844287807b4db03c5db77d6d4d0f8b00773f055bdcb89408c1d9d8ff27e7c3dc

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/10/2026, 20:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
Size 1.5MB
Sample261022-ythb1atxdz
SHA256 844287807b4db03c5db77d6d4d0f8b00773f055bdcb89408c1d9d8ff27e7c3dc
MD5 7d99c9991e2d9486064fc2317d7bcc1d
SHA1 c170914e49b37fca2f8ede682a9d7d5a453361e3
SHA512 f3d7bd7adab3e182617de97a1a0e062f06a73983a305c8eb19f09cd3f2c766acc5ff8f4db6fda35909233361d532c65bfc7a9d9548b70b403de5f64ae4e974a8
SSDEEP 24576:paArVXsMvxub8IIR6i7KlaadbU0IOW0weCvx0ltZbfnQ/tbw/2Mkjy6Fr7g0oB:paC8GxubdNNVdb9IPKfQ/lFTjN4
TLSH
T197651212BAE8912AF1B38F3118745766B07B7CA0DF3A9B6E1B8021AD1D31550DE70B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5116	alg.exe
2292	DiagnosticsHub.StandardCollector.Service.exe
1412	fxssvc.exe
3316	elevation_service.exe
5060	elevation_service.exe
2584	maintenanceservice.exe
1128	msdtc.exe
3824	OSE.EXE
2320	PerceptionSimulationService.exe
1748	perfhost.exe
3304	locator.exe
4392	SensorDataService.exe
3248	snmptrap.exe
3816	spectrum.exe
4056	ssh-agent.exe
1284	TieringEngineService.exe
4760	AgentService.exe
3984	vds.exe
1472	vssvc.exe
2316	wbengine.exe
1580	WmiApSrv.exe
4616	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\515a6cd2a26b1277.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1104-0-0x0000000000400000-0x000000000057C000-memory.dmp	upx
behavioral1/memory/1104-78-0x0000000000400000-0x000000000057C000-memory.dmp	upx
behavioral1/memory/1104-121-0x0000000000400000-0x000000000057C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d7b6a0cb6062dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005804cecb6062dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000793683cc6062dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f54312cd6062dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d18c2cb6062dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2292	DiagnosticsHub.StandardCollector.Service.exe
2292	DiagnosticsHub.StandardCollector.Service.exe
2292	DiagnosticsHub.StandardCollector.Service.exe
2292	DiagnosticsHub.StandardCollector.Service.exe
2292	DiagnosticsHub.StandardCollector.Service.exe
2292	DiagnosticsHub.StandardCollector.Service.exe
3316	elevation_service.exe
3316	elevation_service.exe
3316	elevation_service.exe
3316	elevation_service.exe
3316	elevation_service.exe
3316	elevation_service.exe
3316	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1104	2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
Token: SeAuditPrivilege	1412	fxssvc.exe
Token: SeDebugPrivilege	2292	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	3316	elevation_service.exe
Token: SeRestorePrivilege	1284	TieringEngineService.exe
Token: SeManageVolumePrivilege	1284	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4760	AgentService.exe
Token: SeBackupPrivilege	1472	vssvc.exe
Token: SeRestorePrivilege	1472	vssvc.exe
Token: SeAuditPrivilege	1472	vssvc.exe
Token: SeBackupPrivilege	2316	wbengine.exe
Token: SeRestorePrivilege	2316	wbengine.exe
Token: SeSecurityPrivilege	2316	wbengine.exe
Token: 33	4616	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4616	SearchIndexer.exe
Token: SeDebugPrivilege	3316	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 3664	4616	SearchIndexer.exe	120
PID 4616 wrote to memory of 3876	4616	SearchIndexer.exe	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-21_7d99c9991e2d9486064fc2317d7bcc1d_amadey_elex_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1104

