36abb24fe23789f483346a878cab9a50b88c0c58d39de4a8d7f23a353dc4fa341c8a84f298cc2caea5
SSDEEP 12288:/XZ1IyPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:vZumnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1E555126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 94d91ad204853428a4aef12ef73e0abc9b946e37822209064239663dec94a52d
MD5 fbe88d43e9e82085142fccfe5c10d338
SHA1 85a45e8964e72a8f19069d7874ced7b559975af9
SHA512 b77b5d73bfbac6aa593bcebc6da66a6f3c562ca31882c5c2201c06723157e047e81172419add9f3f4a4e3908486eae9f79c6db3896531a5980ceb11e3cd82235
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:vQRQyi36YOcPQLvw2gAf+PN3KLm
TLSH
T1AC666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f0c1dd0262bd5eaced557b6ad77c71ab830a8470ca0dd8d4e7a578f3a00d9ef0
MD5 ce83d8dcdf07fdcbfdec36b6388fc81a
SHA1 ed23221fc8f2e90194ea41f284098ee7ec699102
SHA512 a0e1e9808ff556c92ee62ed7f3fe9fe0f696a2dce067bde20fa98fa857a47281d9ccb36713cf421d40af89e2570329e528aa885887dd2c2616d96d4eceb5beca
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:LQRQyi36YOcPQLvw2gAf+PN3KLm
TLSH
T104666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 55bbbf09fe47461ab88a97efebd0287fb9b6b22d6add697a734d9a0bd5dc663b
MD5 a603192d3bceec2231dd46db28c0e08b
SHA1 d42a8b4f6e7a4c8ea4d544b25f3bb89d1d4377b2
SHA512 ac906e8c8d3090cb8c2b99a166d3f0c5233b87b6654d3f7bd3b317a13daa409ca09168ac27ee6248e4c2d33d7bb7ba7ceb5a3d3a998bdc50596f6d9166e0ce87
SSDEEP 24576:KwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL02nQ/tbw/2Mkjy6N:k68Qg55nhheWu7PNU3/PQ/lFTjN4
TLSH
T1ECB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2c51052c7a21c168f42da08e5368e236a0715d36b834598ce7a1fba409af2a47
MD5 b7987b31debd1d084a5c5686b55fde79
SHA1 4bcc24e7994ae24e6d451956f5ec8557a6913279
SHA512 fc9cead3f762b0a63fe8cf7055edc91c6bbdc9d349d15da17e41a2746515b1f8dd55c78f43c0467a0f8003c921c0cd7b09feb3caabb5bd840be862f526ea1f60
SSDEEP 49152:c3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99H:Zy5112gYy5azzVvL69nLKnhZlLm
TLSH
T1E4167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f5ac1a9d6f2b7b5351ad4bd6b8a5ec6d67268a3659bbbac1f4b6373ed6c4ff8e
MD5 aa59085e0144ede4b002bae1f35a8854
SHA1 36f445ea6582b7fc0494e63395422130c5c3b071
SHA512 393798002e89774f98dcb19db36a4d7e8e5b6096469dd39008eb3ac8ae4fd49fb9db94525286dcafb418aa37bf6ceacb21b1b2ce1926a9a5a6d836fc66c5db70
SSDEEP 49152:LB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glNQ/lFTjN4:du6JmVxd2dCLm
TLSH
T17CD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e1815d2bda4f171a2810789d39d9dc38a84b64e0983d05677312270184f46f0e
MD5 5278324dda4262d7ef6601100640831e
SHA1 2777dcf544d8280d0ec9849383124ec6af73fb16
SHA512 a52aa6c71fde1c61ad58b8b1fab175a96b0a67ee85017715d6ddfab1e9e42465dd622712d6ab3022b7fe9533deff853e142231dbf5a9ec2d05ff6de6c3a88f99
SSDEEP 49152:71hpsNoJpF1A6UU44CwH7R4xxQ/lFTjN4:7mifPbRzLm
TLSH
T161B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f3fa9759f254a8952b531f4a4c7582006586798a2f9b5060f29d1c67949d34b4
MD5 1253cdd85519834ac0781fd4af2df5ca
SHA1 7029f9654c1a7f83ff4a50e19772a5c2d2e70197
SHA512 9bb6cb34a3ba178ccec31f5e2ddd71c059161c3df0a7e2b699babfa277846ecdc801e387e4f2f9d2899b1835444c0abef3c150aa8c0eda268a6e5e32ad3523d4
SSDEEP 49152:ySuZQIY0Be2KRRVtOnks6NMHqmQ/lFTjN4:s5dKTi61xLm
TLSH
T14CC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 70c38119686925dd4d407ad58e69e1a8ef1dd1572d5dbbfc1d29cc41eac62944
MD5 67a9bf12afe3a498d7c6892dbdbe27eb
SHA1 4a56ca3fcf4d81f63a26948a877a62132da7ee38
