d598ccc0d0cfed31c25b684bb3617b8daa3c49a915018a671e08b82c87919e28

Analysis

max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/10/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 1.3MB
Sample261022-2prxesvtex
SHA256 d598ccc0d0cfed31c25b684bb3617b8daa3c49a915018a671e08b82c87919e28
MD5 6b7a6b85ec78316af311322a60928d34
SHA1 f59fac2453fd3ecd0293261956a0cc2056eb9306
SHA512 b8e5ba5cdb1555c43847f2db630170ff9a110a29070137404882d8be66c422b0d79954bafec783b9752be7f8700d4849264e86af29534fe1b7190e3c52183ed8
SSDEEP 12288:t1ifGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:u/nQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1F95523297950F477D91709F51C92C5819B3F0D827FE5A38F7B88227E9B393D00AAA385
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4144	alg.exe
736	DiagnosticsHub.StandardCollector.Service.exe
4312	fxssvc.exe
2464	elevation_service.exe
4324	elevation_service.exe
4852	maintenanceservice.exe
1200	msdtc.exe
3724	OSE.EXE
4052	PerceptionSimulationService.exe
2412	perfhost.exe
1072	locator.exe
1608	SensorDataService.exe
4208	snmptrap.exe
4540	spectrum.exe
1360	ssh-agent.exe
4812	TieringEngineService.exe
3432	AgentService.exe
2236	vds.exe
2996	vssvc.exe
4536	wbengine.exe
3236	WmiApSrv.exe
4300	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f551f4d2862f6ed0.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104187\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104187\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003aba82527762dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad86b1537762dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000022f75e527762dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bbb8a1527762dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001843ab527762dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ba3eb527762dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd937b527762dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c07da6527762dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
736	DiagnosticsHub.StandardCollector.Service.exe
736	DiagnosticsHub.StandardCollector.Service.exe
736	DiagnosticsHub.StandardCollector.Service.exe
736	DiagnosticsHub.StandardCollector.Service.exe
736	DiagnosticsHub.StandardCollector.Service.exe
736	DiagnosticsHub.StandardCollector.Service.exe
2464	elevation_service.exe
2464	elevation_service.exe
2464	elevation_service.exe
2464	elevation_service.exe
2464	elevation_service.exe
2464	elevation_service.exe
2464	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2616	2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Token: SeAuditPrivilege	4312	fxssvc.exe
Token: SeDebugPrivilege	736	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2464	elevation_service.exe
Token: SeRestorePrivilege	4812	TieringEngineService.exe
Token: SeManageVolumePrivilege	4812	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3432	AgentService.exe
Token: SeBackupPrivilege	2996	vssvc.exe
Token: SeRestorePrivilege	2996	vssvc.exe
Token: SeAuditPrivilege	2996	vssvc.exe
Token: SeBackupPrivilege	4536	wbengine.exe
Token: SeRestorePrivilege	4536	wbengine.exe
Token: SeSecurityPrivilege	4536	wbengine.exe
Token: 33	4300	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4300	SearchIndexer.exe
Token: SeDebugPrivilege	2464	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 2332	4300	SearchIndexer.exe	118
PID 4300 wrote to memory of 1008	4300	SearchIndexer.exe	119