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5116

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2292

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:552

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1412

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5060

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2584

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1128

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3824

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2320

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1748

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3304

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4392

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3248

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3816

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3340

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1284

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4760

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3984

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1472

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2316

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1580

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3664
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 79a51d557a229de9c3c1e9eb34e498cda0a8138ae94538500ca84d2272eaa3b5
MD5 5c66e26dbfd757f14b391a687b424dc0
SHA1 7820d3562c9c75f214f826760b42ca980e7d0e6d
SHA512 dbe67f332177d06d1aeaf5650175be1108f20dba9d55bc9f0d4922b412548ac00a4394112418c94ee83cb16080bf9df9cd17d0581e5fba9780a7fd6fe2af58fc
SSDEEP 49152:/b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnrQ/lFTjN4:93q6HjBzLm
TLSH
T1B5D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 59905043a94174d609714f785224a8cf11d2dafe57213a4b2beeafe5a70d7da2
MD5 dccee8f83e53a6700a80430fb9aec8e8
SHA1 89692b73f13cd70eeeda2769aeb4e0df8696dd16
SHA512 d0489d181fde56c4443899cc724c1afaa60acceda5b0493d7b784d39b8896b8ac00666301b54e14d8103d27edc5e8c243ebdd246c82887c28fa60d7962d48084
SSDEEP 12288:M1XLsswWkxy2lRq2czA0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:6XYfDtczAUnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1F865F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 d0d962fa7f3549ac7f76d0e966cd653b5585189c8c5bc766cae194df4928125e
MD5 2c9b5be96246da216727d5e9c2610e72
SHA1 a1f8134038f8d7b57d4d01eb3029199eee82f387
SHA512 afe1375aff8276114f509ea198e2ba8c8abfa7628d961582b274ad0ed4c3a9473871c6b62546a12d465fef241ff96cc4f8df9015e275de5a7a04eb4139ab4c65
SSDEEP 24576:20Le5ji0hmxLrMYnQ/tbw/2Mkjy6Fr7g0ol:2Pji0Al1Q/lFTjN4
TLSH
T1B4859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7f0581fcc7c72689c22a753fa0d023c262e38b61ace89537f0847b951eff437e
MD5 d143c2c0c025ddaf5379a3e940ae38ba
SHA1 adf209bc1c69b41af663c3277dd98d7c24760c05
SHA512 1f509216f37c6c01cac0f1fa02c2b6c8d93de216844b49bceb4c6ffe744c2cb13bdf40698b6584a9efb5f99213cc3bb508fc1503286c2f1cb8aca676332c0f42
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWE6q8wyuqnQ/tbw/2Mkjy6Fr7g0ot:+/ezSC6vUzPvxHjyJQ/lFTjN4
TLSH
T1AD755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 de9040ada4e77768413031a13727a1386326c9d677af42bb42e471edde494c27
MD5 c7b014ae8fabd8ef2f478d4e6aca332b
SHA1 ace080c187fd5fb03890ea4d641289f3fee71bc8
SHA512 d8086b5205172689a8244cd98f6543849d29d898a0ca8101e28d3a9d6a194cc9bbcdf95b62fdb9d6f2fc5652cb46a2037e70c642b7e048036fca2e7a23f51cf3