SHA512 75d7efacceb370ae3a7ffa6954b4d9751462dc6cacf6798622c9cd552b5b6882cd37654820338904c4d94f3813ee04a5ea5af20d5b9a9552ecef27f7d57c651a
SSDEEP 49152:rhtSn8EApI0figngiDn0AP5w9Q/lFTjN4:qX2iyphXLm
TLSH
T13995BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 d93fe66ea677d7c40ccecba57856a5d9941a24ff880ed0f86f46e499237b2481
MD5 2973e3b07bcf64a5ca70d4e37f5d8767
SHA1 8d4900f8b2883185522509840eb388dd6fad6299
SHA512 dc482f873b649b1b35def2084f4228d83a787d526ff784a3ca0cec226a247231c98a4fe0962f85d20dfa6b18466c81f07f21b0012cd82a9a5f8ef42263f40a41
SSDEEP 12288:9yGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:9ynQ/tbw/2Mkjy6Fr7g0oq
TLSH
T17E5523697965F98BFB1706F14C828182A73F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 353638a62dd7da21a0c89dd4c7d80eff287063c0bd0bd5502a1818bdaacd3b4a
MD5 09f9de1c113ccf3ed1c22fa4c76b98c4
SHA1 c1a3c919a17a85b0af3bfde6f6de75a482dd4ac2
SHA512 bd5493ed5dfc00919c178ff59a293c50e31cf7216aa8ca28c3546e8f97f6b6b451075874cd53ffe6fcf330bab5fad727d1dd50b8a476c6858eb0d5da5c231d25
SSDEEP 12288:trGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:tbnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1C95523697965F98BFB1706F14C8281829B3F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 78c3a18fce4befc8c65dc1d1aa9725ae4fd5db9e6e7904b8125b3d8b8616a282
MD5 719b6e474fb9a1f0cbf28b3d4ae38359
SHA1 49c384ab2a1d587feb3e9e6b13bfe5e4b87a4e12
SHA512 95e4d16b36864d97d344a19286ed05312c0e4b55ea7de8e17f6f9bab1a8480d1e17f740ea3f33e880160fa5b7d874277e6c1dddbe059eb631470a66ad456a5c8
SSDEEP 12288:EpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:E5nQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1E35523697965F98BFA1706F14C8381829B7F0DC6BFD1938F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 9d6faf0e058fd4ebf215f419671a88056c509b31395049db26ce00016bc1e17b
MD5 c57eab59c858768677782937baad177d
SHA1 f53fbb5b58c82940abe92d780b43d6ea6a793cf1
SHA512 bcf2639843f6fcbac50d992d0e815e3e54c6340d27d451a16cd0ee060e3c1cb47133aabf3ad42843a9ff85fee35ca97119e0a4bcf4ce20ddeecb7cd776063316
SSDEEP 12288:aVAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:7nQ/tbw/2Mkjy6Fr7g0oj
TLSH
T10F5523693B69F4C7FD2742B4CC928142E77B3DC1BBA1A38F6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7b5ed761a73b88c3752e31d2bfb76b871c10ed0d3c3291150b557947233d9745
MD5 d7c70af4cb4424ec768bb58ceec622f2
SHA1 1a7bb629e5072c0512a80244ae3f5ff3d810cb9f
SHA512 59cfb39ff2eb79b338d91976cf84727a671a3c8b08b4d9065a9b96665972c02122a9c357976272d6273216cbab13f8dd321116723d26b50e5203b53405100773
SSDEEP 12288:N4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:N4nQ/tbw/2Mkjy6Fr7g0op
TLSH
T1E15523697965F98BFB1706F14C828182AB3F0DC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 cefb3d8cff71b59245812741dea41ce7afa3b0bc7e4df736b309d0eccc1bf958
MD5 0ff4343826168cf14f4a1d82b1d27ede
SHA1 09c5eabf66d89d4b39cb9a404a495c5634ca3146
SHA512 1519cd5ae827d4884aab680a19a2773fa0c8da55c8163fd1b7eb35a515368e7d8d6cf18576325de4255ad0340f43d3da757f5b30159bcf0290e4e1f6cc85249d
SSDEEP 12288:JHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:JnnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1665523697965F99BFB2706F14C828182973F0EC6BFD1938F7B481129967C39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 058c350c76c7d5c7ace0376e5374e33060cab76b6b5eaca7fc6dcd3b1decc9c9
MD5 c00691b8c981fd03717cf7b7cbdbdf47
SHA1 9dc8ae94bf4d6ace979106edb8ed247270a9214c
SHA512 c09150a74ee2bc479546489d88f7f8e65031a814a88c03deb5bd5b196991650335d0f6ac943672d7d513111bd077219e549a8dcb1a80c694064a7c162deb3a9d