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2616

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4144

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4352

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4312

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4324

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4852

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1200

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3724

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4052

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2412

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1072

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1608

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4208

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4540

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4000

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4812

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3432

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2236

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2996

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4536

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3236

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2332
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 04357d539566b762e5ef832b4f5e7a657c0bf9711c12774da38aedb21d3c2d84
MD5 70a1c0b4d9c36394763bbd8199fc239d
SHA1 5cd9127978839d0cf20899f2651e18946493e5ca
SHA512 fcf6c2984055e8e73a1651621811ffcea38d0b02e33c9e4de530a939fc8766a3214a36110ea83ff88ac1f2caaf4ca7f3add02ee8b91ecd6dcce62e7ab6dabad4
SSDEEP 49152:Nb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnwQ/lFTjN4:T3q6HjB0Lm
TLSH
T115D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 40ae5f681547dc160551a8932314fa20eb462e5bd8c9a8fcbfa4918b6b905fd0
MD5 dd01ca3d54a492b6a58a13eeef4a65d9
SHA1 145287511fe78299ce61ed201fc58515963ba522
SHA512 5fc4b724d404e1a6154276164f43547e9569eff697e08a9f1bc87c7c0f0cac04b7d3e50efbab07e5e6569c1cf852b464085805351969357a03f25fcd4f4cece5
SSDEEP 12288:u1XLsswWkxy2lRq2czAbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:cXYfDtczALnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T12A65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 0773e54dc1a66884eeddfb6e571775be7a72621ac0415936adf7f1a660b92a2d
MD5 e01c3e971bcbb887910b77b8d2c4d120
SHA1 e6c9c65f0a0a078d3108da0060a640967105eb51
SHA512 1702cdbe837de02b78133183417914f22dd27dea4a43bc612350bbf5eddb59589cd076aeab550ba441e9a993aa29b4bec6f8fd8d2a748a6f79c84f2f5e4571aa
SSDEEP 24576:60Le5ji0hmxLrMOnQ/tbw/2Mkjy6Fr7g0oA:6Pji0AljQ/lFTjN4
TLSH
T103859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 75b4642a19d5a6ad5416b2c81ebf8cd52a264064bb662a96d4c6e17c05e72375
MD5 ac84c59e44c12f8d9b665f2fa57ee285
SHA1 e8e5b2d3b60ccfc8157121257c605791dd254c24
SHA512 a4591eaaefc7b739473c233fd0a16c94c0baaf25cfa3bb5b9c248bd231209250f3b9d018635f50d1983593d60ca27c99dd40d65c12849b56571b54738781555d
SSDEEP 24576:Ea7/ezSC6vUyD/aqgrvWE6q8wyuwnQ/tbw/2Mkjy6Fr7g0oW:z/ezSC6vUzPvxHjyXQ/lFTjN4
TLSH
T100755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6b905ef3fab84a57e90851a39b8c69eff6f50161a2ec15dd7fa7ae465a41cf1c
MD5 634316ca469be342eb725b0dd0054537
SHA1 b2b8127ef939ffcea3992f023c3fc80222e1eda1
SHA512 5b121f3d8a42fa7c0541dd604ba99019a42c56abd942ae0e0c766df2fb551bea7950c93a7c7566a89220ea0e04fd9e36516831332637c5213dc5bbf07a787aa0
SSDEEP 24576:EVbqPb88hv/l+6hnQ/tbw/2Mkjy6Fr7g0og:EVO88hXl+SQ/lFTjN4
TLSH
T100559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8fd129a562505764678354388659b88f51a256f49720eae69e52aa99e97bddae
MD5 d7b1dc98f9f1f7b5ee332dc6fa4e8949
SHA1 2a7344e89d8a0a64e2146bf4d33158e0fd0bb336
SHA512 ea4c9d160b717adc0c2612b142e4648320a2e936a41776b6f2fb5b085cc160a5dfff36f952b0cd95d5ada2e2b1aa5a35339604e8d10197feea655979cb134a7b
SSDEEP 12288:izqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:izqnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1975523696A24F897FF2B06B15C9284826B7B0EC1BFD4A74E7B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 97bbabb0d85a2ed9c04a189cf64a8b5ddf1380ee053b7b95526bce95e52865ea
MD5 12151a02ac2882fbef13f2e8a6fc35d3
SHA1 ae5569215905aed12158765a183fabc0d8077262
SHA512 63daae6c16d5eda30e49178e06d3d1d8330cbcc2943aedb750c3a9d5b3e97661f1194401fc098109cf0d8958b03b419e9ac8e98a1d6dc31447d13bc194872f3a
SSDEEP 12288:yeBNUbTVO86UZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:yJIUpnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1CE75CF3BAE28FCD2C27E4DB85A918640D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0875396ad9e309b5c5c4ba9101efc124404096516aac08e30dfab7edb2c3f43d
MD5 00dc820ad4e89ebc9f21a4e32880d9ac
SHA1 9d1a3a1932158f82f41d78b0ffbde9a19466ff68
SHA512 d40e95ddbb8e7d861e5bca0491db1fcd1ad0b524fd565e6b2d953b34969edce3f21a2881d1ddfdba3b1d02cb9b408cbd1115387513bf11e7bf8b2a87f21006a6
SSDEEP 49152:7QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THB:7QvGAdlCEL8c/yRNw5CTLm
TLSH
T1B3267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 caeded9c63d2c21ddf93778ed2669cdd6fe64bd73a990dac2fa9fc200a991b42
MD5 768066aeb1b608fbc625474f61a566a2
SHA1 6e6a7801e9c466f2d492180406081156f0725a27
SHA512 6b883dc6976ed4d35c89ee0e6fb31e7a67904bdb47b7c3f543a0821b964d9f771db00814b66dae2b2ca318941946080206bd8b18e37a35a093f905b2bfa90826
SSDEEP 12288:1AwSfxL/2Dc39DLLmt0LDQewsAjDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsga:WQewsAjznQ/tbw/2Mkjy6Fr7g0oc
TLSH
