4c481308ada55ff0a56739e822ac50dd8c26423429944d5b5a2e0b5f82d5b604

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 05:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_0b9b58bd89ec1b6537eca0e047e1f0a3_elex_redline-stealer_rhadamanthys_stop.exe
Size 1.3MB
Sample260930-gd43ds1fre
SHA256 4c481308ada55ff0a56739e822ac50dd8c26423429944d5b5a2e0b5f82d5b604
MD5 0b9b58bd89ec1b6537eca0e047e1f0a3
SHA1 db24e14bd85a655ab57e8148fd9a2e6d29950cc7
SHA512 1428457ca47f1a3c7b87273d0782db2486021ce15a575e7a312c29114f3b3514ebb91a3b49e24abb477513b58e28d5502811324c455cd83fef8d19a6ec61dcac
SSDEEP 12288:f68GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:i8nQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1F35522647950F473D91B04B54842C6A1AB3F0C913BB5DB8BBB89173F8B383D05A6B389
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
412	alg.exe
1136	DiagnosticsHub.StandardCollector.Service.exe
776	fxssvc.exe
3672	elevation_service.exe
3056	elevation_service.exe
4256	maintenanceservice.exe
4816	OSE.EXE
1512	msdtc.exe
4444	PerceptionSimulationService.exe
1596	perfhost.exe
3372	locator.exe
3088	SensorDataService.exe
1856	snmptrap.exe
1836	spectrum.exe
3048	ssh-agent.exe
548	TieringEngineService.exe
4616	AgentService.exe
2016	vds.exe
2708	vssvc.exe
928	wbengine.exe
1520	WmiApSrv.exe
1128	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	elevation_service.exe
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-29_0b9b58bd89ec1b6537eca0e047e1f0a3_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d560ab4e9b11239b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_0b9b58bd89ec1b6537eca0e047e1f0a3_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_0b9b58bd89ec1b6537eca0e047e1f0a3_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-29_0b9b58bd89ec1b6537eca0e047e1f0a3_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_0b9b58bd89ec1b6537eca0e047e1f0a3_elex_redline-stealer_rhadamanthys_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_126703\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_0b9b58bd89ec1b6537eca0e047e1f0a3_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3936	3924	WerFault.exe	84

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_0b9b58bd89ec1b6537eca0e047e1f0a3_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000efe8f3b99e50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce61e7b79e50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae75a0b99e50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ee8acfb79e50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000493ea2b79e50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cce2c9b89e50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ccac33b89e50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d7c6abb79e50dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1136	DiagnosticsHub.StandardCollector.Service.exe
1136	DiagnosticsHub.StandardCollector.Service.exe
1136	DiagnosticsHub.StandardCollector.Service.exe
1136	DiagnosticsHub.StandardCollector.Service.exe
1136	DiagnosticsHub.StandardCollector.Service.exe
1136	DiagnosticsHub.StandardCollector.Service.exe
1136	DiagnosticsHub.StandardCollector.Service.exe
3672	elevation_service.exe
3672	elevation_service.exe
3672	elevation_service.exe
3672	elevation_service.exe
3672	elevation_service.exe
3672	elevation_service.exe
3672	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3924	2026-09-29_0b9b58bd89ec1b6537eca0e047e1f0a3_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeAuditPrivilege	776	fxssvc.exe
Token: SeDebugPrivilege	1136	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	3672	elevation_service.exe
Token: SeRestorePrivilege	548	TieringEngineService.exe
Token: SeManageVolumePrivilege	548	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4616	AgentService.exe
Token: SeBackupPrivilege	2708	vssvc.exe
Token: SeRestorePrivilege	2708	vssvc.exe
Token: SeAuditPrivilege	2708	vssvc.exe
Token: SeBackupPrivilege	928	wbengine.exe
Token: SeRestorePrivilege	928	wbengine.exe
Token: SeSecurityPrivilege	928	wbengine.exe
Token: 33	1128	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1128	SearchIndexer.exe
Token: SeDebugPrivilege	3672	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1396	1128	SearchIndexer.exe	133
PID 1128 wrote to memory of 3268	1128	SearchIndexer.exe	134

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-29_0b9b58bd89ec1b6537eca0e047e1f0a3_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_0b9b58bd89ec1b6537eca0e047e1f0a3_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 452
  2⤵
  - Program crash
  PID:3936