SSDEEP 12288:/DGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:/znQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1915523697965F98BFB2706F14C8281829B3F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 aff88b9f18ccefaeb76592945b2153d03fed60eafaed9604413d104a95a9e7e2
MD5 46050f321de831667644c3d242f21f06
SHA1 b3dd43891e8fbb6ae274dc0a3a6d947f29ae00c1
SHA512 100dd9b72924e0469a0a07dcafbed09d8729f67650edba4dad8a459bb81550f761f7a755ab1ec678da0407bf7893145cd062667814c1cfe79f62fea385f4c9cd
SSDEEP 12288:ciZwbDzzFEoS2cPvyLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:/ZM3zFVSO7nQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1F97501A5B39058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 022f7640b8c3dbaa09d16ef74f456325be7b7d3c87440cfad78238449afcfd91
MD5 a26242b546811f4158aff25131d96a34
SHA1 4105c1337e0860c1fb4770d26801cb1e98d11c8b
SHA512 49ec5fb46932e6525917f172f27693fa43819d9686bf96d323ae40af7b0aa728830acb006dee692db32a38ceb7109a4ab53786f87f12bc8c02b92cd6ae2e39b6
SSDEEP 12288:x2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:xWnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1D05523697965F88BFB1706F5488281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 da01cf2f40aca5a88ed42782320f6e6c8c69ac9c13b5e9f8ef8f18f2d7ddafa4
MD5 082d6cc3b8754a91e02b36c69b830129
SHA1 597673f8259470e49ea7103230911ba20e7b1d2c
SHA512 73552462dac51e6a2e05cc00e1e28c6ce82a349fa371d75d7cbfdbaf4bfda4927875aba227b0377df36b06fe09223fe0c0b309d4ab4f8450af49f611e5aca1cd
SSDEEP 12288:CaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:CanQ/tbw/2Mkjy6Fr7g0oI
TLSH
T16F5523697965F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967C39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 a5f6906732e4d6b8d7b0dad5d7d0a92c067696ecdfa72e65005c453de3152ace
MD5 fad00b939c1dc685f5d1f3480f0c0cc0
SHA1 0858b3a940ad8e0f62cb1711f364dd790c4a924e
SHA512 0cfd9bfdb5a5fd1fd3b6f1761d8b0ae85830022bde102d084440c6981e615a3586e79ac3d042491bdaae87665593bc939cd3765e571bb8cf262543587db391e2
SSDEEP 12288:QyPz5L8PGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:hzyvnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T11365021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 250a39cab47e42d0ddd6de1a2cdd2d13bfb04ab518805b409f47189135c82737
MD5 3035286ad72cab83b1a84b1987ef299c
SHA1 32bc72b7167b8e9a2a81097c80ee77954ebe3277
SHA512 40ff43b2faaef2cbcb1a74ba5feb2bca5dda03a51294aee810d5b05a8058889c5c15384e02072f124675d5c661876e1049beabbd2ac7920ac616717bf5c9006b
SSDEEP 12288:S2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:SWnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1B85523697965F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 52c972e06e57cdcdc2fe6740d17a8af260f3278926768ade61ccb8d9d5e083ba
MD5 52ab5b1065386cac36d6249f9524cef4
SHA1 a72a305febf62ed2aadab9738bbdcb9db64da218
SHA512 2c78ebc3b00d57227cb977c6efbd17a24f24b5f5b01a7f7bbac935b26e7635a503ebb17342d776569537302588d3027268711e39446ab3ea0578d6dba599b6ef
SSDEEP 12288:D2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:DWnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T18F5523697965F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 c9f01e4c25d9f2e747a733c64e26800d9f8e3156a9a71139960e1fb0e6be83af
MD5 bacd63389324b24a561912937745dcfa
SHA1 f631e585289d37e006d55873f1dbe17ef415c3a0
SHA512 24f5e11b5a5a632c6b5c6825090559e09742a9afe34254a9864a2117c524896025b212435d23ddee6023650a251ef28209c8c5903fbd4d50df70539417aaca54