T11D75E031FE74E436C77F0DB21B22C706593D6A604FA11AC3E3A88A9D59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 808ec38a2e4d9b9f4a6ac086e65d52411c806f533d62d51f39a04ae29ee8f8f9
MD5 159d1479d5fd0891c8ca458d713f5ca8
SHA1 aab0eafd02cafef198cfc8330229328a40ad7d98
SHA512 3994eed1e74a201bcf360c71a998d74a1499db956f0118d49ad4534cfc14436bb50e4f766d5612c689f1df429c1c1066e1be92cc4e3047f899abb75d0401b5d8
SSDEEP 196608:iUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHgL:iUEtQevvqc2W1cpV2EI32
TLSH
T163474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b02f22f5bd2f8286b2406db1fa6732b06362d1926c81c5d7a65a6f54cb190a9e
MD5 659b69cac301e41cf0f8da5b678fffb1
SHA1 db4e446c540507020243eb071b56ab6d2b3362ad
SHA512 4280bc0f3d7672d26822e470b8eb3f3d901b4de5fc2337057531e33cdb39e8c5b16663bf644affbf214614eac677f377aebcb3099004041d5fc5e23176a99fa5
SSDEEP 49152:6CbRquA/m2yL5zQfFiV+XenmE3/zTQ/lFTjN4:PoqtVjnmXLm
TLSH
T13FD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e7ebcefc1f3fd2a377efee971063d4e963d059b77c5c46734f8e21514b3b7448
MD5 870632718fb19fa45d6e50e35cbbdf42
SHA1 212aa1959ce1b4e878e45c2ef054be681277e70f
SHA512 56ed6b18610e76fe8c7fad0d34fd31c55d937b2531a215191857e79aa4e431379986b9d6a6204b54903df9833fada56c3e337da60c9dd494551e4c92f8e9093e
SSDEEP 24576:jAhGLJIFoiwtA5l7S53EnQ/tbw/2Mkjy6Fr7g0ob:jAMyFoiq50Q/lFTjN4
TLSH
T1F535AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 eadab13527679a8a0adbd809f66230a260a656fb639883a04f2346de6ee0b547
MD5 bddf2e1098f3777d560a7b0c708b03ec
SHA1 38ae1d498e779efba1f8686cfbe1531d44e29307
SHA512 c5cadfb93b036ee487221046e3315974064396b5ed7ff7693be3c83702f0176b1ae580a06d44b5abae8633fe5f59c02fbdd674180233ba57dc5b4830787fb40d
SSDEEP 12288:Qmw5HEjsChN2BFgl0WDm+CaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMJ:NwuHOWNnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T13E65F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 60ecb85450951312034ff316089827a88a69d2fe734f2f98b24ab7a243eada2f
MD5 f669fe9561db1876ba78ec4e7ac834b0
SHA1 af6563575aac11f58724d6b8f62e7ef0ad743059
SHA512 2dd896e55f855dab1d22c9ff1384667723df03070485bc81baf6ee0b415a330de3ade94b7e5aaccb99938c0940ebb3b8641afa1fe7e84b4b53b19492d65b1681
SSDEEP 12288:kXZ1IyTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:kZu2nQ/tbw/2Mkjy6Fr7g0oS
TLSH
T11B55126933A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 919f009b8467017933db25929ba124fbc3ce823152c349391f66accfeb4b4c9f
MD5 d6bed5f2fe3de7bf5164634763cd48a9
SHA1 8bfdc284b41edc217953ad080cbe1314064f952e
SHA512 0e86fd728a5ee8e3043cfcaa8b4fdfa56f9176ae197e33454caf046966cc8b97da79baffdf76bf3733609f25a68eea81588ef8d63035bbd18c0182f0bc558bba
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UF:LQRQyi36YOcPQLvw2gAf+PN3SLm
TLSH
T149666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6ab3a2f6f65d21a18c7239a3a942f08d103f77c5c30c94dea7f3a947db58e4fe
MD5 8176274750e1d157936454d91d25dfce
SHA1 3db86d1ac2eae11c562827e29559b2db177ff37b
SHA512 10a5f4ee64d0d88f5b0b2ed75377512ce2aa1e7592b062a271b06020f30c8e099bd5d43646a018fb72d1644f17fa1d6884f711c577203114ad88ebe31bad8cde
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UF:YQRQyi36YOcPQLvw2gAf+PN3SLm
TLSH
T1AA666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f64129e54a8bbd5e14583b5af765934813669e5cd2b58495576203cf7db8a23c
MD5 6e31b6321f993e76f2e50d582c06a335
SHA1 ea97738b14426f0663259350cbf05dc6eca43029
SHA512 b55a6fae86608d6c03f0dcde4515cf8eefd251bf131ee0115c53f701006951e3bfcea8c50ea98876bf86bbf030a10413ff3743f8f763a61b64dea39dd838ab95
SSDEEP 24576:ewvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0mnQ/tbw/2Mkjy62:o68Qg55nhheWu7PNU3/jQ/lFTjN4
TLSH
T1B8B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8d43a3c253e07353bdddcd5bd6c36eee9f5b7645a42e285e41ab121c4fb6030a
MD5 a64e9952c2a18634ba819ee343ffea38
SHA1 3e99af9906433f34990b54735ff4d1f2cb975477
SHA512 9df7be8a5fd86c9a06cd34b8ec60eb0347d4274509b53743da2ac3f686e9479e58916a002759a9bd111e4e98fdb1fcc50d804f187065570866a985ee07d8b50b
SSDEEP 49152:53aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99L:oy5112gYy5azzVvL69nLKnhZlLm
TLSH
T15E167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8565c9229ae39995fdae882c9e90899f8f2e5efbcc6490a555cb5c2812d81b43
MD5 63872b20833b160e7e465cc6b1180165
SHA1 6c886993ce76af45ee2cc3dbc8382d6139f3100d
SHA512 fe43d9eee75be5c233498974200c08be79d15d7444d3a72a50c322410859c4d01cc9315cab62d10fb6bbd8e933b5220b627e6fa613088c63759ffe1479be2d0b
SSDEEP 49152:6B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glbQ/lFTjN4:ou6JmVxd2dQLm
TLSH
T1DCD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6a4f74bc011924ca7c1dcb8a2a71def1e92984eebc778c4388418ffbbb7ce3cf
MD5 c36c2fd07bef13c7bb37142c4f5236f7
SHA1 b627d00921acf5c2df186a62671e7fb8f3c67257
SHA512 7c67060e71fb5b59ce5caac4c8eacdd5246b612597a77fb71cfbedfc3e50edc4cf5a9d41ff67e904f1df3d207930f9dfaed89089ed14ca190149a608d4bc854f
SSDEEP 49152:d1hpsNoJpF1A6UU44CwH7R4xJQ/lFTjN4:dmifPbRXLm
TLSH
T1BBB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5428fc8150f53121e6ca73b2b971da29a13673ee3a4ac1dcfdc22102aac31f94
MD5 5f2736c0931d299eb045d511552d7917
SHA1 7f57ba78477f2b25049ca04be225000b8eda85ae
SHA512 418aabaadb22378c606152799205faa08724903e09768b22d1354eabf9a3cb878fe038ab0345df700d113d78851db990b3e481f312948256b292647d5aa67f4d
SSDEEP 49152:kSuZQIY0Be2KRRVtOnks6NMHq2Q/lFTjN4:25dKTi61BLm
TLSH
T18FC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f9084493edf337100db93359d7de4fe0f950cb97414ff772c0808fefc9569a54