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3924 -ip 3924
1⤵
PID:376

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1136

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3968

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:776

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3672

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3056

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4256

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4816

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1512

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4444

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1596

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3372

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3088

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1856

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1836

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3048

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2948

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4616

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2016

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2708

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:928

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1520

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1396
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4e9a5b6d2757081907c610494896e3cf35ffe1373202063b1cf54a67a0bda5ce
MD5 3cade9c6d6935cddae003390d0ee90ee
SHA1 513f2fbfd56311acec4f3210ade8624839c83462
SHA512 5d0d015a80cdee7384afa73f39b58c8c1df619917bf6fe45fa374989d85a68ad9facf2a59416d318871f4223d2808fd5f60ba38002f05a6dea9f9607d4595604
SSDEEP 49152:+b+632BuPkFKRrdE6ohmstBhuXjfS4LWxncQ/lFTjN4:A3q6HjB4Lm
TLSH
T115D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 b06e8ee039dc7692c67cba48168809193351b30d2d5d6c567a96f01050774448
MD5 5711f948e94c8b7948b0ec56bb87738e
SHA1 425099c9bd705180a106aa9126bebedfda4051df
SHA512 22b7b92349cb09ae140b4576eda0f14ffc4aad2e2e75b28e9435ac68340db85d41a7d461906b64d68fca422eea3da203a8076c37a882d4f823a0b307e2bc7226
SSDEEP 12288:t1XLsswWkxy2lRq2czAfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:DXYfDtczA/nQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1FE65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 6f1802e0df4bf483d761e18e382f7079aa1b0b682f67924f7ac9244576c5a86c
MD5 b2b5ec8eb7d4758b01dc632ead51f666
SHA1 812237613695d87ef6d3d1f667d2f722a4bc8065
SHA512 d1ea8d225b81bff21e6d8b7e30b5f64617dfaa4dd155873fe4440e74c6e8abf43c95a7d7b267f96230a89407b170f515c336c86b16be6ce623a87248cbe6affc
SSDEEP 24576:Y0Le5ji0hmxLrMknQ/tbw/2Mkjy6Fr7g0oL:YPji0AlVQ/lFTjN4
TLSH
T198859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3998900e35386f5abc9277ce5f82a6b2864570a3760e7973afd6b45dd3f21d2c
MD5 7fef1873baae01090e3bace6aa7473c7
SHA1 b302a49f4f7c961a41aa2e3b6f6f20e30f8ce00e
SHA512 335dd81b82304941f2de80029432422065b0ae9100703f3ca74f4b43610578dc66630a30d5e3ac25ad9d0e5f2a72b78cad6c308c66be01476ef975dbdffd1085
SSDEEP 24576:Va7/ezSC6vUyD/aqgrvWE6q8wyuGnQ/tbw/2Mkjy6Fr7g0oV:c/ezSC6vUzPvxHjyBQ/lFTjN4
TLSH
T1F4755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5e2e410dc4f0dfaca55ff0e6f574ed31fbfdcdd690828d0d6189ac1ddafb8e61
MD5 3d5cbc5acaccb735c666734b702acc06
SHA1 02e6c9c42c4116bb5d776d9b074ca26526eebb77
SHA512 d1d862b25922c2d72d8d131b347ce03252efafb7a4f5418c0f53e1a270778fe17def35d984e30358967f26be0fb41495a5d7be311c166819f55386bd12a7dfbb
SSDEEP 24576:uVbqPb88hv/l+6jnQ/tbw/2Mkjy6Fr7g0oe:uVO88hXl+wQ/lFTjN4
TLSH
T106559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ede632039b5bc2c567e9dd648ad1a45e65f193821d5b39e149a5618328b4a0d2
MD5 38873d2207d15765b42aa3364a368913
SHA1 6db361d2c9882ae06c5635e7b3b9a69925525840
SHA512 6a3cc36535e5d4e0430e9a5ae692f6336cb5c95575f7bc179de366c395a07c2a3a843f5daeea70039b4d9df24b8d9e2ce6294bc5f3222944e306501b2d6f67d4
SSDEEP 12288:/zoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:/zonQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1DA5523696A14F897FF2B06B55CC284826B7B0EC1BFD4AB4E7B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 6f515fc440fb0da7d6be0b94bf4ec76e383ef1295573fb106a3b80b22ae3f3f7
MD5 f62821544505dabfc711230559a979b9
SHA1 af1738395e9878bb3cd1a569742516b8d71e3fae
SHA512 39af38463c9b13ccbae9e2ad3cc0bab06f451a3d3924a2f452c8fa89791cbc06aa490cb660c965cf073b7bcb9dd5ec6803c458feca6e125735bfe47cd76342a5
SSDEEP 12288:feBNUbTVO86U7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:fJIUrnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1DC75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7216f4a23ea23906424d4394470228f6ee0c82726ed589672a80846da961c7c2
MD5 ba63a25e71d5e4f5221d0ce0625d5c71
SHA1 d8ae49023f2e1441d817ba73eab733cb440067c2
SHA512 7f3a16b51c07dcf474855c52fe8c760ff2069096a538fe46c3636c265e088c5cacaafbdf4e4c18f6efdf6bbbb54640c235b54b7c9eebc33c84b4833d6e4e3a5b
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH7:BQvGAdlCEL8c/yRNw5ChLm
TLSH
T19F267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 319ede8dd1ba3afaafe4500d3093ddb3a0ae4aa5522952d50b4ff4badeb7e58b
MD5 6185c22bf5eb47da4539d698b5ef9cc7
