81f2d3531e81442ffa5ea7f082e46df76c165305ef3fbb877091ea1c25be617f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/10/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_b7a667400bba0c8eee0e2e26ccdefd82_elex_redline-stealer_rhadamanthys_stop.exe
Size 2.3MB
Sample261011-e4bgnaxz7m
SHA256 81f2d3531e81442ffa5ea7f082e46df76c165305ef3fbb877091ea1c25be617f
MD5 b7a667400bba0c8eee0e2e26ccdefd82
SHA1 25056579bb1772c0f8e93060f1c632392c8a9af6
SHA512 e1312d2065c7d57957c4a0249714d547a3834333db3f8ceb0c7666819c12dc0d2f55373e19d328f9a8be14f0b08c9b69e34ada02728751cf6652824c0e18dda6
SSDEEP 24576:f3dCN/j2GLl3iFSE33b9xLaKngL2jdshRTdG1YxITqvfPkbIcbjL:fkN/j2U4FHdarSj8RoTCC
TLSH
T157B52375FAC0D630D01B57781AADDE942D12BFF8E11B884ADAD11BFF5A797E0923A000
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
2180	elevation_service.exe
3796	elevation_service.exe
3344	maintenanceservice.exe
3352	msdtc.exe
4904	PerceptionSimulationService.exe
4200	perfhost.exe
1648	locator.exe
944	SensorDataService.exe
1976	snmptrap.exe
1780	spectrum.exe
3804	ssh-agent.exe
4484	TieringEngineService.exe
2312	AgentService.exe
4520	vds.exe
5036	vssvc.exe
4796	wbengine.exe
1900	WmiApSrv.exe
4704	SearchIndexer.exe
3204	alg.exe
4092	fxssvc.exe
864	240829015.tmp

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-10_b7a667400bba0c8eee0e2e26ccdefd82_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a8d7bf4e862f6ed0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\240829015.tmp	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-10_b7a667400bba0c8eee0e2e26ccdefd82_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-10_b7a667400bba0c8eee0e2e26ccdefd82_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-10_b7a667400bba0c8eee0e2e26ccdefd82_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-10_b7a667400bba0c8eee0e2e26ccdefd82_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-10_b7a667400bba0c8eee0e2e26ccdefd82_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-10_b7a667400bba0c8eee0e2e26ccdefd82_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\aFoj.bin.part	240829015.tmp

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1172-0-0x0000000000400000-0x0000000000CC6000-memory.dmp	upx
behavioral1/memory/1172-63-0x0000000000400000-0x0000000000CC6000-memory.dmp	upx
behavioral1/files/0x0001000000017bcd-86.dat	upx
behavioral1/memory/1172-320-0x0000000000400000-0x0000000000CC6000-memory.dmp	upx
behavioral1/files/0x0001000000017046-85.dat	upx
behavioral1/files/0x0001000000017007-84.dat	upx
behavioral1/files/0x0001000000017007-489.dat	upx
behavioral1/memory/3204-490-0x0000000140000000-0x0000000140167000-memory.dmp	upx
behavioral1/files/0x0001000000017046-503.dat	upx
behavioral1/memory/3204-544-0x0000000140000000-0x0000000140167000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-10-10_b7a667400bba0c8eee0e2e26ccdefd82_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104187\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-10_b7a667400bba0c8eee0e2e26ccdefd82_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2624	1172	WerFault.exe	84

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	240829015.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	240829015.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-10_b7a667400bba0c8eee0e2e26ccdefd82_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004fead21f3959dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b06b96203959dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000894832203959dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f855c1203959dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001027af1f3959dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff139c1f3959dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001211f91f3959dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004772fb1f3959dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2c1ea1f3959dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004425ce1f3959dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2180	elevation_service.exe
2180	elevation_service.exe
2180	elevation_service.exe
2180	elevation_service.exe
2180	elevation_service.exe
2180	elevation_service.exe
2180	elevation_service.exe
3796	elevation_service.exe
3796	elevation_service.exe
3796	elevation_service.exe
3796	elevation_service.exe
3796	elevation_service.exe
3796	elevation_service.exe
3796	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1172	2026-10-10_b7a667400bba0c8eee0e2e26ccdefd82_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	2180	elevation_service.exe
Token: SeRestorePrivilege	4484	TieringEngineService.exe
Token: SeManageVolumePrivilege	4484	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2312	AgentService.exe
Token: SeBackupPrivilege	5036	vssvc.exe
Token: SeRestorePrivilege	5036	vssvc.exe
Token: SeAuditPrivilege	5036	vssvc.exe
Token: SeBackupPrivilege	4796	wbengine.exe
Token: SeRestorePrivilege	4796	wbengine.exe
Token: SeSecurityPrivilege	4796	wbengine.exe
Token: 33	4704	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeDebugPrivilege	2180	elevation_service.exe
Token: SeDebugPrivilege	3796	elevation_service.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 2648	4704	SearchIndexer.exe	120
PID 4704 wrote to memory of 4412	4704	SearchIndexer.exe	121
PID 2180 wrote to memory of 864	2180	elevation_service.exe	139
PID 4704 wrote to memory of 4176	4704	SearchIndexer.exe	140
PID 4704 wrote to memory of 2076	4704	SearchIndexer.exe	141

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-10_b7a667400bba0c8eee0e2e26ccdefd82_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_b7a667400bba0c8eee0e2e26ccdefd82_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 700
  2⤵
  - Program crash
  PID:2624

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\system32\config\systemprofile\AppData\Roaming\240829015.tmp
  "C:\Windows\system32\config\systemprofile\AppData\Roaming\240829015.tmp"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  PID:864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1172 -ip 1172
1⤵
PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3796

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3344

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3352

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4904

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4200

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1648

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:944

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1976

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1780

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3804

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4372

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2312

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4520

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5036

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4796

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1900

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2648
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4412
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4176
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  PID:2076