SSDEEP 24576:SVbqPb88hv/l+6DnQ/tbw/2Mkjy6Fr7g0oC:SVO88hXl+8Q/lFTjN4
TLSH
T1D9559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ed6f5f932932209502bba43cc68f8740ab985718a82b7fb111eac20c51948f60
MD5 c9cd05388bac661e5b61d0736914c177
SHA1 070384345e9cc59d6089667b2b4378cb6bb92992
SHA512 79db1578fe582da79574c0151c76ff06e6e650ca33e713bccf0b4f91bf5e1abfac1a25b5ae36d2452a3c20cb459a2d9d485a5b8b92f965b4af708b915fb8a4cb
SSDEEP 12288:9zEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:9zknQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1F65523696A24F89BFF2B06B15CC284826B7B0EC1BFD4A74E7744362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 41f433bb110a9df152a9060a2583dff8b32c12a6c5e7c8f8150777ba8d4d4e0b
MD5 7357cdeeb27d04f0fa46a87f5835b561
SHA1 6ea295c7dec4de3ff050383cb69b33300e6f4128
SHA512 b639d88d6cab2027607dca53d9383cb95fb60e4f7b3917762f9b3934e150363a1a8db9d12f0a54850eef9c157759437a1c908c1b8ee7d234268827130de4367e
SSDEEP 12288:BeBNUbTVO86UrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:BJIUbnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T10C75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 cdf51847eec2b6e718cd57241cd24e5b35b8e4506964e9e6742fd9cc366391fd
MD5 435a24f637365b486c17d3492e86e99c
SHA1 dae7fd7c8e8b73bb644da9541f948d759195ac19
SHA512 0a323d35e0a8930b2b42258118ec47fbc9363074b1ae6cdc0212ac6994c3b4071d0491013d1165321edb6ae3c6365ecccaaa371dc06238d5ef4a70ef62e939f0
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THb:2QvGAdlCEL8c/yRNw5C1Lm
TLSH
T103267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 7275499b88427ddc5fae5a3dd248dbc7eea618c7a9c0b9246d1c3d891f257056
MD5 1b5dfcf29bb02d24d75a105d08f04f4a
SHA1 9fea92872aa71e16c4dee84bc209be379dd0ca1e
SHA512 ed94124590dd36471fd7df18ec97142506190da723f386f65aa7c9be6cc4938501cc1757217f9d545f4a52690217e59db0a0d968771958637867f05717a65040
SSDEEP 12288:WAwSfxL/2Dc39DLLmt0LDQewsAjlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgW:rQewsAjFnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1F075E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 272bf4ba8c52f5c10175bdaba58e3cf27ccd999289db474765c096cc51f2bb4a
MD5 ac226e3403fe4a306b33c3e8cd3f73ce
SHA1 7e9921de15389f4bba95d08c719274292bbf7894
SHA512 d343da2d0e3dac4ff8368bf08c2c6b38a6565bf5ede2930afc23ac2529e14865f7e7baaae4310581d5781826b325e449141937b08f103e8c7727b1e47c3ae050
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHCL:3UEtQevvqc2W1cpV2EI32
TLSH
T1BD474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 47aa269e48fb9ef5cb96c61e1d75396dfccdd52776c2a01a964a710f805582df
MD5 e00e3547aa14399e92bb33796029b4f8
SHA1 e96e7a44584ef2608c9e93d3c68ce6f570e22761
SHA512 1c7128da45dda8464e9c119c55220254f095dc0adfd64abeb8639c40bd39f378a3cfe4ecf1a0c9c3289653b1ff6883814efe7675e36a9c79c219c43e885ec32c
SSDEEP 49152:xCbRquA/m2yL5zQfFiV+XenmE3/zlQ/lFTjN4:+oqtVjnmJLm
TLSH
T110D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 cd54370629f5c897b9c109584565e690c69a7653d0ce0ae543a2b83fd38545e8
MD5 ea5d69035c15015cdeaa236105214d50
SHA1 15a25bd530e41415f57affbcad3b6ea88af6f058
SHA512 1a692c79bb2480ddab85a03767e4b050b2cf4e006b9202fe3a40be31d6d5badc5a3595210d75307fbc440e28022c1d67a1fdca4f9e40fb70d5160831be569ab7
SSDEEP 24576:DAhGLJIFoiwtA5l7S53OnQ/tbw/2Mkjy6Fr7g0op:DAMyFoiq5+Q/lFTjN4
TLSH
T1D235AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 394c8a18b36ad22b81571823dcb20c070f5bc9f146613f866f04842571ece7c7
MD5 f123a463c7ec18793501004c9183e438