SHA1 c9839d0b50d26d8772f38c1b900f469be1d6d225
SHA512 d26b88735e99e2e2ed1a4f1ba0a8d7a06599380c0a0fe5e88c6ee9ebcdf30c03750075413939ce5eb8e5cd33953eec178a3c301126f7d58a155ccedcf0974b9d
SSDEEP 12288:KAwSfxL/2Dc39DLLmt0LDQewsAjFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg3:fQewsAjlnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T13775E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a8bc3152f6521d7e8835e529460380eecef0b8c36023ff8244535640feee4c34
MD5 858e1946160d6a9bf54f1d68c3529537
SHA1 10a6a2eb7977e31cbe534d2eb0c3eef33d311dd4
SHA512 d34349722c2a8e7dacdd579cd02b941913a896bf2bdb0296da2f2cc0f354d0ec10e52df206361eb605a3aeb5bc9327aca5758064c63fef4c1fa1a708f0da96ec
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHyL:CUEtQevvqc2W1cpV2EI32
TLSH
T1A5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 80a7f47fd13d1eee7b403535d21e2025fe36a1094049a01672dd05b9c749edd1
MD5 eb30c0d525eac62124d7eaf3390ea955
SHA1 b51d596228e3cfee225441cddc77dd12981dab59
SHA512 52da7651c0fb0910d52980ffe393cc44bab3ca7153d1d6057ed2a84bcb9ea3c8a74a859478b32bc716195f8a828ac3c4279cce52466825c44db033e7f8788697
SSDEEP 49152:oCbRquA/m2yL5zQfFiV+XenmE3/zFQ/lFTjN4:BoqtVjnmdLm
TLSH
T151D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 deb56ba57e60f5188dfb52195879ff1acb7a0f09287006e5e6f698ee5fc2c407
MD5 e9a6d7d3533ae34f3067f93cc231e55f
SHA1 e2651f72b7f9bd56de650504804db791af838e1c
SHA512 5979b29031a33662b50c732153758b299661d4703a9a90f33130dab7a084371ff2099ca77aa5d3c76914f9f2a5b3a1039f30c5f2309e784ee89eec6e86e38f58
SSDEEP 24576:yAhGLJIFoiwtA5l7S53ynQ/tbw/2Mkjy6Fr7g0oJ:yAMyFoiq5iQ/lFTjN4
TLSH
T19135AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 0eed2c96300506085e443ba7625a0c3a2c6247b581f7d230d221f3271eac0684
MD5 c71f817a64d5c2c577e6501726315adb
SHA1 c9a9b55b738caa019a8f3c66e2f2497b8f3e016d
SHA512 add39259e751b2f3c7b80b6a7f46b7025ba0c54450b4d77e1d4de31847e361e7e21b230755a57940f4d3534df7023da8afc5ea55c3e2a07a2cea5decb95c39bd
SSDEEP 12288:0mw5HEjsChN2BFgl0WDm+CGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMJ:xwuHOWhnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T17665F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f547ca090c0137d9daef583fc0114b3c2d86307898f3e4dde1fc91277afdf22c
MD5 53c2afb967bf9fd1ec44d83efd7a6421
SHA1 bcca49eace09aeb7cd4c7df07148fab42a833309
SHA512 ebf9843db244b9a0596f00d56368046cf817b428f0fba381b5438d304d947cbe2f5baf743a9ba447c839d09c3f2c45f417f1a9631a72aaf1bdd03a6a6e93c60f
SSDEEP 12288:fXZ1IyVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:PZusnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T19655126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8e623820f4757fd0c04886d2daed98179dfc6480daf4fa86be721d91ceabd24f
MD5 b54f6fb6db1ca7427351380739c74732
SHA1 ed7c3d465aadfa500e01823b58e136e5ad40cab6
SHA512 4e76f1f73f1fa66b2d4c6e4f5a15d73fe4bf8a1646b9efa6ce1a63c62ee06efbccccc25c9df95806a0fb6ab38d609a008221e958cae61b09e3e863a56c40ad19
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UH:+QRQyi36YOcPQLvw2gAf+PN3sLm
TLSH
T1D0667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 36366ed3bd0dd680d0b235f6bd65c15b4c36c4ae2336b7fe15871b03dcff904d
MD5 6669bb4229444abc124ed3bb620274f1
SHA1 eeec2e3f6296dbe0b548bc04f65ac7d1bd7f61bf
SHA512 473d5c4b04c5f9d63837b9da44b981cc199c2f1892a919a65773833955f9db13a2407bcec20d40512c1a9ba0f20d46419c9d3cf3470b134ae12cc57484d555b7
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UH:wQRQyi36YOcPQLvw2gAf+PN3sLm
TLSH
T1FE667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e5af7c5df09d522e79f4a02c5efe2ec0c68c9c9a379db2cc79955ad1a723602d
MD5 315bb4067607809ff690ff3a3abe84c3
SHA1 fc888908b4d4287fac610bb37c47b64155508570
SHA512 77fee87c3f194f708a2adb240a5e90a88eae9cba49f95207819e08deb031a91ca62566c55f5e17d30f06d02095550800d3768709810bb7633647f229dc93105b
SSDEEP 24576:JwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0cnQ/tbw/2Mkjy6Q:V68Qg55nhheWu7PNU3/VQ/lFTjN4
TLSH
T1ECB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 099c38f88b4dfb1471f1b1a5f95b1f68bddf805129684782c46cc2597e8edbbb
MD5 4bfd1856b00b54206084d9b0f41dc34d
SHA1 31d3237591f6d031ab22875fefb060ffafd36ea6
SHA512 72dace5c93fb66f424b7b4bdbd1ee8a8a85e262c009cac424495b3eedbfb8f0a71f1a6ffb15ec35fcd6b0044e598fdb3acdcaf702421e55cf259ec209bbdd930
SSDEEP 49152:53aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99V:oy5112gYy5azzVvL69nLKnhZLLm
TLSH
T13F167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4bf87e112d625509265dbd86a8d6f53e58e00a54340c09154d9a9395c59cc942
MD5 7874032ffe7c9d785fdcda901db77173
SHA1 e12ab9cb9c52d11f70becac8f3d73969bd54ea1f
SHA512 ffa4a84d872bdf002df25a1040569f48e0da94f37e0305e3da9267fc8eea4603a6f6d68a679ef83129d5ee9b391dff1eb36a46219937e0a339acc83861b1d9de
SSDEEP 49152:qB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glRQ/lFTjN4:4u6JmVxd2d2Lm
TLSH
T16BD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d36fe40a2f518d569c9a82bf8ee83cc09ad9fdd659a4775c4a3d07b3491fbb12
MD5 ec07ccb3d1d61752334d9a88bbcf9d0d
SHA1 7f16b34145521f8af1d3ed9d409aaa7913716b67
SHA512 e4eede5696d359a8ed15afa4cac2ce98b0c7370e6d99aa5a80b810c2d17fc6d127ab888f042436c7fca9655e967f9a8703481f3e08518ece7b0f101dd07ee177