SSDEEP 12288:gyPz5L8PGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:RzyvnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1EC65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 295d6a7a4d845cbb1953ad59f26948dddbe225d3c7b941513e2787807d3f40bc
MD5 e10c5adaa9c6bc51cf0a2aba111ba21c
SHA1 7205ee3d052b160bde31bf0a88984af3afd00e69
SHA512 885be7ad19517a73c3a0534d061068d8486e7f8ac02493ab5e431f1323f39354406af09d1fcdaa7f7728ade7d7e088f4d613901725289963ab0306d4eb0f42be
SSDEEP 24576:rT0aLl3z0zDJnQ/tbw/2Mkjy6Fr7g0oO:rTDLljcQ/lFTjN4
TLSH
T1F37501A4B35058F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 65fc966e84c7e8edb951ad1fbec3d6c247c514e3e8dbf0cd7feed0c0b795130c
MD5 513c985732319942cec08a1f423025bb
SHA1 86cf714c9ddae98a665a46b54abffa8c450c9922
SHA512 65af9c35691aadfab3efb80ac9b8d98ddfd49bba0ea28a8f37051bc3c556eadee18eb7820d407eaf325db101c3e02305da992f28b807328201caaf64edfd2e31
SSDEEP 24576:s31d9CHKy7GZFnQ/tbw/2Mkjy6Fr7g0oU:W1d9CHKyaXQ/lFTjN4
TLSH
T14B85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d5a7dcc13d776527c02a0b42a3d85b116dff0e10f8f11a6e5de6b7b64815383f
MD5 88ff1af8ed9ba3c0f37f5f766782de7d
SHA1 54dfaa6a4f1743bb2d3382c49c28eeaee57ca128
SHA512 f2552d8afd5f38748f1fbf09ffd4947c629c08f0f9759d2c022b10f04bc0ad1ac9b6addcd3544e3fd2da2d38ac0bc29c66be5e9d8d0b0996a8c966d77cb94766
SSDEEP 12288:0JGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:0ZnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1725523697965F98BFB1706F14C828182AB3F0DC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 fcf14b159762995ea7d09a6987b31096d116715a2746af154568391cf21eb945
MD5 d11b1f468f6eb0e7cd1d1a9283180409
SHA1 ddcec6396318b5a1f731464c4ef757bd0a3c8e3a
SHA512 6bcc73b5a12be59f35cdf1e2b2c941ed37552c7bc5428d7ade2b602e54c401613624efa9987ab1702626dcbbbef7c43da1ce45ad24cbc01d3ab41fadd903fafa
SSDEEP 12288:6vGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:6PnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T18D5523787964F99BFA2B06F14C8281829B3F0EC6BFD1938F7B481129967D39406C67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 53917567c894411c8eb313cbc3e086628c64b02009873b448cc6153a95c2d9d8
MD5 b7d48d7261fb6fea06e71b121f96e56a
SHA1 7c78bd667a208277dc3d1a8a4af04590416eca83
SHA512 4cafa93e1dff4c8ba4ea14381cae57b2b32255d92e5fb69bda53f7b3739cbecb96ec476e4dcccbc346b63d388b701b2a55f2ec3126ba0532f076d38497fb73b1
SSDEEP 12288:00GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:0UnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T11E5523697965F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 e97a44e1bec3ffb6efd5a42920e34e76d39068f90d9da79891d1832c09207700
MD5 b613a469e33ba4978981f160ff6e3655
SHA1 e3418f02afb4cbb2c66824dc8bee26043607a305
SHA512 6ca7a0e76ee9bf2310bb5ae3fb70635b47f63ac342aca4c92f167b97a3d0a72a19df93e8ff59d0a14ee5397e14077e77d708ba6237c66decedce3badcd879bab
SSDEEP 12288:32GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:3WnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1695523697965F88BFB1706F5488281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 98f178f26d804b77305c22a91203feb9cc55148dbe0f968ab19dc1dda24e7bd1
MD5 ce143cc23be4e07d65ae982e9c026a9e
SHA1 e23d56e475686c66d00bc233bf34571233971ab3
SHA512 92854c80557cd3746df647f478c1aba55802dfa17117651607a726b4ef79b3c9c8b0146c793cf97d0ab57cefa695b50ecbbde698adcf476c2153b60cbca4a867
SSDEEP 12288:DssfGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:vmnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T14B65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e8a90695009810cb242dda891175bc70cdbb9e035496c4c73de8137fd7cb1fed