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1304

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 df337209bde59fe6334baed2036b95f513f7bf4c2d9dc1b0a6ef2b5b972ff09d
MD5 69d901ae40b0fb696e858e5ee450ea9b
SHA1 0686e997b687900550051dfaaa739dee1c8b1ffb
SHA512 8b3f55e69424fc9b211c93b6264aeb0f5acceaaba97d45dcb77a0c1e4920f5a51e402f2764a75688621624fd6236d81bd64696a38ba493b792e30e43bfb5d47d
SSDEEP 49152:ub+632BuPkFKRrdE6ohmstBhuXjfS4LWxn7N/j2U4FH:w3q6HjBUj2jF
TLSH
T134D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 ab65cbfd34887d94e2dfe5a279ed69b079d752f0145fcbcd380a2254689a65ce
MD5 da66c4cd3706d749c28c4ad7d0abd08c
SHA1 888f480f08a17f9c88f769c6b9830361b2f1c42c
SHA512 4f82c9cf9849b38abb3fcb036e8901a9143abc1e9ceaf1225bcf3f9e2f5e02f0ba19c16e0e5273c971b2334d7e57b8f315f9f0aec2170cf23f446f1f9a5dec05
SSDEEP 12288:e1XLsswWkxy2lRq2czAvJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:sXYfDtczA/dCN/j2GLl3iFSE33b9
TLSH
T12685F128B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.8MB
SHA256 2e7762d15f1a377b752537046f93ce789598791d989331f8132988b4935dd5e2
MD5 1b11a845c9ca808ffebddf721ba42c9f
SHA1 5029e8600ac12d22e84c258eea315d16c37d4836
SHA512 0c77993926523189c4696693d5b9a213b7938e3d765cd064499055a1185d0a30b310681455855cb225516db41d2e6a2885f37b5d4f856172c3ea5df2689c8830
SSDEEP 24576:K0Le5ji0hmxirM6dCN/j2GLl3iFSE33b9Q5taKngL2jdshRTdG1YxITqvfPkbIcK:KPji0AckN/j2U4FHQ5tarSj8RoTCCW
TLSH
T189D5D026F6B48731D073C1B9C5D2A68EE971308557308ACB4286D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 2.2MB
SHA256 16650272118f33f41426e6d98f6fcf1a3d32d193ec0d0ae759fd61b1a34791c0
MD5 207604b5897eb57a59c3fa1f5588ccb3
SHA1 e55fba288f06a833d3840887393cf582b72ff65d
SHA512 314034b9e8058277c44df13ce867b51d40efe084b207a2c10fef566a6c36321b1bb1005dc375d45992125f32a9518425a74644c6703a9f28b38a609c2d5780a3
SSDEEP 49152:c/ezSC6vUzPvxHjyQN/j2U4FHUarSj8RoTCCW:YezSC6v2XxHrj2jF0JTy
TLSH
T143B5AF25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a91b4c053d6ec577de70c205854347dc1a89a338f4ff80f468c55028066cf26f
MD5 0c54ef23f6e016035c0b6111cbf0aa4d
SHA1 b22213f5365944c1fa9845375ec6506f50c76417
SHA512 50960c882557855e3800ea24e1d1aa35616c29a028fb4ed7ec9f69b2fa7146d9fbd4014b6ae95aef9019a81c40bdc2e2ea7318924bf9b30706f3012a7646c011
SSDEEP 24576:TVbqPb88hv/l+6ldCN/j2GLl3iFSE33b9:TVO88hXl+ZN/j2U4FH
TLSH
T146559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 2.3MB
SHA256 14c85ac70e4a7c65a5b7219bfd4351db9ecadd08082da3959c2b60c764948cc3
MD5 8226cb0a87ad9d479eb4a371849f1835
SHA1 6acecaa76d76c79a3a14e6d534933865fe09d85f
SHA512 9a81c23df36387fd9f97975db8abb08bc6df8d2e412296ae8da656ff30e2854c8ce2dede108670d5c3b5da92510a9fc487b4bc7d147b7ff15a5c5cf80093d997
SSDEEP 24576:ORedCN/j2GLl3iFSE33b9Z1aKngL2jdshRTdG1YxITqvfPkbIcbjLm:oN/j2U4FHXarSj8RoTCCW
TLSH
T1B2B533BADBC4AB64E66F577827F9ED492801BFECD40B850DC9D02ADE15BDBE49039010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 020c310d28ca1157e8100689b55813aa16aa85963cba1d6c09d201ed9690c639
MD5 c6f64005de956ce0d2da9c6dea5e3bb1
SHA1 f942415b2b0d7053bb7ef89e4d6203a58cd4e480
SHA512 0fa95d96fb9d54ec610a4b639b752d4b19f513a6db4c88360b3b210ee34d02e3b62e0ca1c426cc315ef3c803d66f6ee4cce9f0177ddf74476363ce6d67a0b5d7
SSDEEP 12288:8eBNUbTVO86UZJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:8JIU9dCN/j2GLl3iFSE33b9
TLSH
T1EF85CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 686f34186bd6bf3a80c8301baa52bc7be748e8a6094991cfb3f4009575fee5d3
MD5 3a76e98d94a0102613ce335848de223c
SHA1 429fba1309af4ac92ac355ad93851386fdca08e9
SHA512 b9a845d67a2115803dc3d2ef9cb295af580d9093f02070091b531102d5008ce15129a54be58181ce418c03a59d108abbdbfe19590aa2e942e8862ae6f8331e15
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THj:mQvGAdlCEL8c/yRNw5CBj2jF
TLSH
T111267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 00e0332d9d4356c5d269960a26c5d540e3b0f601ff1d91d7189370639d6278a2
MD5 12461806cb00b3da325e67e964c48b7e
SHA1 e63260ad98e9a6f0b88e6b45ee8aed425a7c2c9b
SHA512 8cfb282f7946c58739551c61bf331c3ea9738de869dee2149440d8086e089f3840a9cdfd0d389df0d48a4886b42c818247f6cfe3c44dccdc1f2c32edd016a582
SSDEEP 12288:cAwSfxL/2Dc34DLLmt0LDQewsAjnJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b92:BdewsAjndCN/j2GLl3iFSE33b92
TLSH
T17495E031FE74E436C2BF0DB61B35C716142CBA608B6119C3E3E88E9E59346D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 57d3ba8dad8951908343f5ac163a83d5de097e54d679c2b763850793753d6fec
MD5 7185dfbf18d2eadb93fe23298b0649bf
SHA1 44ea39f4596b6fd136bb7f406b4fb2c0e2f3fe4f
SHA512 b527fdd2dca70aade0392e0cabb05f1f3f3719f7a5bbcf1f52dad927af957ed5586b63b42dda75a4834d17e0631e65b4b2b470b7eed45cf794aaa82b0fef2302
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHw8F:/UEtQevvqc2W1cpV2EI32w
TLSH
T16C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8179d9f56703f30b2d5916ea72fa506521c2f8cb144674b05b2ffb4c5e65f017
MD5 fec2dd0ef415ba515b2320baa608a68c
SHA1 7e06f851aecae7b2fb96d93f920907caecab0abf