SSDEEP 49152:31hpsNoJpF1A6UU44CwH7R4xLQ/lFTjN4:3mifPbRdLm
TLSH
T12DB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8687b19bc596cd0c583b7c63fa849f9ecadd88a5a7eeac1f3007da843e90c834
MD5 d0c74496bbf31691f4d0acdfffbc7613
SHA1 54d0fbc7451c7190c79b65e7d456d996e928dd09
SHA512 094089b4d761a9cab84702c3bfcbd89aa4b9ff516870c34aa95ade8f40d49a58dd25d0489de349df59caa5aeb9e280ba875b720bb8fb2f7f1af2a4b019db31c9
SSDEEP 49152:BSuZQIY0Be2KRRVtOnks6NMHqsQ/lFTjN4:P5dKTi61PLm
TLSH
T175C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 bb31420894ed327f42f7f59765e4ef5866d68a2b5d499a065ef9b113f190f652
MD5 52cebb1396ac42748485797c0f2a5a02
SHA1 03737ba9019863c7665c0ff2faffe5a386a5e3d4
SHA512 3fac6a6fe83cfdce03c74e74cd5903b8559e232c79cec70c29d92c37e33453fc803b51c88b2cee6e6c5b91a3241313087fd42a7d199cbbc5b7ede415cf494f11
SSDEEP 49152:ShtSn8EApI0figngiDn0AP5w/Q/lFTjN4:TX2iyphJLm
TLSH
T13B95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c414161ead50617f995eef62694fefbaaa56c28ae0a39ff29119aa2150c6b5b8
MD5 373ca19a01b7ecc69c42f37050b76570
SHA1 8f0829c0124bd2655137b4d2b3bdac37079eb31e
SHA512 c0ddcf62b2fb28810897324a8c1079dd6dbd59d4b0550d0442248f2db30ad0b5ba69ac528ee40e373f07765c4f3cdd6c6b61cdb067eb55fb4001fa95525c3d12
SSDEEP 12288:SQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:SwnQ/tbw/2Mkjy6Fr7g0og
TLSH
T1BF5523697965F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 9241d12422554781bb3f6cb7eb5d5e4aced5b1770f9dd2ef309fb8e06160261a
MD5 4782b43f5ce9457f062503a6597294bd
SHA1 7abed61937a1c290d27850f875e702d797928bfb
SHA512 8b39e86b653741cb3e87f7d00a0fa0aaa01a251903b4d9743d999780cdc299683a9089a617c41a7d49476c0fdc1b6fae60cf1d2bf0762714bcd6480b39a73f4f
SSDEEP 12288:NpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:N5nQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1B15523697964F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 79c65f66ed6068023627e3c30e1a0b88c5de3977fe0cab0a5a2e145ca7993e6b
MD5 86c79916f3f1ba7134ac3f18f97d7642
SHA1 1399c556feeb5411c1688db4fb81d04c69bb5a5b
SHA512 c78f44210e5d017d47ae6f7c0d61498f049f41e320eb508d5a4d2a4e7352e88394232e14e21f52ee8e0254f3cd9b927be8a4922268595f92e68922a11ddeaac5
SSDEEP 12288:rjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:rTnQ/tbw/2Mkjy6Fr7g0og
TLSH
T11A5523697965F98BFB1706F54C8381829B3B0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 0f7c22e5d6de77d815b240b48735462bb746b716bee41d2053aae00340a5cd3f
MD5 31a18aff3bbd614af8269e004287b5f6
SHA1 557fb97ecbeed1eb62344c360f4da2ba0cb21cdb
SHA512 debd18660a9d91a09f9d6e93983a4a9b67786a6edfa8cad18965ac192ecdd569d911390bd571845f157f247e8be8784050ae5cbac5dac96b89ca42a8dbb34ccf
SSDEEP 12288:6VSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:5nQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1CB5523693A69E4C7FD2742B4CC938142E77B3DC5BBA1A3CF6B04111D4E793D41AA5B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9e6ad88d7b7a4036cca9397494361c1d5bb73054cfecf1fdcb08b92e3bce22f0
MD5 2304801d07c6147dd6aadf401c43b76b
SHA1 2f781ba005808fdd57575cd6351a4c5a6217cf4a
SHA512 0ff062bd5171b41cce89649e6a97dc9d3d12a6045cff8c4125d1c6e28195a56b3523df1983955caea98e4aec3279188c32a58f66c131e918cdd1e8d1b77d1f87
SSDEEP 12288:vqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:vqnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1935523697965F98BFA1706F14C8381829B7B0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d9c921f715894e05991eec6b9b17a79e36c81e0755aedd0ee4fa00c091d40063
MD5 f50430b614baca75d55634565086a59d
SHA1 a721b4f1415d7f55bbdc6961d402a551de48a2c6
SHA512 85b2fe8016ee1e37435e933eb97d66796dd6976d627621506adda101f6955ca082b65d2cfe328f0bd88308ef64635c786d506acfa03c208fd387812df0564969
SSDEEP 12288:atGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:aNnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1AC5523697964F98BFB2706F14C828182973F0EC6BFD1A38F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 09092ce0d5690dfb7e2d97f62279dfbf03d1f7b8d765be30502ba4b8c1cc42a1
MD5 e58615147a8e94aa4738ef6628179630
SHA1 db96db969c41654a6349c1a9503a32c4e2c33a81
SHA512 f016beb970e49ddc2a45615d0cbf0fbf1135ee5aa1d02a977a99fd06ba48403a0fefb03e97694d48709d1cf8d4b00a9fad765a9a359ad81828beb47b00ca7fc7
SSDEEP 12288:xBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:xRnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1635523697924F98BFB2706F14C828182973F0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 2afc228de6a8d247bca9377189161d65401b44d656833075ab47c4ad2dde18c1
MD5 94a9304bddbbe766605c38facc6fe194
SHA1 c874d42aaef3bc6a06ed87aa227e66efe28a19e1
SHA512 76da4e3cd847af708945438359154f515135e2b0482f0c8039dd23c2f0ad77739781f6bbccac09f365244f280eacd4ab95b44db3eb593bbbeadf8235fd421b5f
SSDEEP 12288:UiZwbDzzFEoS2cPvyJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:3ZM3zFVSOZnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1A87501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 740b6bdf2f9e2ca77b5054bd5b42eec0f0587115490815816a4feccc50184a72
MD5 fc48963c9a186172598a90af93e85377
SHA1 c6c46fca8a0ea0ff9cada88e6b356e0338a4eca7
SHA512 96863a39c4bfc12d007d80b6b30bafde9c284cffe0f57d45bc16380db37211cc14395e7df522a6cee3b428cfdb49618e4ec3516be11830bd546e9962d45f49b7