MD5 26f9b9bb4fa9cda74ad5506c2b0da888
SHA1 c3017e02a0ebc58daad32340313af8d4c5f20100
SHA512 bf3a8d949001894e560d4561ce461ad015f83ed4c989b506c3f5efa8ee2b6b38478884fa4ef9d7d93706c3cefa9b0a33cbabb0998bde39eb5439f8f0e671bda2
SSDEEP 12288:14GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:14nQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1255523696768F94BFA3B06B05882C151673F0EC5BF90D38FBB08222D967C3D01EA6745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 fce51475f297713bf9853702dc44e8b138947f157182c1acf3bd6e0a08fc9f7c
MD5 a84db2b132f2b107d898922776f63ca2
SHA1 14018069dd0a341d45f38a1189770da55fd6b687
SHA512 edaa046880c7e28a885d61ab8722f63f5f7db724b917e65fe31b4702cb2c425d8dbc87a8bada7d5c538455625ef42125e71a6aad3a4c30761d928ed64496fbb4
SSDEEP 49152:wa0h2GEkuAe73q3pp46zwwQ+Q/lFTjN4:wa0hNYG4JweLm
TLSH
T16F859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 fc7538fa4fd1df2137645a447aa07b2e37cfa32eb1ddeb47dba0597dc51ad1a6
MD5 01a452db68191ec3bcc9368c6df673b7
SHA1 b432fa3bb6edc12a6cc4865bec80d505b2bd5c82
SHA512 fd80b6bfcf5e8b32433491101ebe0fd11c93aeac649e60d3304dcc49d8b233c0f8f3f8aaf86194195f4246ae045e85844f17aaf37bc926626aff471a5b4e451f
SSDEEP 12288:8hbHjfXlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:8hbHjPFnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T18F55027D26AC30DAF63692BD88928546D7327C552B11A3DF2384823D4F3BBE40D79B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 3a19931e7e61b11df6f113998f97f7b246f63a0f7f0f76d19f62be06b7c4bcd0
MD5 94f84ace490f9d6abf0d3801b980c6db
SHA1 06c9881737827e1f20471b268099db2fc9277487
SHA512 aac702746115f64f85bc4767ff074b3a57e59b713ee94bd7ce65edd55610c18b43e474e0d3fcc7f62d18a7a68e1af4dbe7891ba906fad469b48a4bbbd2f2cd36
SSDEEP 12288:OEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:OknQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1C85523687618F98BFA2706F54C838546673B0EC17F9193CF7B482229967D3D41AFA780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 922be1ed837c804114f45b3e154767de1c178c3b4ea668451f25c3ecad921cb4
MD5 e0aff5d2231e01c0b77b9378da092ee2
SHA1 9ddc88cc1d0152dbe5667ceb00bc610f2ce4b363
SHA512 b6c7fc0c2ad91c504a24598d368f94ddd36b3c115d4bd5ac4035b5800af6d68356b1a80fc17d715e28287fdff867924b577e3806ef7ea32d200a34cff7170c60
SSDEEP 12288:MOb4A4LWOsvAYFTrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:xwL3UTbnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T16975F155F7A450F9E92B813CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 1b3f455751588eab6f20d781d43d23548cd1492ba60b268d0249f9aadaefb6fa
MD5 d6992d79b8d3393143bf60aa022bdf1a
SHA1 1fb7422a823059135bf29d6f2e25a082fa1da026
SHA512 e9b557e5b361f31a8ecf89b66fb236c658195e871aea4045b15be3d0efb7e13b445823084c3c374e562cefb83bd5029703851a24eb1f0f0daa447168ff72dee7
SSDEEP 12288:CpFtCOXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:vO3nQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T10655022D36EC60E6E536527C89838209D37278921B6253DF0780817E5F7BBF85C7AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 392e0bdb9da7b7ab2e9825cfc3ad8da05f090a05dc3c163bc6f1df152ff8c714
MD5 32bc1579326eab1633fc24f9bb3bad47
SHA1 e958ff32e5d29fb2f6f5663a4932bde3b51af864
SHA512 da2df703462dc4d95917625a49fc6fd3f91ae8ddf9c6f683347860677ae19e3c18f2795617fee4eb42869d03cd340ce60bfd6e828d9e107220bff685daf6cc34
SSDEEP 24576:+7NM9YqZqmWMUkPjZM48Mv6bEhsInQ/tbw/2Mkjy6Fr7g0oa:+7cBWMpPjN8DbEhVQ/lFTjN4
TLSH