SHA512 a4b3daa75be5dd295824b12bf9e978af9a7c1fbd428a86f66e58bc8d3d45c4a5b1eacd69bc75a58320b0efa8d7b54c0ae2b1c7bc6e14927a0058365c91c06154
SSDEEP 49152:eCbRquA/m2yL5zQfFiV+XenmE3/z0N/j2U4FH:ToqtVjnmFj2jF
TLSH
T10CD58D0976B8C2E4D1F6C77886A2C647F37178158B3197EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fdda7441fd2d768ca29a2ec37d83024e0e0a671957e3cf616e59287b1b2ecc04
MD5 a320be0dc7d59587002528aa36fd3ad6
SHA1 eb6b0642f717b57646c0b143795d538399fd4bd6
SHA512 a96dca1e49a0eb070a6ebf71c87b6683d1ff0e6796785db4f11a0c37a2324566cede5d478042841313a23140f00a8d848835f7b3034ef45cffb8113d9df53c17
SSDEEP 24576:XAhGLJIFoiwtA5l7S53gdCN/j2GLl3iFSE33b9:XAMyFoiq57N/j2U4FH
TLSH
T1A535AD80E7F955D4F5B3AAB899B68571EA72BCA95E31C20F1150D21F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 9765df4178d3b13dcd2f536436999e90500e008c38b152f57ca0a9f31be9062d
MD5 0304f3fcaf260874144fbe57de9020cd
SHA1 4f8be3de4ab5f6cd9032da29e34e6cf364243479
SHA512 dc46b759e34456ee5ded7aaeab4d0e571c8f3ed9f2d836c82398432a57453186d3894b7afe977bf70a09eb90b501c4dd27a0532b4eb0ee5222540dba1d726157
SSDEEP 12288:dBZ1Iy3JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:7ZuSdCN/j2GLl3iFSE33b9
TLSH
T1E975125963E471F9E1A7823C8AF59A05D321B8A5A73243CF026047EA1F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 aa23426283e4e945df54b0c4eee8c1bad8ab1cdec70407f7348acd5fc06b5f4e
MD5 e4724eb11585d00a31128d64dc162dfa
SHA1 1c24cf2b20e616c24bcbed3f1c131324a73c9ad9
SHA512 ee979bd1ab52a36efcc50828f0b23e6f6cd8fa69d9f0a2fbc44c1aae0b1b905aaf18ed34523a5df29cb0fe823b8523a49f3aeb19f55cd40ec44dd35d6a8d4ffe
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uf:5QRQyi36YOcPQLvw2gAf+PN32j2jF
TLSH
T13D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ebe43fe642064ca9ccea17b0506bd8195de4a6113f8c8f636f9ea00bdd48b473
MD5 fadf3302742138958287bf05271dd0c3
SHA1 394825336c443e2e9735c3826048e1b9f6644a41
SHA512 f677030f81410b85d958b4b034c0c9976092802f7f0bb4a677ec647f7ea38e056be6e5c984fb2022c2991bdbedffc3418bafc0f2ea2bf473b012055805089d17
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uf:uQRQyi36YOcPQLvw2gAf+PN32j2jF
TLSH
T10E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 63ccb2906c9c845a1f6abcc3c26f4e5a8d8bb6c7baa78e0b716d6d2e1fa61d29
MD5 529f5ca0ec46e6b11637dd1a2559f073
SHA1 ad9407541b5e7ed9f0adff179da0210c3b0d54f0
SHA512 c5a0cd4c40897c09f2345d5d77e0f1890435f60197bf9966147d17dfb59069fc8a9fb6efdd1b732cfbb208e0533da2fa3be13743f48560543ecf7efaede5a7c7
SSDEEP 24576:6wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0idCN/j2GLl3iFS+:068Qg55nhheWu7PNU3/kN/j2U4FH
TLSH
T181B54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ff262ec97db1572add4887c7801c8c6f364f4e643bacc1c2d24fd590f09ca74e
MD5 14104e513593fc085103d422b38a623c
SHA1 1d4583f0207e7facc459de7ae48820d7bb03987f
SHA512 9aa94078c8e5235a6875d67ad4c1372d475998ee35d893d6a182af63ddad9d64f594e489a812408257d80595b69f9c8806107f997c1da6b319539728af94f556
SSDEEP 49152:N3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99V:cy5112gYy5azzVvL69nLKnhZPj2jF
TLSH
T11E168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fec68b75d700df4838c65f77cd8c76d50afabf3c884bf57aa8756e41aba45731
MD5 e6dab6b62aae0608197cc9f30cde0acc
SHA1 e5dbe058ad308df5d40502be687727be999e86a1
SHA512 aff23c8c71f82a4a22fb9809cc1508c2fa23a540515863b05e744600431debf261b67d0103950a6ed85b1ca56f46c6a70cb4d18c3c56b4b05d4aebf70a44cbb6
SSDEEP 49152:6B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl8N/j2U4FH:ou6JmVxd2dwj2jF
TLSH
T1C3D59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4c17048ba2f47d5eff0c074034e5f5b217f49f823ad0bf81425d471b153759b0
MD5 eddfbb488827d9b85408b9bde03ed2f9
SHA1 3dc6f5f34a8923b69520b0a4d3a4278305cf2c72
SHA512 effe4036a81ef0a0e8fa1b7c7ee5d247e02dc0e620c6e590434822e1f19cb6c8700b6165e4fe023f6c2ab74df62fb7e90452a95421ded51566a61c7ee199d836
SSDEEP 49152:h1hpsNoJpF1A6UU44CwH7R4xyN/j2U4FH:hmifPbRFj2jF
TLSH
T196B5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d10803a577206a71ea2dcc6973653d87cb55642b28cae66ee35a5955a200eed6
MD5 716d15606ad01e122d02252f9a26957e
SHA1 ec467697f7d3c5089a9a7c0df228b39d975c4c5a
SHA512 cf9e30ec945ae70cbe9951fff728dbdf9eb8cf0c484844c2338c798e467d706e66eb911ac44f94536d5e3167fa3753a5ee21f6542875ba8a7086be28f435d749
SSDEEP 49152:vSuZQIY0Be2KRRVtOnks6NMHqVN/j2U4FH:V5dKTi617j2jF
TLSH
T1B6C5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ede6aa1885e5823e0bf40a407945e69d2583fa723628fb326130577d179807f6
MD5 1e05d0c42d4bc32155dd230d9e5226da
SHA1 056250d309e8cfee7b1630193276145bbe59af23
SHA512 4413dec4bb529a263cff2df576bbd8eb3506b3228148aa1704ef247da9b00f88ce4ab6f1a7e37f257daa57ab311c90fb384e76abfb8584fdaba2aca436658187
SSDEEP 49152:JhtSn8EApI0figngiDn0AP5w2N/j2U4FH:4X2iyphZj2jF
TLSH
T11695BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 542c153dfb20cedd60f840160dd8c677954178ea3cf84f3d6095a56aab340343
MD5 009c5446952e30da8712fcd5403153fa
SHA1 1874ee11d1f8a227208447b3178f1303a696bbf3