MD5 4420191f086078c88f7559a91ae381e0
SHA1 0edd97295e31b5993fb0525ef0523757816631a5
SHA512 a25efa2cb999557addb8c5fdf5f79bd10eb83487f3a25c1d78d2630ac50a1a44bed0f1a22de690b72e7d243a3a9b823479935b3611c2e03a5ed865f06ae87063
SSDEEP 49152:ThtSn8EApI0figngiDn0AP5w1Q/lFTjN4:SX2iyphbLm
TLSH
T16495BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1ff46dac63f1913ac6650cdd9c9d1a85b27adeda7dfebd94c6d6378856a5fc51
MD5 b11c683a54e110b4d06ecb6e7e98316f
SHA1 c8adc552d257f5bbf0ec66667493a5f3c1920fcc
SHA512 f32ea723a2c944d15a0e03f20472505d81126a9474ad06bb9fec3d0875d6eb7f64d09e193db71b7b5897ed665b137fe42cf7bef79558eb4e2e9de8b254193cf1
SSDEEP 12288:2SGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:2SnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1A85523697965F98BFA1706F18C828182A73F0DC6BFD1A38F77482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 2d80d51116d2a0138c52b39d409524ee2667c164143a0338163ddc760b180031
MD5 5283283bf9e887e1b27ce97de97b3574
SHA1 99041a8b2c066eef178cf01741aee102b67a7ef6
SHA512 a4e416858bd1d9d900bb530677f4f07bae7321791169396d9809466a4ebb7b8749d09fee3814e503b9b9fb75ac92e92d235ef7bd6c220404001b1bfca570a423
SSDEEP 12288:BPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:BvnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T16D5523697965F98BFA1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 461c2f0fd1b14d5267f057a0390fa7ea38714d69ec576aed9844a07aa43fb2dd
MD5 2c2056098ebbad3ecac769b6523cc514
SHA1 aa3f69b717a2b4b8044c71d6c2505e32df992bf6
SHA512 b954a534ab029c9d2e63558ddd9cc71bacbefb118795639f188eaac18f28aafc9f9aa73549cdbac938f1e974414d697946a3ee388575b25e6c8f04d6f46fa574
SSDEEP 12288:NBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:NRnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1D45523697965F98BFA1706F14C8381829B3B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 61d369582843eeb631c9423376d7f407cce992bf6084594d7f38616cd525c59d
MD5 69c2f1b2cf5d1eeae016fedf5939541e
SHA1 64cfd08ef792f13bb29b11a616a634f7aaec6bc4
SHA512 3ce7d9163e39a7a32d94fad1bdbdee24bd30106469db816a261a53f1e83fd48211b2a4f561532760a6a35020cc15852e171cb91d9e5caac87f3ae9dc772c1a7e
SSDEEP 12288:9VEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:MnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T10C5523693769F4C7F92742B5CC928142E77B3DC2BBA1A3CF6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a833476c5ea46117af6b8965d98fb00d1aa4358ce1b65203ec8a115c3436d5ac
MD5 965709bbda680af010dee4d927441b85
SHA1 55978e9cbc52f1e9b2bd8ca0a0a1c165cb52d66a
SHA512 8d506eb779746e070e7cb72ab764a92937e8ef157c9229309560b54f3be583823d049804e31860032ba30753b21bca7e41fbb66529d6ca28cb27f1d9067668ef
SSDEEP 12288:WcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:WcnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1AB5523697965F98BFA1706F14C828182AB3B0DC7BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 483a1eeae5abc7563b2949a372aabbbf176f6c40b07075ddb0c6b8c8b6e6bc15
MD5 0b98c4bdb87fb8848b539fd2be676d86
SHA1 eddc7cd78ffaeede0bab59be1b4072189379d9e5
SHA512 11cd0211d607fbebb5d424f924fc91e80014e5b6a31f58abad091d981112eb1e6f3cc00df8b3663ea36fe98be9aaaf4e8ca51f7782bc6481dcc8105f5ecd67a2
SSDEEP 12288:GLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:G7nQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1E55523697965F98BFB2706F14C828182973B0EC7BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f4391d44740a9cfdde93a4aefa07256535f64f1928433ec8c6b9912aec200c85
MD5 6194deadba7190ae2226865ce31ea2eb
SHA1 8e3e864a162119651377904281cb9b2bf46bdd10
SHA512 0b891ab0ebb104781d8d00e0e6e4a1185ae6aaa5dc1b4e71897c10fa88e88b52a0b8494ad3675dbb1a4d7cc44c529350f43f3a9632cef2b46d17bf9542edcf85
SSDEEP 12288:xHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:xnnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T18D5523697965F98BFB2706F14C828182973F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 baf61e612390b7e1104e36e8c7dd86217cad476b4140e662c12baa84ea2efb99
MD5 b54a1d8748c5d7fcb0e2f3aa8b2c69b9
SHA1 e135677960e2e0ab8179a624a3d46780aa58c6f5
SHA512 f25c50f5cae8935a3f0bf045d980a34f74e7f5e51cbd0f0eea6fa0fe8e203cc5931a8caa09b39653c83b7735f85cb888508d59f9b231a55788b92e37fe3aa74b
SSDEEP 12288:kiZwbDzzFEoS2cPvyvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:HZM3zFVSOPnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1C67501A5B39058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0cd29f8a42854e5bce1fcece53b2c7963810ed7632f9f5188719e1ba62e2eab8
MD5 8e8d1754f665eff3a6699b5e7a922b07
SHA1 8bfde95f57fb98faa0eaecf671143828f73086ad
SHA512 e29bbd02ba992f8e520074a6eb309aad7691aa21bf3e3add655d2097fc00c96f23a3efc86adecff4350ea9096996b72d8aa7da0716bf8e9ebea4e7ecfccc966a
SSDEEP 12288:QmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:QGnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1605523697965F98BFA1706F5488281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c53ef2016861872b4453cd9582fa027184da5a39a185aaadfcaba756f10775af
MD5 c7028d622e183e599904ce69c3789657
SHA1 30f83825e4268e8a2322c1a7a4858b0dd8d5e9c1
SHA512 fe3704f4aa759c174234b1c629a28da1dc1278add3a680f29473fe166ed78ff7c3549c61e956ae653ab46146b85784dcd7e452d6cccf435ee06ba17d75bb4ddb
SSDEEP 12288:X6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:X6nQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1D35523697964F98BFA1706F14C8281829B3F0EC6BFD1A38F7B4C1129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 06975c4c2f6469f9b01dd82d21e0da700a53a0803510960ff2449397b30466d1
MD5 f73d7da0a03c137b0e2bb7785942a0a4