T1D0659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 f383bac90cc83d4f60d0f0375a053c9d2b92b7c56849dc4acf7de2d5aa625f9d
MD5 e4fff21a92cb34c1d0474ef3daaa91e4
SHA1 2f3c03eae4e004271af613a0971183ec72c31b11
SHA512 4f2d0bd2d85dcc0acab873c9c40eab0ce9b1dcac051208a9e27ad2a7f0d64d763bbae013015c7b44fe21902d055155509d65d4001030f03bdbb31c87b7b4c87d
SSDEEP 24576:kW6BApg2YuyuNDYTabvcdvNYf8km1ynQ/tbw/2Mkjy6Fr7g0oC:kF2YuHNETovAvNYf8kmoQ/lFTjN4
TLSH
T150857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 26df5685777958a1bd085043c7893338267293d481aa9cad6222a97218e23ce1
MD5 0f4cb6dd2b794845dd98d1b5b097135e
SHA1 264fa74ce9a7adeed9693099150f7da8d8b3a6a5
SHA512 55744a81636c3c94120c1d3e9a19904a98ff33d1cb4807c829dd94b7356604baaaeb11cf4b49d6ee859c227783d36ef135033bb9d9d6171626cd7d9d30599d0c
SSDEEP 24576:JAFs06+Omlf3NXEbToznQ/tbw/2Mkjy6Fr7g0oq:OFs060lVXueQ/lFTjN4
TLSH
T10465AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 b48f98bd3a8d89af4038cfeb5138e6e883a2e080864f9af0f270961334a6b2ea
MD5 cb67a7d7e3466987115d091d76c70914
SHA1 72390328798b88c7a75434cc6a9b52e29d3917da
SHA512 9cc0b295b3dce86d18a7bf78159ffef0302a122e2331fe8c84c5b84b3e95ce1ac22c6d2a1c208f009256f3d1e3428eb0c063b6a4d61cf00be0b437236042b6f1
SSDEEP 12288:ZCJnJ5D3VkrqzxoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:wJnJ5D3WaenQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1EA75D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f5089fdbe3f8a7d46f6b97d435b69fcdd106fc51b7dcce4122d2d294a9c38de5
MD5 4a21cab2a027b3caa5d43d67edcb2b1e
SHA1 30e9709bfcfee7ab506791c97833ec0dc7b025b9
SHA512 6d0f488ad82c25b491929ef88d7a3177c3a8180380530d8686507155a5eef0c8ac265e07de4a64c7c447038643c79a61c0731e88015ba4fdea2cf426c36ee44e
SSDEEP 24576:0EPghm6/7IIXdwcXrif7qQncjlP65i3VudnQ/tbw/2Mkjy6Fr7g0or:bg06DIKdwc+eQnSt65aV8Q/lFTjN4
TLSH
T151955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 0877caf38d21c64cd51d4974f98f9dbf2f471d79748122bbc65eeb46af3f3878
MD5 e405f16175fe68a3a5ec2e029c1174e9
SHA1 306d95c0c12e181825cebe152cdbbaee20d0808d
SHA512 3cdeeb64f85b511ef00b503fe97dfd2aa03d7e2d0dbce8d8287f538c49094ae3e3b2491624783e15abfe7abf8b4f26f46c8b77e8f8e0da5a2fca6670f653f828
SSDEEP 12288:JEP3RS2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:aSWnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1C955126D37ACB0DAE52A917D84918145D373F4A12B5267EF2680823D8F7B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 e2ca3653fdebe62da65268a778f4aa89c738de52a54976427ead50e96378211b
MD5 2a6c70dcbfb18e79442e9f0cbb0bb485
SHA1 93e63ecb7dfa452f40c0570f9dd97ec5a5c87717
SHA512 83b8955c017bad91e0ddb84fcb78d8ece052f57c5e402885a54c8da964fb7898898d8dae167ff0c3cd590a4a2320d4d3f8a7b205e50ab2031596e6925597f7a8
SSDEEP 12288:EjkyFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:EIylnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1A76512186398F4CAFA7A06788DA381919B367C506F2193DF6280F23E9F3A3D45D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 93c5d2415fcc17824301d44b792d29c8106c657577c7cf0de33f4fcf9129c6fe
MD5 1de8ed4ef03010dfefa76f2ffebc7f74
SHA1 1e23ab456258bf598cf3f1b43586149083f377fd
SHA512 1399ec33ebd062a244b54509bed1ee5318daea8446e3e19121a935cab6a979f2b433a186a2beb3fb18b2f937874c10aa67adb89a2710af3556cd15672ad10b67
SSDEEP 12288:p0HGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:GnnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T18155236C2625F89BFE2706F448928542973B0DC17F9167EF36886239CB7D3D416B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 00d8b30c96fa8b40a1076279efef4377bbfd5fed25e09f0c4e7807a217d6da84