SHA512 85f22602272ee4a16924589102877d47058de02dfec46e8c7a23faab28edfb92eddde0f4870ec01279c41ad5146707e1aabcc889c05cf3c4cb83330c0424e4ff
SSDEEP 12288:CqJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:CWdCN/j2GLl3iFSE33b9
TLSH
T185752364E9F6B669F15BC37943A9DF515100FEE8F6264487868156EB237CFEC8033062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 193e6961839a67e2b4c18851c0b94f4428b3d9a62339b4c75e3e344c43f4c367
MD5 4a1dc7a6055d653d6730aaf25f4d558d
SHA1 37613663c07ca99c481ffa6417a2f7fcb0ee49c6
SHA512 1546f3effc3596b0da1bbdf4d96f452565c5509abbc87608c954a9d37a2888df7d234e2df10fcada82fa99a11e7cd32227330d6508a6f91b05681fd95c1eba89
SSDEEP 12288:hjJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:hbdCN/j2GLl3iFSE33b9
TLSH
T191752364E9E6B669F11AC37943A9DF519100FEE8F6224487868156EB237CFEC9033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 808b94d149a69e027e65ecb4275326970503536ab70d5e8671ba20d6e6d4cba6
MD5 8cf230fadefdcdf7d2bf56c14228bfc0
SHA1 9f18afd7559009f5d7b1b34325809b1fa4db4601
SHA512 c364532be64728a6edeba06400c56f7dfa40aaec7ea5b824cdc082f0875868d727b339c22a0d1776068af31aaad8f2a60946166f9951e3cc3c4003ed0f2458ec
SSDEEP 12288:qBJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:q1dCN/j2GLl3iFSE33b9
TLSH
T153752364E9F6B659F15BC37943A9DF519100FEE8F6264487868156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 6d231b39ff21633bc45234d0d0828e30a6be34b062adde2760ee0e2c5ab9ce82
MD5 3b781c8bbfc742e9c9d572cc6a1ccd54
SHA1 5efb6d71f6ce2cf8dc66f778be9481087adac89d
SHA512 2300479c82cb07c94a72b6af0d39b7ed0788287d9c9f0871f5c9fba85fca49626c66406b5065e06f8edff06fe549851acd8a4d5abff84e09b6a08fc949a5adcc
SSDEEP 12288:YVwJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:FdCN/j2GLl3iFSE33b9
TLSH
T167752360A7F561D5E46BC37883B5DA21E220FDE8E73245CF87400AEF1B75BE89432562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 48784c037aecb9860f46bad509ebbff94c4ce27e51e10e7e6c520d47f89e0471
MD5 d1236f612fa26a096b07dd447cf84450
SHA1 5b25c6c8f7fecc73fd8f7a16bb45b45c7307fce2
SHA512 156a133ab5bd0d5185225a2763ba7696d0f730a631fab89e1a55056a0b17516f8a7789ab7639e66936beb715a38d1f920349fc3ae73c0840c8c8d79534ff655d
SSDEEP 12288:NIJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:NodCN/j2GLl3iFSE33b9
TLSH
T1F0752364E9F6B659F15BC37943A9DF615100FEE8F6264487868156EB137CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 91d9e48d4a42d24807e1df89a243539ba93672017929de8e6983b65c0749de56
MD5 4aacc437620f5c687d339ba34a0ac0b0
SHA1 c434bd466602eac438e0d2e5f9bb8a141eaeb62c
SHA512 387dbb55be0a85c05703ecb2f07e995ea503209e549f0311ae42f7f13ee02401d55414bb32df70f16532cbba2540f2a2272bb720bf363c5aca2d03a28f5a7848
SSDEEP 12288:ePJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:efdCN/j2GLl3iFSE33b9
TLSH
T1B1752364E9F5B669F11BC37943A9DF519100FEE8F6264487868156EB237CFEC90320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 db7005f4a6ce1deeaaec700b163417530ccfed206ac348134378fa068009eba0
MD5 006c54f32bb98e5ccb36784eab3e54b6
SHA1 3c21a10b8d0b839117286f22bc1df9bf6a3d4618
SHA512 daa6903e1be20092807912c7ab20488816361bf0e992307d936f19127160fdbc477c76a99947bae42a07e961964dacf728e8db9dfcabbd4dcaebceff0d628358
SSDEEP 12288:ebJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:eDdCN/j2GLl3iFSE33b9
TLSH
T1F8752364E9F5B669F15BC37943A8DF615100FEE8F6264487868156EB237CFEC90320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 5aef64339acf1a6398d376c26fef9d4db4218dd27a1af8aaea398dbdd2c66433
MD5 cdc02ca7227ab4326ecca18ee227c2cc
SHA1 69e9de922e887ee17d9d24aa8d7e756b2bc7ccff
SHA512 57b08ed0d0931c4cc8c78d4b1a1b94a91ce4fb2819ab13feb22cc941b23f263eaa3c982c138ec79a01a7a2dbac010a630f093ec5c23ed6286a82be77193c5607
SSDEEP 12288:liZwb6zzFEoS2cPvyDJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:oZMSzFVSO7dCN/j2GLl3iFSE33b9
TLSH
T17F8502A4B3A018F8EC67823EC9658916D271BC594770C60F03E4366B5F377A15C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 a13ed61a7cb6bc4708405380121f54b1b748e09028b5306cd2664ed731e25872
MD5 0291683846c5e2858acc8bc8acd0b9ee
SHA1 44b4fdfd61c39cc1fb3c765f140c73d8109b797b
SHA512 3f63e335befd09482f0b0363837bf0473c6abef979ebf4139a921b371d74ba95d79c8e9eb674feb3e921bd1e6573b54f8a58ae56c6e677e0b73a1d5768c3072d
SSDEEP 12288:TuJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:TCdCN/j2GLl3iFSE33b9
TLSH
T1BC752364E9F5B669F15BC37943A9DF615100FEE8F6264487868156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 e0db68cc0cf17116d7019b18fa171eb1fe86df7b813b9b250d5d7249bd291676
MD5 bbf0cb839de897019377c15a2c15e2fd
SHA1 e04af9c52c0ac53e161b3ff68a904cb35d6e13d3
SHA512 4861515a01852e89f658070e1054e3bb51447192a031820f4446f1b95c46838f6e0b62c123c874ba2d772ff856bb46dc11802825ef76ffa2feeb465f11fcef0a
SSDEEP 12288:FSJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:FOdCN/j2GLl3iFSE33b9
TLSH
T158752364E9E5B669F11BC37943A8DF655100FEE8F6264487868156EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 45a615fc79b1ab71eb037d03df66be2a29573c7d630938dbbee1f79b35f1e0cb