SHA1 0398435c6e03a9cc2b2f5a7639db06e71974490a
SHA512 44d7a5c3e1ccd538d8485b07369fa9f347e57903c45b37806a218ed7ca687720b142a86cc955c601ef8d85e0958e4db00313edee26ceb355734e3d65e4297cb1
SSDEEP 12288:syPz5L8TGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:1zyDnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T11765021773A570FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 0e6994d75d8548a9eb75d97e75ddffbd110f1e62bc45787fec36cdc65d5f7f6e
MD5 084ff486ab78235f6440c6a6ff5a3f99
SHA1 d0fcba12c201bda4f62bcdbbdb1b8c4b653edc06
SHA512 7907219aab051833063c1b31a71c151cd5e970a03916d2ea395832105f50d0946a49da9a09bf42509c0dbb152e2ced5e94eeb61b7c8c71597f9aeb703e5a638e
SSDEEP 12288:4mGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:4GnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1045523697965F98BFA1706F5488281829B3F0EC6BFD1A38F7B4C1128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4b09f862fd1eea35bd267544237451221a82317bd7b7e75a62e0ae21ad5ced83
MD5 74c219fef89bf433802de1eaefc2b7e4
SHA1 cbf57a298e619b44a4f15a8ef0a1266179632f07
SHA512 c9a93e5614fdaa4978d8b55d3e6ed2feb650f8737ae71227920bf93f2468eca78ab4b9b4e4ab6b7e24547cb853be9424fc79f3805a14caeaf20af852ee357341
SSDEEP 12288:LmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:LGnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1E65523697965F88BFA1706F5488281829B3F0EC7BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 832edb6ea1a5c475173f66a58ea2c373681856447d3961af6cc1b92e5d14e9ca
MD5 e0cbc397c2e46e19ff551a4d529efc3b
SHA1 a5da92d05062de8b1265cdf9f4ebdecfcc696126
SHA512 c9ec1dfc3ca78556a1fb75baa241ad3db2e2c61716cbbe33c991dd0f41e007fbc5145b3a99240dbd13675cb1e2a019dab700f5d80597003bc0ef2b29e8a762af
SSDEEP 12288:UyPz5L8TGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:NzyDnQ/tbw/2Mkjy6Fr7g0op
TLSH
T13D65021773A570FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 45e3d4bc991df75d7662af80058a941bef121a62de38a6d8dd0755859a7fdf84
MD5 0df26975eb8f4bd5ebd791ff9ce1e1a3
SHA1 5460f8e54bb8dafbdde4bef6bccaf6ad1c4eec00
SHA512 f0f04087f5d4d92cb9105c622269f74b177b5e1cc47f9a0cff4d1e609a4f272f491847be3b1300b0ab2fc8e608d8f9b83d1fa66ee08660aa0d15af7d5f6070cc
SSDEEP 24576:JT0aLl3z0zDBnQ/tbw/2Mkjy6Fr7g0oA:JTDLljwQ/lFTjN4
TLSH
T1387501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 703bd201856379ecec78207bd5d9bc5943892d0695712239f945398e502b0ffd
MD5 721c99e94f7489c271919a0bbc96856b
SHA1 03e421b3181c20b7cfbe314b1f466e48a137cdef
SHA512 a2ec0891c4c723e6e9cd184ba26c23fb2f70d2bebfb8f4a0fe5621a363d533fb29f5817375b1ec87deef0892f5048ae41c7457540c7b77729f05b9bb33042662
SSDEEP 24576:931d9CHKy7GZ9nQ/tbw/2Mkjy6Fr7g0oi:d1d9CHKyaLQ/lFTjN4
TLSH
T19E85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 996b63534e776deaad21942d0a2fa2e8e76363733eb1a25c6a3ed8f09f205bbe
MD5 216a4dfff49e11bebf2ebb70f8e40557
SHA1 6e58c4bd6e7c4fdab4e5437649cd45422976f2ea
SHA512 9c6ea3f6c0f237d65032bcb6fa486c363387782eec738d0b61cd1ed99ef57cb26bf502e4b7a1b83b2ade6796503b327ccb6e8888af29d82d3fc9bfc406f80122
SSDEEP 12288:PhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:PxnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T11C5523697965F98BFA1706F14C8281829B3F0DC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 21dcdd1385e25b4567db082ea3d9c9e3f7a1cbed8e64e232031f14a604305d85
MD5 bcdc9814df8e59d69810ac9cf69983bf
SHA1 b48d9ba2452364cb8576a70e48cc72bf6ff9db0b
SHA512 a534b0e94bd1d5c3322aefb623b149c0cd8ad4511adf7c9462f69447ef2406ef927bb5b07798de42888f36277600479f33edfd9bb958e7679d5f05aba3d6f0c0
SSDEEP 12288:nzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:njnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1825523787964F99BFA1B06F14C828182AB3F0EC6BFD1938F7B481129967D39406D67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 d40fe01035ddd90c5ccfc6af97150efd5732d6d83dab3a3b2e3d484f1f93e4ed
MD5 f9cfca646b06d8d8a55f136f49eb4d0b
SHA1 dd00ee725943fcb8d48d8eec4a8d9523d3f857ae
SHA512 dfc925203751a863ce41ae443a1b9443e040ccdc3afeb799125cb09b42b0f1e5f43ce0306060c30fab4cc4ff6a29e222335fec747e5a937a9a3eb678319de6a5
SSDEEP 12288:SssfWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:E2nQ/tbw/2Mkjy6Fr7g0oz
TLSH
T18865F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 d25c7d7e5a77120f9898640138409158d066719d24eedb60885a585c19012caa
MD5 28389301b475f94c8984690f2adff63f
SHA1 2535fdf05231466bd09925d363f46ab677829aac
SHA512 ce43ed8c3ab140cec17cc5d16182f2e9229f17c298a02c20705c664661da7d81bd3544c906c4a72cfd725ad4e6699740438e8624d106b712b16554a899e8e39a
SSDEEP 12288:+zGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:+jnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T10C552369A668F94BFA3B06B05892C151673F0EC5BF90D38FBB08222D957C3D01EA6745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 e61635eaeddcfce3a3831c2297aa906f0c5ca8256787c411b13e64131cbf8218
MD5 2af09a5b2a13497bc0a5ce7ba010f3c0
SHA1 28b870926568b838465879e4b906cef463e47254
SHA512 1951013edf1b9901be6bbcc7ec06babff553205e0650e8a454bb47cfd43f518078cac1d99c3553542685ae511ac2ccbd54aafd82821d8ef828568264035b1f6a
SSDEEP 49152:6a0h2GEkuAe73q3pp46zwwQ1Q/lFTjN4:6a0hNYG4Jw1Lm
TLSH
T128859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 cc8f4a31980e380b41763b32a552f69d2721ea2fc26f6875aacf6520bdd89b1f
MD5 1c5e20184692051acddda5bb4d6dced1
SHA1 f18b56a290db9b166933a0ceba8dc0f2cf55e6e7
SHA512 749c059d35bce8f7befd291a4236b60b6f68a0dda5a761933ecc6ed252151b28a824871816c6086cdab55c1e19d198d689343dc4ab4570b807e6668e411e6b12