MD5 e86586570867add561eaae9b965b8186
SHA1 bc90b4f8bdf630e87d40bd5ebe45e0d38b98e3bb
SHA512 32a62b75e2528933f277842c31d6304237414b9dda09d73b682fecfdf79507bd24682194774c1297b0c8fb13f7f7a08800ed19f3fd3ee714c82e52cae7fd6740
SSDEEP 24576:jQ9MxZKdcz9dw3gnQ/tbw/2Mkjy6Fr7g0oC:jVKZgQ/lFTjN4
TLSH
T15E558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 6421c1c466b9f553b8894ec5fca94cadef07a02feae66152650b8e42c3d058a9
MD5 d9993c2165bf542fefd3e219c158bfd2
SHA1 b6d51e87f3dd2ce0d54be28a8e35a81c1124b181
SHA512 3b8392d6e59ee4f104fde1b1702e0b22e70369fea3207402d481c7d038f0882a1bc78fa6ab78d8b4346f36a065daa7be00b7e3fb08bf08facb9eb8f842ea2a78
SSDEEP 12288:gyoKo20Rple9pxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:gyocSApBnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1C865E01FBB6990A2E136813C89818745E773B4706B6253CB6681C33D8F77AE87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 83c1223d955ec571376da9e236d9c8ba5bc726a91b3f2b6925e708c722f02ea3
MD5 27da322b605b8c22806bb4d8151f81ab
SHA1 c55a9431e99b2517ccaccf25474920a18747450b
SHA512 d3eda4165ee2c9770b5af23df461617600b8f20b8aa7962a843433a5cf2c2e128f423d1a594b09098d70926a5c729f32331ec5b85d17d6daf408374a238cf12a
SSDEEP 49152:RWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKBQ/lFTjN4:J0zuNIQLm
TLSH
T196A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b45418791043fa157780b273256391330f816e65a31085385cf0c848316c52f5
MD5 fc0f4efb40713393f44da0b2f7c81d27
SHA1 764c28540297702ce3935bd1ec6e2a87daf90441
SHA512 fa7f2b2d6eadb0cca27a187f9c48d739b93e8de9fe405ed8332343a6f2d203453cff9c80eb8081a077953714045feee2b9a2d715d45b0c6127fcf005eb518e09
SSDEEP 24576:m1QT7EcpfxR+N5AWAz3ooiYtjMqbWnQ/tbw/2Mkjy6Fr7g0oE:rTDxR+N5YzTfjMPQ/lFTjN4
TLSH
T12355B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 7032b487c93065eb19a177e67bca5403a47ea39aa829e5cec17826dee0d98958
MD5 da489d5b1eda4321809a621f3d3690d5
SHA1 85c982141c7d269db8bec6526d9f82f5ffa8c77c
SHA512 14400a2fc572efe125820c7385701b92b1ff8ef68af7a8def0bf7494e84b7c236736ab7ba0da6bebbf310be126196e5ee23178dda1875c08f9cf757276360e03
SSDEEP 24576:03YgnJcRTk4yti+R5dBR/dnQ/tbw/2Mkjy6Fr7g0oF:0IgnaTk46pBR/dQ/lFTjN4
TLSH
T16545BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1252-218-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/1252-25-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1252-16-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/1252-17-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1676-274-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1676-328-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1676-407-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1728-243-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/1728-311-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/1928-271-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/1928-323-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/2220-184-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2220-12-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2528-320-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2528-544-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2636-293-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2636-294-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/2636-408-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2636-300-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3112-413-0x000000000D710000-0x000000000D718000-memory.dmp