SHA1 65db1b1ba81b18c65d448c2d07dc233134a5d143
SHA512 c56b3c4d997c002c89c04cb8008a5f8ce894ac3f7ed19e8834133d8b44f991024090a8428c3af0b1a411888f96b79279801ad626e6632068a7b3604e614076e9
SSDEEP 12288:rmw5HEjsChN2BFgl0WDm+ChGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMz:qwuHOWynQ/tbw/2Mkjy6Fr7g0o6
TLSH
T14165F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8ba017e6eb0a7ec5e31f64a4231de49ba5f9be353c596e0e28473cb338a90551
MD5 01b92a1fcde6ca06f6d86d9dd2aa84dd
SHA1 0bb12799b6867529efb7609d30c639a9c8b36429
SHA512 1fb0a1fdb1ec194f369c91bcbbe692252061abaa0defe1e5e2f732e43b4bfb63e03194f409398580ae09eb0743564946ae7cc374a91cc70ade53f293900eedee
SSDEEP 12288:lXZ1Iy1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:1ZuwnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T16F55126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 44d397ce8ff156f01d84eb7e033bace42df21677e41250f1ae55beaa6579fa6b
MD5 853dc05b22a15bd8eb9e23b70dd5af91
SHA1 af7a6871feabb0b77078a1647bd1ba128c497247
SHA512 4502def8ffabef805bd32ae848d0acd663c0769a55ceabe7a1b2c3dbea362ed5c9b5564b720dd292e2f101a0a01838d84ba26622c608e2a0c2ecf730e5788e80
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uv:SQRQyi36YOcPQLvw2gAf+PN3ULm
TLSH
T140666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 cd15c1995452e8d7e7963277b2a0a85612252375921821959e27a3cf88d9e885
MD5 049dc9c4435422b954a19ea650d47310
SHA1 f3dcf3d06f4be628e64d7c13826fc1882ce065bf
SHA512 ab764042131fda8bff2ed0155db7732f0e66fb3fc917246fb7931d508dfd99bb05f446c97dab311bb1a268510e9a3880f8d0b8e327ea6d09adb0812c3c2c9f7a
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uv:2QRQyi36YOcPQLvw2gAf+PN3ULm
TLSH
T1A3666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f04553336e040275133bc03925d0d0b74676490729db94cf01488446bd97e67b
MD5 20a077d2fcfe86c385c5c8abf569ca4b
SHA1 3aa08c89b35500c44c0c6a82795e02db9f02b5b5
SHA512 b463510d2da1f52038b1625880e2a1a83b6f6fcaa70cc3c7d16902a672e1d927de705337e64b135dce2f6908badbf1fc61e78a654ea1b70fbff8cc33956ac337
SSDEEP 24576:ewvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0gnQ/tbw/2Mkjy6d:o68Qg55nhheWu7PNU3/1Q/lFTjN4
TLSH
T1BDB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 89cecc4954440cdedc41fb5c3299237168e94548efcdf2f6edd28bb335adb0f7
MD5 61089d72a88128cb1e574de99f352fa3
SHA1 d11580f79a798aacede599e131dba65fd7400b4a
SHA512 0eaa15c9634149af0a765ac3ce3876659cd079551c1a146f93251a9efc2bca50d2c8aff77ac072297f4f859ae795ac246aaaf3b574f38988173dd3630f453ead
SSDEEP 49152:B3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk991:Ay5112gYy5azzVvL69nLKnhZXLm
TLSH
T1EB167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6bc87ed184e1681035167bb2df0bef195a77613e6b16725fcc0a5baaf7b90f45
MD5 e174294640bb5ed92cf0c00be421e2fc
SHA1 011bb9148072784eab66d8d552c901f472996b58
SHA512 111605566902bcd9b560a86042bcd9ef3aa9ab382ec6d926e86ef316cde1d4172f60050463f3537a0efc44466190905b2a86b8714d7a06db83e3d6a17944c4d8
SSDEEP 49152:fB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glEQ/lFTjN4:hu6JmVxd2d3Lm
TLSH
T195D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4fdceda55796ecbbad48559fcd5d5eeb3f49b055264f60f07ea52046f7df468f
MD5 1d840065c49a366f61623290da2ece07
SHA1 a32874983fb64ccb0624a7e998b7343fe20d147d
SHA512 007d1998d6848bb017dae5fb22e2548398d83178d09e19ad4391a63654f583c518d187d5c839a420ebf834f1d56a93a2398aa12b778dd19b770602f6e3f15bf6
SSDEEP 49152:d1hpsNoJpF1A6UU44CwH7R4x7Q/lFTjN4:dmifPbRJLm
TLSH