SSDEEP 12288:qhbHjfX1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:qhbHjPVnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1AA55027D26AC20DAF63692BD88928546D7327C552B11A3DF2385423D4F3BBE40D7AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 05500996f969d3463f5098c2ff3d16a95dcd9a033cab80cf89918662260f74db
MD5 da3c8055ae464a590462e1ebb9befab5
SHA1 2fc54808cbffb8efab77a16b01b7ed37bd06112b
SHA512 1c255f43f508d694d09c73c1baccd3590e8091d206d0b013db74a8c4d5ef4b6f4ff5a9da3991583317da51279b38cad1a56d904bfb44b9fea4562bd8ee5cf8bc
SSDEEP 24576:33YgnJcRTk4yti+R5dBR/NnQ/tbw/2Mkjy6Fr7g0oW:3IgnaTk46pBR/NQ/lFTjN4
TLSH
T1DE45BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 55f535fa1b609b087b15bdc6e44f0c342b2f7357db04408d513bcf70ab8517c1
MD5 6116fdf77e8fccc5525b28e1e09a0c4d
SHA1 32a1c5af05f9a576ed845b83717bc66d8a9a8048
SHA512 54d4ccd5fec96bbee4d57192742c868db608e4c0736269c560c9d822ef0aa4409c04b5a0586871c58c8569f253ca8613ffe9145cf6112659e863b90adb928180
SSDEEP 12288:2HGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:2nnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1A85523687614F98BFA2706F54C838546673B0EC17F92A3CF7B482129967D3E41AF6780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 7c0597275e38ad311937595681758b3efe4f3f0f41193053866de0b9160b5837
MD5 46ffe44b86bd190cdf42fdfa5db23c8d
SHA1 39c4da1c09a2577a69f5041fa1885a30bb3b3727
SHA512 3c31c86f6a75675f84202945638619ff47304d8357c5602b5f1d3a2f6fb6561f323be84546dee751c9ec7879697a2dce219875ed15d645a5bd8208582c92107a
SSDEEP 12288:VOb4A4LWOsvAYFTAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:SwL3UTgnQ/tbw/2Mkjy6Fr7g0og
TLSH
T15C75F155F7A450F9E92B813CC8A28616E772789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 72cff467b2dbbac341b9ab8783f2a8407d86cdc448f1a30503fdd54c8f10b1ca
MD5 ee3269068a0713ef308abaa7cd70485c
SHA1 ffa92ca3c7cf3830179019d10aa07bee9ca85c74
SHA512 305585aca6544d09a213f8a884fa36f98a45ac516a8d7687e02ff98034270543c3e916583a585deefb7b20c463d584b4dea237cd50fd6a3bc423d8b7a013a624
SSDEEP 12288:ApFtCO3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:pOXnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T16455022D36EC60E6E536527C89838209D37278961B6253DF0780817E5F7BBF81C7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9137590817947273155ee19865efd3cfcf59e7e72ecf9bc89cf97091c684a45d
MD5 2cf30088159d0730c25538676d6d0a02
SHA1 311dd63b552f18bdc156940893e667087c0180c4
SHA512 4601c623dd6feb59c898e2b9e55647dca07503dc6c5e4aca274c57aac4c3ee1de98d97b9588c670fd84e832b462633167b89d90a37f0b262999c2dfc03323516
SSDEEP 24576:37NM9YqZqmWMUkPjZM48Mv6bEhsTnQ/tbw/2Mkjy6Fr7g0oH:37cBWMpPjN8DbEhOQ/lFTjN4
TLSH
T1BC659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 2edf4c60bfb292f563a42309f3416cd70b93e55d3051e3967d4d6d82b0d161f1
MD5 cc2daa1890cc9f58f11ca1a1cf6b3fc8
SHA1 2f8ac444e9d4664116fd68b9d110a0519218ab6c
SHA512 aefb2c5b14da11a05e7e91d75e7ff35d4cfca161866accfe26d06acc77bccb915dd3bd3321ef9e2f8600170478c1c250b9d632ce1391f0e32e95f869c943c581
SSDEEP 24576:pW6BApg2YuyuNDYTabvcdvNYf8km1xnQ/tbw/2Mkjy6Fr7g0oZ:pF2YuHNETovAvNYf8kmzQ/lFTjN4
TLSH
T1AA857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 869a359665322b41667d191fb4627bd12671f4826d2f8b2dbda9ab8e6b96dbc5
MD5 dbac7a742bc5e53d4a0195cbefb4f8e9
SHA1 2f4a48cfb4a43962aae893d68a0989214379d978
SHA512 b1fd37ecfb1633b4e266f5fda8b5cd66fbc5e1a0e7188923142389ca9d4c4d6211e6a5634012e893c1a9ffbf61bcdf6983511b3dd78738fae073d0ceaf9984d1
SSDEEP 24576:bAFs06+Omlf3NXEbToYnQ/tbw/2Mkjy6Fr7g0oc:UFs060lVXuVQ/lFTjN4
TLSH
T11B65AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 40396777a09cde57bfb4e6614609adc85940670839453b376712c8b2669d0706
MD5 8899abf10b2680136f2466f6ba75d981
SHA1 41255bf6c86d185e4edb5fa388009c731fc43fac
SHA512 1397880e624fbacb9103bff5b6ebb08b8a591fc0f2ccd895dc306af60d6bdd799a88ee060a87712786383e0868c3f9cba79dd2eb4c08e6c1d5e554e9df3a8f91
SSDEEP 12288:pCJnJ5D3VkrqzxDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:AJnJ5D3WaVnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1D075D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 aeb276c5da41b1bf242644e4465ed206872164386140068c6ab7f7c703e95a05
MD5 576a0f477115777593de1a8ecdcfdd7b
SHA1 ea1f07fe49977fcc1655e284b5cc5d2347abdb2e
SHA512 7eff6bea8a5b10cc99af155a5c18c8fc986d0b9f3dc121a4a4a5af35cd43afea83acc77f8fef64fc5a80360380a87a842dc10aca2a1b792f365193a3e9549bbc
SSDEEP 24576:KEPghm6/7IIXdwcXrif7qQncjlP65i3VuWnQ/tbw/2Mkjy6Fr7g0or:dg06DIKdwc+eQnSt65aVfQ/lFTjN4
TLSH
T105955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 bc1be47c6bf3c8cab9fbd24c8d65c0af8734058b4a7242072b9097b588156b47
MD5 02451efefc3282c9ac074592ffa96e38
SHA1 4e67f9d3ac5206bc294491a620a143e767710ca2
SHA512 68a631cbff90a4f4517ed9db8140600e1ca823bade298cc2a59b73f2ad6ae3cada5d1143f3bf9d57fd4c9858c25b52fcf86482f67c74c69fa4debaf5be40e3af
SSDEEP 12288:nEP3RSaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:sSanQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T19255126D37ACB0EAE52A517D84918145D373F4A16B5267EF2680823D8F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 f112aea0e2cbb6a3de3038d9d9e188586ce49d7d31c1d341a4179b5d32b4924a
MD5 dcf0d2e461abc031a5640a2445895cbc
SHA1 d0630f1e1a1a0ebb5b2026aeb61040f9420f6592
SHA512 074b0923aa013d4a30065816f9b2f0a47eca11782949a0fe1b4a51c3a64fbd9f50b92cb0af571e74911db0e45e3d5522681c8803f53a754f5daa4ebeac0ad728
SSDEEP 12288:ajkylGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:aIyFnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T19B6512186398F4C6FA7A06788DA381919B367C506F2193DF6280F23EAF3A3D45D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 d499ac23ace9ea434f2118fa35c9fffd6475b51a2420229b4b427c139d81e7a4