MD5 922334b996cfe3681bae31a8fa169a51
SHA1 bb224b792944aae7ca38544d2ffd0289638e59d7
SHA512 648aa6cb8494ed05ef9837836a5436c6fdd7e69157ece1dc5d924195548e8e0f3ec1e0d7f92913f908d055912248c2026a69d07b0ded17b65d611351d61bdf2e
SSDEEP 49152:GP4m4IpOO67W8K/N/j2U4FH6arSj8RoTCCW:+ppOOHPj2jFaJTy
TLSH
T127B5DF2DABDC0095D0BA927886658A49FAB1742E1F3286CF0160937D3F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 721a64cc1c87e1d8109485f08d6e1a1af02c864cdcefd81396f5a6105e112ef9
MD5 235432c94b661390031a6ff48cbc07cf
SHA1 7187ca3e320dee9cce1a330e037945d2206adbbc
SHA512 d4f5bfd01c6813621ecc69f2acb4112aee217a05841834d7a122e6a0d9647b5f763ce92c57944bea4357b386946863699bbd4a50b41ff1117feaa960302aa4ad
SSDEEP 12288:bNsfeJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:YSdCN/j2GLl3iFSE33b9
TLSH
T108850119D29412E8D06E9279C7558A41B323BCA493E1C3CB43C0F5BE1F7AAD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 b476fca248ca231396afb3989c89f501d4c76ac37522511ea683410ca7b1a62a
MD5 26f8c992d9904d9faf3545832f1d7993
SHA1 70e6655f6f82cf47efdcf81dc052678ad696380b
SHA512 dffb76ef174f8fc7f86c6b52a82e22736d27453604f4d75c69d5295e213d399b77008cd7d7ac66768d01689d1b80c6f98de9953cbcad9c742f84a3457d891c5f
SSDEEP 12288:3+JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH2:3ydCN/j2GLl3iFSE33b9f
TLSH
T1E9752364D7E9B656F17B837403A9DA356200FEF8EF258487C58156EB1278FE8D832423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 d63b3c285975a9cb65147b9dcc2386b66dab0571b647421a956b5144bcd8ebd0
MD5 7df31e36f90ca7fdbfa8af96f57ce3b0
SHA1 0a8f79a91552c109a5227392525063f3430c5882
SHA512 2660bf142a4c8da05f585fc873e55d13f6179455ca22694f6955aa4d51482e9710909250159bceca8b828adcadd663bde40278c19a299a0e5467bc8d28350e56
SSDEEP 49152:Ba0h2GEkuAe73q3pp46zwwQTN/j2U4FH:Ba0hNYG4Jwwj2jF
TLSH
T1F185AF1D67EC82B5D0BAD278C9A6854BE6B2B4260B3156CF1150853D3F37EE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 fd7f9b3dcb4d154de16362122c568d2860d65d5b4482087a62420e8e850962bc
MD5 7031ccf0c88002365537db86d25171ea
SHA1 821296f2129a5d1799c215127575e4503384f60d
SHA512 e76e74f3fb61929414d41053ed4c4cce7bec51c8992e5c08bddaea33b356d80c5c2d8165040551cb61065e6592ce6088af489f5d270d8f0cc8e087293b164805
SSDEEP 24576:q3YgnJcRTk4yti+R5dBR/BdCN/j2GLl3iFSE33b9:qIgnaTk46pBR/WN/j2U4FH
TLSH
T1C545B02DF3B910B9D8AAD236450147B5FB71782D1F209ACB0170C538AF1AEE85E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 845dab565fac70b703b4856ae3fc0c3877dbcbdbb81f18b3fc353fe2c7891791
MD5 be0e53c37be1568555f82499a440b0af
SHA1 90bbcb3a5dd1699a066311c29e35b6bfe794239e
SHA512 678541400f217c4aea7be7cb913b399507f9ce2e9cb482852afe02d35460814147163ff16f3721552e41fd9060e1748e955ee5352f1e5bcd953960d7f3b403fb
SSDEEP 12288:wiJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:w+dCN/j2GLl3iFSE33b9
TLSH
T168752364D6A5BA59E16BC3BD03A9DF256100FFE8E72245C7858166EB137CFFC9032062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 3d285abb2f709b5e05d054b921635e1dd9c8b3c3a39797cbfdfc1d341881b934
MD5 c6c016a77c715c20f64e058bc5edbc62
SHA1 95705e7df40f579646dd8ac53675239c3156f4ae
SHA512 ce41219fe3d9aeca65ab4e817156d3a3fea0538433a839da74ea9db0212481ae809917720d2ec0d2ee657f7e0c051653aaa5dcd26ab5008796086000104b2d58
SSDEEP 12288:UOb9A4LWOsvAYFTlJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:5pL3UThdCN/j2GLl3iFSE33b9
TLSH
T17095F154E7A410F9E97BC23CC5A68A16D271B89C1724E7CF03A84BA61F237E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 ed63fdef3e245863e2803fe39874004d81116fb98b3e716f09c0624cdd45a031
MD5 a037f5cac38cda3e972fe9e1e01c9142
SHA1 2bc80b10bb9f3630d9908dcd79c50753d92f655f
SHA512 33f0f29828518213d05174e0d35263cd12f5cad4609d36aaeb4704c9a57936ba5a11923d113632cc456b3d6b4141e0d8b8049d19c1d4daa23c7b3ac45974f788
SSDEEP 12288:jpFtpO5JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:/OddCN/j2GLl3iFSE33b9
TLSH
T17E75022936ED20E5E17A923C86968709D331B8A5572247CF42D081FE1F77FF89C36A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d58f52037145a0357437e4712942a4172f4cc20d8f7e6337fa569746373b08ff
MD5 b800e584f0f4c5e60e7da0a53387f9f0
SHA1 4b17b259ae6f29d85851bc67982281ae9bc48860
SHA512 5e83a1253ea96d39db7d21a234e9d29ecec89e2163d2da9e82d603c2835d94bf46ecc40e9d7929a204532a4e8be3aaa7fa288f0746903ebb6d1f781076de313f
SSDEEP 24576:07NM9YqZqmWMUkPjZM48Mv6bEhsCdCN/j2GLl3iFSE33b9:07cBWMpPjN8DbEhoN/j2U4FH
TLSH
T15165AE2E6BEC81E5D477D13DC9E28605F2B1B4611B318ACB5162833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 34913f628b6fe555fb38bcc3f9d253196b953737a4d516b4280bcfaaccb895b9
MD5 5cbcb95e8757a2da13ef6ccee9f11d9f
SHA1 00efa3deaabd51189c244cf45f69c32ce77ba7d2
SHA512 fcaab3f07e9c21d6ed8c6f19316a35ae737eaf15930abd1a4f837bbb4a6debd9c5262a1b63f9fd1e37397e1a4b6b940c0956180259bf62c7dd052b8c3c2c4d0c
SSDEEP 24576:4W6BApg2YuyuNDYTabvcdvNYf8km1sdCN/j2GLl3iFSE33b9:4F2YuHNETovAvNYf8kmlN/j2U4FH
TLSH
T1D7858E2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 2.5MB