Download

memory/3112-333-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/3112-329-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3112-375-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/3112-597-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3112-410-0x000000000CE00000-0x000000000CE08000-memory.dmp

Download

memory/3112-349-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/3112-412-0x000000000D710000-0x000000000D718000-memory.dmp

Download

memory/3264-278-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/3264-388-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/3316-309-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3316-307-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3660-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3660-46-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3660-234-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3660-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3660-54-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3776-31-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/3776-8-0x0000000000690000-0x00000000006F6000-memory.dmp

Download

memory/3776-1-0x0000000000690000-0x00000000006F6000-memory.dmp

Download

memory/3776-0-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/4164-267-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/4164-262-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/4164-261-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4164-319-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4276-59-0x0000000001870000-0x00000000018D0000-memory.dmp

Download

memory/4276-58-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4276-65-0x0000000001870000-0x00000000018D0000-memory.dmp

Download

memory/4276-73-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4276-70-0x0000000001870000-0x00000000018D0000-memory.dmp

Download

memory/4344-324-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4344-593-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4348-281-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4348-406-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4348-282-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4348-288-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4464-440-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-445-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-422-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-423-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-424-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-425-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-426-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-427-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-428-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-429-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-430-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-431-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-432-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-414-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-415-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-416-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-419-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-418-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-417-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-420-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-421-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-453-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-452-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-451-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-450-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-449-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-448-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-447-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-446-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-433-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-444-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-443-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-442-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-441-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-434-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-439-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-438-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-437-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-436-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4464-435-0x0000020E625B0000-0x0000020E625C0000-memory.dmp

Download

memory/4468-409-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/4468-304-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/4484-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4484-34-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4484-233-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4484-43-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4552-478-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4552-312-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4656-316-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4656-527-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4724-251-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4724-315-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4724-247-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4724-257-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4888-80-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4888-74-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4888-235-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4888-72-0x0000000140000000-0x000000014017A000-memory.dmp

Download