MD5 061ef79863f539683df13908ebcc918b
SHA1 fae54061dcf93daf5958565f28336c2e11ac1bb8
SHA512 5cac9071adfe0a72bc50e6a210142301e90814f1b2fd8b90bfcf86524ff6044619b2c1d297ffa3c261ca2d55fa11162c853a8191cce803864b4516e2dee3dfc1
SSDEEP 12288:o0UGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:T0nQ/tbw/2Mkjy6Fr7g0or
TLSH
T17155236C2625F89BFE2706F448928582973B09C17F9167EF36846239CB7D3D416F6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 baeab835c189330df258d81f8862234e4e8ba33164eacb540fad0e54420fea15
MD5 dc3a1475647f3ad7851b72de910b82b7
SHA1 43c773ae5253ea2e49efa9b64af78cd95cd5f984
SHA512 c2a4988c95229be55b0da5983f9a22dc5a1fdb085e73f3ddd9f16f0593fd31e624a83985d03d78be47464026cbd0b5858b56ed9920412a09ae3788436c37731d
SSDEEP 24576:ZQ9MxZKdcz9dw3rnQ/tbw/2Mkjy6Fr7g0oM:ZVKZrQ/lFTjN4
TLSH
T154558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 1674a09f54e80fafcc1b55921c1ca3760f01d07b5ee759ef8115d047d89b70a0
MD5 bac485940333f106e01999f1b0df7778
SHA1 7f6d4262fdd0cb69a1e854bc2b14b200fe276a2c
SHA512 7a6cf51d38f735f0e1158a14a47a6cfc399d00414a33b6247440e35325e00035078ba4c8951032bcac3e3d2551aef2435a65ddce0c263b09d37da48f356beb88
SSDEEP 12288:GyoKo20Rple9pSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:GyocSApSnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1FB65E01FBB6990A2E176813C88818745E773B4706B6263CB6681C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 8d61777e165aa9c455aa6c3341dd09119e2fe437df1e981ece918fbc1667cc35
MD5 6cfbde8032c83e3d25bc2f35ccd92887
SHA1 3167408d789e35b65bc6ec7a80bae05d58ba4f3b
SHA512 f595593ec03fd9d74f23040bfa8f9dd1594e76455b54b980bd09a77db52312840a63791ac861d5658a53d01aa92500000febcebd923a53a1c553e4edd1555c9b
SSDEEP 49152:fWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKSQ/lFTjN4:H0zuNIzLm
TLSH
T1C1A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 35029dac33fb0eb6e0f7b6fb1667a63ddcb0b43eceb300efa21f4716ad761f7f
MD5 1c8fc49d2aba2dca22ddb3cf029e12ab
SHA1 401c89d87b57806d4fd616e67a1c863464fd77c7
SHA512 003ebe0595928fc0130a8840272a91d7137873a42a0d6a8a838f003ce9b07af1a73bb9937b29f1dd6992257edfc2680070fb27067726a284a15df9ff5a33c87b
SSDEEP 24576:z1QT7EcpfxR+N5AWAz3ooiYtjMqbanQ/tbw/2Mkjy6Fr7g0ol:uTDxR+N5YzTfjM3Q/lFTjN4
TLSH
T1A755B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 1355aeb897d93b0052d7c9efb9365d8601b310a2fe1ec6c66e98f992bc2ccad3
MD5 ffb4fd093861ebdacc6f2fdd3aeed8fd
SHA1 850be5049cb6331233162d70cc4e5590841a996d
SHA512 620c9ffd96451be47c4e0f61a59d42205939dc7ab7a84ee1c100b640917a007df32afe9eefe0fae57ed5fcf413781a23085c36573e39f934a1fe59cf94ba5084
SSDEEP 12288:H4TbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:iLnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1C955122D23E8B4DAF93352B48962414697327CA2276167FF36C4C63E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/736-25-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/736-16-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/736-22-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/1008-437-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-448-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-426-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-423-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-420-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-415-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-416-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-417-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-446-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-433-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-445-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-418-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-419-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-414-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-444-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-429-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-443-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-428-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-425-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-447-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-424-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-449-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-450-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-421-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-422-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-442-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-451-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-452-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-441-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-453-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-440-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-439-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-454-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-438-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-427-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-436-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-435-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-434-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-455-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1008-432-0x000001773BE00000-0x000001773BE10000-memory.dmp