T1ACB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9b7884432a36ff02a8f2dcf87e8ab5565397adbbe785b3f0682652dc340bdac4
MD5 5d84cea8fcc532db4d6a05f042591e11
SHA1 66d732a837af155e72512019bcee16ba08ecd972
SHA512 5ecd8a62c07aadbbd4c433a71b78a5a156d37bf10162f32cffd89d1d6c811af675d7b43c86045a8e6e4e2e83a315a3399be8b3b4f989c8f1bd5345d8f153be3f
SSDEEP 49152:ESuZQIY0Be2KRRVtOnks6NMHqwQ/lFTjN4:W5dKTi61DLm
TLSH
T1DCC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9a61e87ba84f6ca7a969bb5fc2fda269d1089220e78f1383eba0b39854161e41
MD5 bfb4d2bc6e70b7dd1c97c82124fef2df
SHA1 53d2400681cb81f6c357022d10b2fa2d541e5ce8
SHA512 55b1cff0ba2473f9d53c32c556243737063c69ce19b708ebf9f51b39db22093f3dd16d20206604306fb08f86c0d5b7f86313dc6e4ac4551b5b9d6c849b4f642e
SSDEEP 49152:YhtSn8EApI0figngiDn0AP5wnQ/lFTjN4:JX2iyphNLm
TLSH
T12395BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 d3b360bc7a1522922782183981679abc2e563c4a452a145aec2c85df832761c4
MD5 f6c0b7cdab7c0315120be450665d3e9f
SHA1 5b1bf7d7d96aefc1fafa71cd6ee6d777aef41798
SHA512 32655a05c6b13947b88f1b284c15827ee4d7756af0d5be80f01a080469fd2aec709e35132b64bd06d80027b74d73fb216b6c69bcbc58ee96b5f66108ededa527
SSDEEP 12288:B8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:B8nQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1D25523697965F98BFB1706F14C828182A73B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e40353dfb53cba96fba99949d51ce455e9e90d4ee7cb660813c317c334351de6
MD5 32de46b14e69f1f6038b16b7ba29e068
SHA1 79a43d6035a9c65b12db79d404d0ff91f08251bc
SHA512 8bcaa9be64888220738b6759bf0391a1be26268c09cb90b02b8503eebdd4ed1ad0a5908cc293b4069e7be280a64ceb485b7a1926caf5bf2abb5e5141e98377bc
SSDEEP 12288:ahGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:axnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1505523797965F98BFA1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 09ffc9c49ebeb0ef1d0484b7e5f30b70e4f6f83ed075456ead6c3c35b4f1b947
MD5 03992f385a7015b7919904f6af01437a
SHA1 150149860ab7d1026ce0201374d05a3bdd17d4c3
SHA512 8b6a67a3d4def7b7c9ca6b94e113afd5ea0a908ae9a56dd3b2979e4d8f24b07bd9cf2d53273fba83113a737d5101686744437110774da2add9c414909c7369d4
SSDEEP 12288:FDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:FznQ/tbw/2Mkjy6Fr7g0op
TLSH
T1805523697965F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 0ff10f16502c7d1f2b7052ed4fa4a551e2b67f9ecc776e536e00fc436daf7e5a
MD5 fcdf183fcd0f4f057d0b991cc8e070fc
SHA1 cc9146171fb3027ce18ccd2a6f43ba71e3dede4e
SHA512 c2e3bbfc71df02a3382f30e09c38282cc8863c9d16bdfad04e1f18ab60e9be494ed7c461521ba06e040e02211df7b40b2febbc626ef8b4fff5e8d5ca61479a69
SSDEEP 12288:GVuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:9nQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1A15523693A69F4C7F92742B4CC938142E77B3DC5BBB1A38F6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d4655adb1814b268d3af6776cd35f46d5efb90189021aed362afa580d8b757f2
MD5 27e6888260060e3b4ebffdc5fcae9efb
SHA1 6064ce3be8cb59766819dc6e0401d75d8dcbf696
SHA512 08e3d99ff22a2f081807c4048ff2c869de297f6f7a1795bf70a50be6b18e2d95f27085a5a0167426d8155c86e00e77657b9fc2ec2e2357cdf56dc66a865fbd89
SSDEEP 12288:M2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:MWnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1925523697965F98BFA1706F14C838182973B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 715b3d11863d5a5bd9064628192288d734621579b2df261fce352cdf78d17f98
MD5 19cb9e109df3c8a9da41862026a1181a