SSDEEP 12288:A8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:A8nQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1475523697965F98BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 fece1c6143a6b43675d563cfb7f9eae099c54cfa1e0366f93aa33959c1cfc4fe
MD5 d0ef2660a3a9b57a136b6a1c6693e462
SHA1 3ae85c89347dd7a38937e9d65bff81e7756a07d1
SHA512 c7cfd788f60b852cdeffbc3011b85cd999cafe4a9fb15f5d1526244fd9a3c3eb5fa17c43b17bef354b3a3513d130a4d43eee804febde1aee25759e5a2d2dff8c
SSDEEP 12288:54GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:54nQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1A55523697964F98BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 61fc5623bd8b830d23680aa28e3f8eab23799054310fdf47bab313bfd91ae6b3
MD5 b85f7cdfe733cfb5c4ba5af3ec9d5974
SHA1 b13cfb7076caa4cf2e12e7419f0e48db5762494e
SHA512 9f23afee7d2240e325dd4de341aee5743edd9f5a27f129b01e821b656799e9f0d013c873cde4c5271ebaf533ba15eb45316d443a7f38b7c323bceb8d540843a9
SSDEEP 12288:fyPz5L8VGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:Szy1nQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1A965021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 7511f3828b05cbe2fc6ac034fb750947de3f283775afce33c7a81e3e0ac303de
MD5 26869e2c0e883b41b1a9b6da4d28996a
SHA1 060e91b3522c5d0219e75f196aa0e803bef3daee
SHA512 de461f2c732bd5ffd47710b54f729940e3c8a369e57abb380ef8526fee13b167ea91e2392bfa2c9839d59a0b4af260ff2a7bff54a4edd5afd0e5620a07d62a3e
SSDEEP 12288:J8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:J8nQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1B85523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 66893a295fc953280747ba1ca7fdcda0ff2df96920b9a40c0eef21617b6d6273
MD5 55e5fd9e366f04c6cd0d7f08920520e9
SHA1 b7f50fa46dbabdc019cbe96b9c26610b5dac5310
SHA512 5a5c986f36ee8100a691c4277c6b7f750cec7ccf85561a4b2d191d1f1c951bbffae55d9d80a4d5ff538fc4b0cddad0d3e4f65c12016e8e85fa24e5f494125b09
SSDEEP 12288:l8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:l8nQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1E85523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 70be92140251fd65eedfab4dbf6b197985decc8262e14ff3dd1a9c46e8ad44b0
MD5 fc1711a6b9c1bd7563bc43579bdd9886
SHA1 ebb0a3d1511e041920cadc1f62b5cbe64e225605
SHA512 33bfbb843799d0b9df589a6a14f212edb69449da69a726966b620533236f15b03de1dabdf4d91733e268589c920621d1595d91357e51ece38cf848ac7dfd46e8
SSDEEP 12288:8yPz5L8VGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:lzy1nQ/tbw/2Mkjy6Fr7g0on
TLSH
T17265021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 7f4c7b7918c24164b3cbfccbd036e5d9c389c7171daafde4fa6bf6d4fe10e5b3
MD5 c09dbc43d4ea34ee8de69a2c8bdc3585
SHA1 5f249b6cbb2aaca683cce7789aba27f735565cd1
SHA512 fc27db0c62edb4853ca0dd947fc2d45f903d0d657e9036afeb515abc03972a08c80db4942ebe90aa197782ec55805605fa66251b11ea4f4f1ba03fa76e0e83d0
SSDEEP 24576:3T0aLl3z0zDDnQ/tbw/2Mkjy6Fr7g0o3:3TDLljGQ/lFTjN4
TLSH
T1917501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 f9ca01ba2ffb0b55fb175e345176c3ba4962d28800abbb4610c85cf8e45e5bf3
MD5 a602695ae404fa140433e9d9ae42c649
SHA1 4b587b52e52133c966b7ec719d71346d0c8367a7
SHA512 796ecfecccb62484d9b3555c0d28b91d1c0c577319f723622ef7605fdbd3ce1db6912e99f3b4a2e8fe53b9d5ad4356a2051c074dadf50dd5eebb2edbdcc60cf0
SSDEEP 24576:l31d9CHKy7GZnnQ/tbw/2Mkjy6Fr7g0oA:F1d9CHKyadQ/lFTjN4
TLSH
T19585CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 4a72a87889fbfb708cf6f58f4b3647948eb28f554992ce0c19eba819d521ae8e
MD5 6882aef79d731098adc3d9534f1be25b
SHA1 3f10d7dcf1831ca30c45c80d1b1466b6760cbe0e
SHA512 0ec2632dce25edb704280f75e392e064433e95d1cd9a7f467e726c34aa7423d49786765195bd6fc342ae9cbc593aa9f32fbdff641d323932cdc54821690e770d
SSDEEP 12288:rDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:rznQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1B05523697965F98BFA1706F14C8381829B3B0EC6BFD1A38F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 5c5842f7b87ff889cb56c7e408f4a8df89fca7a3740b7258b1bdf9f232a01333
MD5 ad0912e8e2ed4769ba4b9e7deee5bdb1
SHA1 50eee438cfdac3c8daf817b2dc30eba1e916a651
SHA512 413b0fbebd8ace7f33eb5197bd161aa322d3857b9b13ccc78e0ac6ec7c8d44f7ffa9971526e2234656f5977e448addaf2344401c0a4cae556f4466e0d22c40e3
SSDEEP 12288:l1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:lVnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1B15523797964F89BFA2B02F14C8381429B3B0EC6BFD1938F7B481129967D39406CA3C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 e533a04409b2657a06014e088497c1995b288361dec93d0a311f551c016d618e
MD5 5f5de76cb42777c83c7dd428f7705636
SHA1 87fc8c6c6b04cd62713730750cb57d94b5642ff6
SHA512 a928a382404dd1fd07231f9d8806ebcae3396a56a5dc92456acc5945f7b82df57331889467acf4af009c8a9343f0c2eba7474727c7dcf9b133701dc004eb6c47
SSDEEP 12288:j+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:j+nQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1A35523697965F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 e329867f34955ea3d4cc7fce3d386e1dd3eb02a17e12f5bca49fb3ad30541b21
MD5 990fdd26e90d11004522482faee0c9cc
SHA1 fa9de975e9c6bcea7df5933aac63fad26fccf9a0