SHA256 825b348c999dd5523f70cae3c9f480efef644ad49e9773b6c1029fbf78d4fa61
MD5 a76176d19dfd20c10cf14439efd6d45f
SHA1 d925718df856ca62319e3050528e9a75dadb398f
SHA512 9d8597f9901688842dea087014fff11a96cb6fd9657ba233a77e8203525da437c1852464ed3a993f971a1292e8995fbf48a8b84b41693ed5bd98d2a97ee1a8f7
SSDEEP 49152:4F2YuHNETovAvNYf8kmlN/j2U4FHLarSj8RoTCCW:96BCf8kCj2jFrJTy
TLSH
T187C5BF2A67EC80A4E0BBD27D45B7D246FAB2B8551B3056CF0255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 7a7fe88a5f2763bbfa4a11a6ba87141b1d03d0cd68f3b6a747e465f4e3147488
MD5 8f77ce615194aa1aceff187b85e55681
SHA1 c2e17245f888c302c3df9ca6e537d643caccb8e3
SHA512 5435e3be9a9927878bc649ec8e31ab75f54a9f5eac7c2d98085c7398a307cb3e1877dc45e24de1df495de9b1f46de3afac95262f65538cc1d1c57b391ae7504e
SSDEEP 24576:uAFs06+Omlf3NXEbToZdCN/j2GLl3iFSE33b9h:nFs060lVXuzN/j2U4FH
TLSH
T14D65AF2F62EC00D5D07ED17D8A97C91AF2B1746307255ACB0260867E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 520ffbcde165a2240fb9ac9c42cb8513feb8a351e5335162639ea0ed269f7f3b
MD5 bf4467233dfb908f173fc206da64bac5
SHA1 b464092aa710186492628bb90dd0b6128bff036a
SHA512 4b8f2830b4e6f1f07a91fdb5bd0bdc95159477e12863e7be41ef2db8991847c374265d30eda1e4cf44063b54c09ab34c4cdf5ed783887f2a874667841f80030d
SSDEEP 12288:HCJnJ5D3VkrDzxOJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:iJnJ5D3WXIdCN/j2GLl3iFSE33b9
TLSH
T15E95D02CD2A810E8E4B7C2B4829A5B56FE71387D2F2269C718B4D5353F12FE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 be5b368b79d16ca906d1d55879b98b965330d19a798123e9ac167b0d31737835
MD5 a089499cf732d30d5fe852633057f148
SHA1 1e6ea5930225034558d5b4d31ce62764d7f62351
SHA512 a3891c757ca0fc08ea92b9dc9567cd7db3c35c52bc78f1c7ad49562667a136480f93a234a0f2ccf8c397ef9a373cf95bd2c56f0e105cbdb65e30f887b8c6316f
SSDEEP 24576:SEPghm6/7IIXdwcXrif7qQncjlP65i3VuzdCN/j2GLl3iFSE33b9:lg06DIKdwc+eQnSt65aVZN/j2U4FH
TLSH
T175956C15B7EA5294E8B3CAB1CA6291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 fc8ba93bcd80358a33551a69a35ab6a76a04989b12d935ce5d50bfc20ae50995
MD5 596068a496a41682c6debdbdb4abdee9
SHA1 0b5b3a512a91a2748762fa0c2c7004882b9c744d
SHA512 720aca8552cf270b60947cfb09314707e78334d92e72ec08faf7feeb7ebbef253c226734f98936c73689f0f998ad2c46fd04ecac2d901c57669b13b12792a512
SSDEEP 24576:vpSnaKngL2jdshRTdG1YxITqvfPkbIcbjLJdCN/j2GLl3iFSE33b9:vpCarSj8RoTCCON/j2U4FH
TLSH
T19565236DABCC61E4D02A937C56A5CA48E772F5B8A70707CF45D082BE4E7BBE81D39500
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 850KB
SHA256 8b2bcc1ca4fd2c8b2eb6525853de94599f749042bf00787a81acb333e066a9d9
MD5 709c82fb316ac8b896e4864c1811c4ad
SHA1 baf763b19ead48290cb2b4186d1f26001b1a22ac
SHA512 423a85e5e2dc26c21be544a87280e608b56198b0196f25dfaf1e455454c4d9b216d178bc83ac1f17c7839bfde1dfd359737dff7355f76e7f399b2bfbcec4adca
SSDEEP 24576:ViSnaKngL2jdshRTdG1YxITqvfPkbIcbjLm:ViCarSj8RoTCCW
TLSH
T1E905126EABCC61E4D12AA27C69A18549E7B3F168570317DF45E0C27D0E77BE52E3CA00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.7MB
SHA256 cd9d2af5aaf7a3e24eea3680e96f3730db20a52f5f867161d487fc30f965cc67
MD5 582ce3d6cd079b395e518ac86d79ae2b
SHA1 96a4ccb0d0887e7c1af783b1bbbb66e924b6c0f4
SHA512 cb21883dbd8282460541bd5d1b27f74e38fca97d712afe6cec633f405a0223d698d04eaaa5ee35a99681a0e4e22df967ed169b90ff0bebcb6c3d3c1f81039faa
SSDEEP 12288:VjkyVJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:VIyxdCN/j2GLl3iFSE33b9
TLSH
T18B851214A3E4A195E57A423C86B686619A30FC70AF2146CF41C0E77F6F7ABE49831B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 85f3a8f3739b9ef74d692f049424f242f259673d3973cfd98ed9747cbddbba14
MD5 3d6dd573539843e4df576902401bf63c
SHA1 e533b9dcae253c3896195c2a3560087d800c06ba
SHA512 b776b4d81c72d1951188d8593e119a9ffadefc5f671fabbe672c523340908f74a834aa68214aa5983a68a2ce53b8dbc90c6ee7fa315731fb6dfd92fbc2941d5f
SSDEEP 12288:VyJJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:0NdCN/j2GLl3iFSE33b9
TLSH
T179752368A6B5B569F52B837C03799F215200FEF8E72104CB41D1A6FB537DFE89032852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c596ed447477dc35ba48d66f524e7cd79d13c32cbea0b5afff3b3940b138e2c9
MD5 896567a4e03abd4cffa4555ae0c804d3
SHA1 701d8e638c743c50ff3ee96e6ef25de124a69c33
SHA512 101110beae66cd78d279c1ebfa15e16c3abcd406a2697de252a91fe4db969517913772fcd2a7f4dfe37653f8533152bfff36b15540d4548b723490949cd76d0e
SSDEEP 24576:qQ9MxZKdcz9dw3adCN/j2GLl3iFSE33b9:qVKZ9N/j2U4FH
TLSH
T16E558C2DABE9159AE177D27995A250C3A633B4301B31C6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 da24e88968f77ac7f191d6cf154309134c3e144f40f1dafb191d4ef105a763a9
MD5 19508899d67aba8ecd95396db3c82144
SHA1 4d0fcda7f0510ab4f1d7d70197aa1b3636d658c7
SHA512 b9d13d67bf6953a5bfec09adb230ecb9c1ef8d4282c1f45b26d94bce080f4eaea6120146fac788f5d8e6ca2e9a198d8e5108b72a0333a55f8158a551720ac28d
SSDEEP 12288:6yoKo2JRple9pnJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:6yocDApndCN/j2GLl3iFSE33b9
TLSH