Download

memory/1072-275-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/1072-325-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/1200-255-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/1200-70-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/1360-407-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1360-304-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1360-297-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1360-298-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1608-406-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1608-338-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1608-280-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2236-314-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2236-431-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2412-320-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2412-270-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/2412-272-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2412-265-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/2464-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2464-37-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2464-31-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2464-253-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2616-8-0x0000000002280000-0x00000000022E6000-memory.dmp

Download

memory/2616-1-0x0000000002280000-0x00000000022E6000-memory.dmp

Download

memory/2616-0-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/2616-104-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/2616-69-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/2996-480-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2996-317-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3236-482-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/3236-326-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/3432-430-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3432-312-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3724-256-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3724-74-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3724-80-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3724-83-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4052-257-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4052-97-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4052-95-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/4052-89-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/4144-12-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4144-88-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/4208-282-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/4208-402-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/4300-411-0x000000000C970000-0x000000000C978000-memory.dmp

Download

memory/4300-368-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4300-483-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4300-384-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4300-400-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4300-339-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4312-52-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4312-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4324-42-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4324-48-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4324-254-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4324-50-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4536-481-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4536-321-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4540-291-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4540-405-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4540-293-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4540-285-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4812-308-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/4812-413-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/4852-60-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/4852-62-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4852-65-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/4852-67-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4852-54-0x0000000001510000-0x0000000001570000-memory.dmp

Download