SHA512 4d598da9ecd2484e407537fab1398b1fd1aeca5bf5c91409989d81acb107d4cbc50bae041203947a4ae7139e5998772a27970fb87d6cc46bcb0c75bd8227c440
SSDEEP 12288:1ssfsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:VsnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T10F65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f987fef42916502474dd486de230effb7326cc6f28e554a1e5e43170cb5c4959
MD5 8e380f2984f8bad08035d68855986b46
SHA1 74167628b98863720063db8806e8b9a1f2e4593a
SHA512 d99785e5ebcad9b86a71bad5b46026d438cfe9f3de5cc23207e4ceb21ea8ee4b878f3e3c552960caef57996ca21cb4ef21b4f24133dff9a8e5b2aad662dd71d4
SSDEEP 12288:UtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:UNnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1815523696768F94BFA3B16B05882C151673F0EC5BF90D38FBB08222C967C3D41EA6745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 9e6795db2ed9830fd7a17bf635e998da40401b364b42220dac58b7dc24fa383f
MD5 7ddbe8b274f376e39e0d3b10f453f800
SHA1 9bbea6d03c018c1ec2d5bd1c827615757dbfd111
SHA512 687b570856e616907108524df944d3650cb65520dd937d4932c07ad1c69e7b25043280e5509b4f5e8ea1c2c2bcca18b9d3545382cbee9e1831b25d992c7cc227
SSDEEP 49152:Ja0h2GEkuAe73q3pp46zwwQTQ/lFTjN41:Ja0hNYG4JwnLm1
TLSH
T1F6859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 1b7ab0174a47c2397375226cd1db484eb61daca694bffed69b1a89e39c677e67
MD5 3017e0055c127aef6298ab0e8c996394
SHA1 3497a7934b3abd9dcd8b9435b262465636dee265
SHA512 5aa780a2c824dd949cfb8fd48925df3a027f3c0346ed740d5fa70cc5b77e0f2b6e4a6f7ee24b2da424a2ea56f066bcfdaf046598bbb800bfef1215103457f71a
SSDEEP 12288:ohbHjfX3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:ohbHjPXnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1C155027D26AC20DAF63692BD88928546D7327C552B11A3DF2381827D4F3BBE40D79F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 4b8ac59d523f1322b6599d07094ef0b55b54ad4c473000f53297a435e067d16b
MD5 7f4287fa3751a695710b85564a3932de
SHA1 e8d90b3b65bd4febeb067adda4720bbd6a9accc7
SHA512 02412d9fcd22ee93db6ea9600641ec45a796c4701ce2e061b771e932a685ae8f8b2a37a641f562a22d98f7d4a7be51a864e7e71706936fcf9884ee08819e3daf
SSDEEP 24576:Q3YgnJcRTk4yti+R5dBR/vnQ/tbw/2Mkjy6Fr7g0oz:QIgnaTk46pBR/vQ/lFTjN4
TLSH
T11445BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 1f91489bb8dd644e04a308ca1cd2d3cd1524e4352d5cc0acc80b6a08ba43bae0
MD5 7909249cf5a8607a601dbaa7b78e3b58
SHA1 ef0e64dabfc9dcc700a43edbbc4cdc7312f70494
SHA512 d0bca409388b884b89e854b13f78b0b7da15405808e79e7b52cca155a635e8eff0ec7d95e4e0d2ce62289dfa14a2f836616b8d73ad282cbe801971d8ad0c8bda
SSDEEP 12288:0BGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:0RnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1945523687618F98BFA2B06F54C838546673B0EC17F9193CF7B482229967D3D41AF6780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 3be0743126dbeff02d486ad75fd23c5f0e3d7e23f6e3cd0720f808253682c077
MD5 9b9175ba32d6a2775af946df01226ffd
SHA1 e9244b125f6be3d8a0d5e3315d2249d152a8c570
SHA512 039906e486623ed3c64fd9042c74d517008c841eec1401b4e40a21beba526a1ff61e15e771f4c8ee567d5f366b53ff6abc00873eb7396d43132c7dbafb5083f0
SSDEEP 12288:BOb4A4LWOsvAYFTeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:2wL3UTenQ/tbw/2Mkjy6Fr7g0ok
TLSH
T13D75F155F7A450F9E92B817CC8A28A16E372789D1764E7DF03A84A691F333E14E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 192e5d9356bedd4e4c3d112ecc716922bda52d2cfc642841197c6bf2f0ada59e
MD5 94e71b8fd1d883a232d5ff8ac9f99126
SHA1 a9b1ca871e8520b85e0c05df2d18d5f74f217513
SHA512 7af4e0fe9c033a0e6256476afc3549d5ef4ff04a7c1fe4fb8943b790c7069efda80c44a29e5dd070626c69d11dcd5d02a2674ebd2428271dde4e4bf70514e4ac
SSDEEP 12288:epFtCOSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:LOSnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T11055022D36EC60E6E536527D89838209D37278921B6253DF0780817E5F7BBF85C7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6be8570eb8aa009e2920c674500d1bfee418985358817004a69d58147a1814c2
MD5 da6abb01b65e11f6dce0ea3761a6f1b6
SHA1 9b2a131f6dad19f223ec2e7fca3794db5e0201de
SHA512 c566e1df66629470a6160a434f82a5ea2d22566dd1d95e545196bf9532da9cacb488b8696de7066f353f7d1019d01268a339a72fba79885c6f2aa9e76c6aaa68
SSDEEP 24576:L7NM9YqZqmWMUkPjZM48Mv6bEhs9nQ/tbw/2Mkjy6Fr7g0oP:L7cBWMpPjN8DbEhoQ/lFTjN4
TLSH
T16E659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 06a4b4b23382bd7eaa3d10b8547dbd3aa3b94d854816bc2a9635814cc2203db7
MD5 e894061a681276af7374c608035031f4
SHA1 9ecf9c04463cac29756ded6abb1a6e56b3594237
SHA512 c77a06dd62dae33a283f76fdf93959354b1faee38c9ff992aee60ea1d433380a11b1c8a8ff75151bb37221ec4bf22bb4e24c732481a1c9df04c060b9a4239802
SSDEEP 24576:nW6BApg2YuyuNDYTabvcdvNYf8km1vnQ/tbw/2Mkjy6Fr7g0oI:nF2YuHNETovAvNYf8kmdQ/lFTjN4
TLSH
T15B857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 0e66839a8bbb234d0c41d5b0fd997d9d14708f7466ba3ba9439b332289671a00
MD5 9e14ea270d325562ad217ee4ec119ed0
SHA1 889ca25ce24a2451db4b47eb86c179b148e24d80
SHA512 af138ce38840f11d2b81e8a901c967883f7cdea593fd06ca7e2ac9a7afaf1e625e249d3d947ec4b47b1c568282292cd55e313566e2d0a2f11ff065bc8fc00fdb
SSDEEP 24576:XAFs06+Omlf3NXEbTo2nQ/tbw/2Mkjy6Fr7g0o4:wFs060lVXuzQ/lFTjN4
TLSH
T13865AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 7bae95b79391459312eaa3135dda19b8335b4e0a50838d078c6532a6a7227b31