T14885E01FBBA940A2E076823C89858745E773B0705B2253CB5691C37E4F27AECBD35B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 13cd28ba4be91e5cae9c68b63827c0d2033351642259c6ba77034118899fa272
MD5 a4e0d8dc01032e95b7b1f5a9c54d06d0
SHA1 b0125156b924b4f42ffb313e6d04078e2bb574cc
SHA512 7a4eed96ac11b720c24a3a93d6c6e4ae8b05a04fef51f09172c9615f74ca0adfca662d66384d1c7551644dfefc7c948e62c037f144101e48f5ab2717e5aa26cd
SSDEEP 49152:bWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKUN/j2U4FH:L0zuNIuj2jF
TLSH
T1ABA57B3DA2F800A8D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.5MB
SHA256 aa854f6fad9053436627447231c8c06a61e4bca48c9a1821207f54e7685565dc
MD5 1a4d189b6b674100e6a198e2c274a874
SHA1 efbf0929056550fa3933d674d8db6aaee3c06e11
SHA512 ccfb9e5d9ada2e4c540c43611956fd2bfe583dc71689a808e63f995c124c12df7c88bb93c305b1064a674496f662ed8a1b994b62c36b790a4d48b13a51d53372
SSDEEP 49152:Ba0h2GEkuAe73q3pp46zwwQTN/j2U4FHZarSj8RoTCCW:Ba0hNYG4Jwwj2jF5JTy
TLSH
T1D6C5D01EA7DC82B4D0BAD278C9A6854BE6B2B4261B3156CF0190857D3F37EE44D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 6e489a0b554ce79ccc78bcf2132c327eb329050d2fc7f382acd4b80aba485bf7
MD5 55d60e31e1cac0148342e825d97981fd
SHA1 6f6955a9b99d0e4dcf1570fa1ff81cce29ba1095
SHA512 1105bcda1274ce40a81c01725ff09afe4fd0edf27e80602c6bdb42750e0a4957ec1d8e3f1bf05e97e5bab1cd531f3d77677441131d8161a8a52184b6baa6d9aa
SSDEEP 49152:aTDxR+N5YzTpjMFarSj8RoTCCON/j2U4FH:Ku5FJTqj2jF
TLSH
T192A5E12EA7E855E5D17E86789B23C502FA727861033193CF42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 677722400005954834f947de4509e4f0f94f4e0805d13ca825d18e465bb76464
MD5 84539c0f30ce5a8335f7803769de0562
SHA1 85f7913652e17e52012660e7c02b4f8bb34bcf9e
SHA512 712c8cf6c90bf34435778ee9628305209b8864257e830be124682a83b968f2fc2c22501d2dd6467e7890529c5c13fdfc4ddb47085e1eae2d894356fe495dc5ad
SSDEEP 24576:t1QT7EcpfxR+N5AWAz3ooiYhjMqbzkaKngL2jdshRTdG1YxITqvfPkbIcbjLm:YTDxR+N5YzTTjMFarSj8RoTCCW
TLSH
T1DE75C12EA7F815E9D17E86799B23C506FA727821033193CF42A0C17E1E6B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 848KB
SHA256 474cb2d4b1ca21ed42f2eb3d6de87a60aba6d0544ece10c18e644559e5110cac
MD5 d077e3a6039484d1b6e90fb2828f03b6
SHA1 28c699d9b9dc7f48a045a6b499fe90f46935c9f0
SHA512 6906cbd93fa7de7a43651983ade66c1b73ffda20f229d76ef3a1e9d09f759484aea68592fe535f54fa9507b9caf217eabb969586e050836d8775430a0a545066
SSDEEP 24576:EhbHjPr6VaKngL2jdshRTdG1YxITqvfPkbIcbjLm:EhbHj+arSj8RoTCCW
TLSH
T1D105127E57DC12D4F176A37C6AA6894AEA727929170283DF46D0827D0F3BBE01D38B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 2.6MB
SHA256 4a8611d6166ee319aa185a6dac811e63946a195f7387b389ad2d141ac3b5bbbd
MD5 b763e34e4d7af92649f3cdfcfe25a88b
SHA1 428f0b9dc80db2070313e4a677904a59b5d66c1d
SHA512 29509e3310856bc1b86b23026234e59e7376cd6f56310cf858f51a0e92afd4e8c8d9580dff3298755a6433c13cc80ab40b0481833022f6db1c24ea446386bd39
SSDEEP 24576:hTMdOz0FFS+imSLAdCN/j2GLl3iFSE33b9CaKngL2jdshRTdG1YxITqvfPkbIcbW:L0K+imSLLN/j2U4FHCarSj8RoTCCW
TLSH
T19DC5127EA79D14E4E47BC27C9653C906E57238A50322A6CB06D0C1BD2F6BFE47939B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a8d7bf4e862f6ed0.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\a8d7bf4e862f6ed0.bin
Size 12KB
SHA256 ce45e5bfa8f841a0e6d3c26730d0c81f520909a401316171e441559e46be84b7
MD5 64a2fde0baf274f035906e65c6a59b4d
SHA1 917854864b7d0f9ffda0737a710a21b1a45c5f18
SHA512 506b145c0e7d0e4d26da401609da35aa742ae7da940c310b45fd90623cf5cbe2040e61f3547510685736e0bda3c3c16aef19ff087f30b0107f515499e0bbbbb2
SSDEEP 192:EAP/J7ldWMa26oD/I4FhhTcpez7MMvZO8LwThIAnqIKZ/SAxjTtSjh:Ek7s26o04FHokFkVlIAw/SAxjTYjh
TLSH
T1FC42C0660BFB3C0E2FAC8305403599665F2681CCECBA369714797D3F1162A295ED39A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.6MB
SHA256 d2bb2d5a691957209c01824030de753daf21637e2002db9989dc5d45ea129a17
MD5 04e39533e789d5f3e6d69b0a741772e2
SHA1 a42f9e4459e616fb5b44f1ee309f08d528b0d29a
SHA512 d928d320cb107bee61ea392e995bd424ee2854a0aa81b5552e1303f5d0b3da1ffa588d9b112d7c9591aad3877304bb5100bcf2101280ae305d332eba04e632bc
SSDEEP 12288:t4KvJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:p/dCN/j2GLl3iFSE33b9
TLSH
T13375121CA3E870D4F4768279877A86159220FCB4A72146EF15D0C6FF5B3ABE8D435B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 14a02a969564428725d86b1247ea9e6c619e2f082ffd613197d7c1183a5bf4f0
MD5 c9f8f537e6d7dff4c86bbfeceaea24f3
SHA1 bedd25a20e500e08cf11270f1cfb2e2d2462cd53
SHA512 2f682481caf7b88b1fb9bf9bb9de10e4b96b8a2658be160e19a2720cbd511f3cfd89a8358adab759240b65a9e8843ffc8a853d6acabf18fcbaf8c7c7ade954da
SSDEEP 12288:qmw5HEjsChNVBFgl0WDm+CGJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:jwuoOWJdCN/j2GLl3iFSE33b9
TLSH
T1C685F14577E41CF9E96782388697C536F7B2BC512A21CB0F0360C69B6F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/944-117-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/944-171-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/944-348-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1172-0-0x0000000000400000-0x0000000000CC6000-memory.dmp

Download

memory/1172-63-0x0000000000400000-0x0000000000CC6000-memory.dmp

Download

memory/1172-320-0x0000000000400000-0x0000000000CC6000-memory.dmp

Download

memory/1172-19-0x0000000003690000-0x00000000036F7000-memory.dmp

Download

memory/1172-14-0x0000000003690000-0x00000000036F7000-memory.dmp

Download

memory/1172-8-0x00000000011D0000-0x0000000001255000-memory.dmp

Download

memory/1172-2-0x00000000011D0000-0x0000000001255000-memory.dmp

Download

memory/1172-1-0x0000000000F50000-0x00000000010AE000-memory.dmp

Download

memory/1648-113-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/1648-166-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/1780-133-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1780-130-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1780-124-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1780-332-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1900-366-0x0000000140000000-0x00000001402AF000-memory.dmp

Download

memory/1900-167-0x0000000140000000-0x00000001402AF000-memory.dmp

Download

memory/1976-121-0x0000000140000000-0x000000014027F000-memory.dmp

Download

memory/1976-324-0x0000000140000000-0x000000014027F000-memory.dmp

Download

memory/2180-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2180-40-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2180-116-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2180-41-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2180-33-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2312-153-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2312-151-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3204-490-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/3204-544-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/3344-57-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/3344-67-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/3344-70-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/3344-72-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/3344-66-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/3352-77-0x0000000140000000-0x00000001402A2000-memory.dmp

Download

memory/3796-132-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3796-54-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3796-46-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3796-52-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3804-145-0x0000000140000000-0x00000001402EB000-memory.dmp

Download

memory/3804-137-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3804-143-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3804-347-0x0000000140000000-0x00000001402EB000-memory.dmp

Download

memory/4092-541-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4092-519-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4200-103-0x0000000000940000-0x00000000009A7000-memory.dmp

Download

memory/4200-162-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/4200-108-0x0000000000940000-0x00000000009A7000-memory.dmp

Download

memory/4200-110-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/4412-380-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-411-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-406-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-405-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-404-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-403-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-402-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-401-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-400-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-399-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-398-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-397-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-396-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-395-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-394-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-393-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-392-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-391-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-390-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-389-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-408-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-409-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-410-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-407-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-412-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-413-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-383-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-414-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-415-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-388-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-373-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-374-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-375-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-376-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-377-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-378-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-379-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-382-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-381-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-384-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-385-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-386-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4412-387-0x0000016879200000-0x0000016879210000-memory.dmp

Download

memory/4484-362-0x0000000140000000-0x00000001402CB000-memory.dmp

Download

memory/4484-148-0x0000000140000000-0x00000001402CB000-memory.dmp

Download

memory/4520-155-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4520-363-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4704-370-0x000000000CE00000-0x000000000CE08000-memory.dmp

Download

memory/4704-193-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4704-372-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4704-213-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4704-177-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4704-172-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4796-163-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4796-365-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4904-92-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/4904-158-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/4904-98-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/4904-100-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/5036-159-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5036-364-0x0000000140000000-0x00000001401FC000-memory.dmp

Download