MD5 e97a16b3871e4001a8751ce486c75473
SHA1 c9a9d7e652bb5044ea80261d348a905414249178
SHA512 e039f006ad0ec8aec5cdcc7edd5eeb004f4694815c4a22517c1817aa8510599d529a0e879edef49730fab2cc1a7b31ac7f269ea3ac13e945085c91e2e644ead5
SSDEEP 12288:rCJnJ5D3Vkrqzx9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:mJnJ5D3WaznQ/tbw/2Mkjy6Fr7g0o/
TLSH
T11775D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 02a86a2312273ace326db1776b6ad47cca03ed6d869ea3230574fb4741a92f67
MD5 a48296069fd8b44d719cd75428b2709d
SHA1 e8736322b95b404113100747eaf27af56502b13f
SHA512 101096067bc255c88fb3b8f081b769b100d3f0c5a4aadcabba5e80afc97f5b48d51ecaf213757b515822b4ace7e790d0b12fab01f3167e2d7739a61036c21b2d
SSDEEP 24576:fEPghm6/7IIXdwcXrif7qQncjlP65i3VuQnQ/tbw/2Mkjy6Fr7g0or:Yg06DIKdwc+eQnSt65aVpQ/lFTjN4
TLSH
T1A6955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 768cd260a995213cdcb966bbf61b527403c75363d4cfa04aa45604f523cdd9ff
MD5 53f5708cc1bc52a72759b275d00f27b8
SHA1 fdd741dfa7b7284ccfa769d5350cf6bb9068aceb
SHA512 e22e81be1c4180d0dbd3ae4d2a9c5338840eaeef6ebecaba4e4eada15d5e1a3725a056f0ecf8fd94f38ad6cd54eba62129541ed0b2bb712d705d6ddec3976fe5
SSDEEP 12288:fEP3RS0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:kSUnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T15E55126D37ACB0DAE52A517D88918145D373F4A16B5267EF2680823D8F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 a1fe5baa5f9425313fd1403a7d74addbfb89740ab4e28aee038197f99584f70b
MD5 a2b01bb0010bbe16eddab5a258576db5
SHA1 8f3a6e09f645aba6a9239d256a43ee2436452545
SHA512 22896bb8bf21226b405f420b1afe1f8715db295ad3d4629f3564a58d772ee9031cf56bfabdd585426c4a320fa53b9e97996400e3208904c33211a68aa499faab
SSDEEP 12288:djkyYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:dIyYnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1B46512186398F4C6FA7A06788DA381919B367C506F2193DF6280F23E9F3A3D46D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 0b568ea53f2e667857e01ef6185daed042c8c666346c97f29c9aa0efac2b8ace
MD5 80e6e8665b935df42f47804a1ff507e1
SHA1 f3ca94841cd8b9efe9176f3301f8953eaf4438b0
SHA512 2794ed9a0157b4e8da7a5a48e466e5929270e1b15fd74411ea8736cd441a9a4fece34621c86fc5d29e1bb6271e7ea2b3e67ed501aa696da5431d4ebb96398138
SSDEEP 12288:p0iGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:GinQ/tbw/2Mkjy6Fr7g0oo
TLSH
T15A55236C3625F89BFE2706F448928542973B09D17F9163EF3684A239CB7D3D416B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 a150790670395c62ef5342a1dfe60f211b8a86f95c5a9a60e42170da8f63dfff
MD5 50bbd223dbf19831bda9eb0926f9449f
SHA1 b0a660f1d05d98688743921dd32fee4b22510b38
SHA512 30444b0a6ebf8f8e619edb0688867e7c4869e7a47518890f142eb30d86a5f3512d9cbeeb9bb8ffdd0214a91d86f66b5885946960c6f68ea0ba4b255845a1fafe
SSDEEP 24576:xQ9MxZKdcz9dw31nQ/tbw/2Mkjy6Fr7g0oY:xVKZ1Q/lFTjN4
TLSH
T1A2558C2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 59c3fafaab34d49f9887df24ab5b0bcedf8ce96cecddbde18b16110c4d12412d
MD5 62a0ca4dcd2e3ae174a91e974b415692
SHA1 823690d603061e26814f798574dec88685ce6b2d
SHA512 64df2eaf34c28d13798b2c5f1f16a572dbe123348784ee6fcf635de01c199c87d66e1a5284b605a12ceb49347576b23b5159828c6a47f7d4a95370016f421977
SSDEEP 12288:8yoKo20Rple9psGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:8yocSApsnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T19965E01FBB6990A2E136813C89818745E773B4706B6263CB6681C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 e7e17bfde1b6dbae7b2d6f01f33eee322e22c1a73dd44d73fa8684ef21ef2573
MD5 c31c55f855afbcebcce6e9f3da15d612
SHA1 5528d3b45698e07dff061bfbf8ed9ca9bd2db3bd
SHA512 841aa11889f21c69ddf481c216d5f7860c1a8336af56be34a0d27ebea365cfaf30842a12d2d1f3ff659ef76a6a2c73d0d60094ff631bbeb6df84f74aae5e645a
SSDEEP 49152:HWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKsQ/lFTjN4:/0zuNI5Lm
TLSH
T13DA57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 19fcd24589ec466e4722c4f06f74f7a69e87faf4ed142d5acd61088edcad6612
MD5 10289da1664f670858efbb1a0713a00e
SHA1 fe0f564c371b3b39e3014f5f1cb161e2fd0306a3
SHA512 adaed609b75fc3551a665f8580d9917b9c510e0174f8f7f9cf299741d9bbaf329070fa42e491186bc438653173dd93fe22651b2b0c18d20164167886a8ea677f
SSDEEP 24576:/1QT7EcpfxR+N5AWAz3ooiYtjMqbUnQ/tbw/2Mkjy6Fr7g0oE:CTDxR+N5YzTfjMFQ/lFTjN4
TLSH
T15655B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/412-12-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/412-216-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/548-305-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/548-411-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/776-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/776-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/928-322-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/928-478-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1128-560-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1128-401-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1128-330-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1128-347-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1128-363-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1128-408-0x000000000BA30000-0x000000000BA38000-memory.dmp

Download

memory/1136-24-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/1136-16-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/1136-25-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/1512-312-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/1512-244-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/1520-325-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/1520-559-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/1596-262-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1596-268-0x0000000000870000-0x00000000008D6000-memory.dmp

Download

memory/1596-320-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1596-263-0x0000000000870000-0x00000000008D6000-memory.dmp

Download

memory/1836-288-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1836-290-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1836-282-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1836-407-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1856-403-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/1856-279-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2016-444-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2016-313-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2708-461-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2708-317-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3048-410-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3048-300-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3048-302-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3048-294-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3056-234-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3056-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3056-65-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3056-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3088-275-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3088-404-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3088-329-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3268-431-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-420-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-451-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-452-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-453-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-449-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-450-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-448-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-447-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-446-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-445-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-418-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-419-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-421-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-422-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-423-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-428-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-429-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-430-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-432-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-412-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-413-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-414-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-417-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-416-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-415-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-425-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-427-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-426-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-424-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-433-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-439-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-443-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-442-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-441-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-440-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-438-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-437-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-436-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-435-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3268-434-0x0000014E5DB30000-0x0000014E5DB40000-memory.dmp

Download

memory/3372-324-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/3372-272-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/3672-43-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3672-41-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3672-35-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3672-235-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3924-1-0x0000000000550000-0x00000000005B6000-memory.dmp

Download

memory/3924-0-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/3924-8-0x0000000000550000-0x00000000005B6000-memory.dmp

Download

memory/3924-46-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/4256-66-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/4256-59-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/4256-71-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/4256-68-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4256-73-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4444-254-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4444-316-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4444-255-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4444-248-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4616-310-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4616-308-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4816-75-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4816-83-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4816-81-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4816-236-0x0000000140000000-0x000000014017A000-memory.dmp

Download