SHA1 f3fc3ea19f107e160f37cd9c9c142f165cfe8f04
SHA512 00f51376fe64170254cfda157b6513b5231e73aa63c5417575509a3efe8c389de18feea4cbd37787da480369cd14e5c6dc59fb600ce8524e89c4e21657aa1977
SSDEEP 12288:m9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:mdnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1C75523797965F98BFB2706F14C828182973B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 009b4c60a6e263d74acbd17894af23b87ff13e4b5a20facbabd18e8b4ea244a9
MD5 080a333c5548bb473211bdbd427f43aa
SHA1 bd6f6277c88798fdadf939dee052768c41641507
SHA512 c4449c54e441fda3b6a1cdea50c90b2a85ed6ff13ada4f1cf3db849e876c6d70bfe9d022b62751b70036df7bcfec56dfe22bcb364b147871c925c56639c627d2
SSDEEP 12288:VJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:VZnQ/tbw/2Mkjy6Fr7g0on
TLSH
T19B5523797964F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 3408008c078fa8268eb88024153a502a6d07383d786b9bbb1955ef5d61ac409d
MD5 14c1e282fe49d5edae7d1f59f0fcf90d
SHA1 7cf6d92ff81adf3eb1bcba3460063bc461a9886f
SHA512 9c57dc2ee04c96b73814c5cbb09587ba5710abb1ca4c71170a2a842c3b1c88e1d12cfb613d07af3aaa65d14c063da31efef3b0329c2fe32d7a8667027962a5c2
SSDEEP 12288:miZwbDzzFEoS2cPvyBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:pZM3zFVSORnQ/tbw/2Mkjy6Fr7g0op
TLSH
T19D7501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 4a6f4c652c9847b43ae4dfad93bca29c6b46a189bb5872242676ad5f0db00c2a
MD5 248f18421f7dc88e96cca54e8165d1be
SHA1 4520a42ff8e85252c517324e27fe7ab76eb39d79
SHA512 f1855a04371cb68ce1421fb40be58bde0037299c99ea0fbc22c899484b58bc325f607678efb8b3b1c5b028f7f8b06957331e0db7e241c2a034882d4084fc8acb
SSDEEP 12288:jgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:jAnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1F25523697965F98BFB1706F5488281829B3F0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 666c4fa5c50370dd92413545c805fa3f3c2f5c8035859384735d4bc57fa195e1
MD5 957bca794b60cc1bdcb896bd6133c217
SHA1 b3940fe0634bfd2918e0ff8432c16ffda5b89a99
SHA512 6ba87742a65fdcf7a1e3ec3f6346a00f1eb9d8b7ade0267db1584c7c03cf984717369ac27eb286d71e81371f9b24be0f1852e587b84d849aa8a139b868cdf9e0
SSDEEP 12288:wUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:w0nQ/tbw/2Mkjy6Fr7g0om
TLSH
T1625523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 8101d02e57399704c95aad1135fc6bf270843386e9af8db51278239ef652ca71
MD5 a0e0d1f4d8f7eaf7480ec062470fccb9
SHA1 0a7500aeda361bd0776ec4032c97dc267b3a976b
SHA512 1a2c9531846e39455f786a0233ecb5f4a7ea1eeae30ac9f02e61e6c8908538f3fa763cdcd4a632be45dae89afad5c8f6131297bf7451bb2946e4d2dde35af198
SSDEEP 12288:/yPz5L81GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:yzyVnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1C865021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 bdcbee8e814de1f640857da84ca32d9dfb78046ed45eaec1760990066a9d7c96
MD5 e84ead32fddd910387552d204683130e
SHA1 57276c7e54862afa3c8b7c8e9f54a0b5d0522efc
SHA512 b362d4c52634790c6d6e0752a72d2db61a5f53ab33883ac64fac46299b0b13b6dd2bda699c4c4901064139db86af5f381e804de1b65c94a436e06f2648493a0a
SSDEEP 12288:RgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:RAnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T10E5523697964F98BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 14ac94b417bce9e86a32c589fd18156b693961b25261b7380890dd4106407e70
MD5 3163e754bcc1f7bcbf04bb7afe795857
SHA1 b756800635d85ba69f4c97d4e0c3f7828e37902c
SHA512 01db4e15c0e317aedfe04080269419be8afb0b11b66431c5893e5d971dc86fac34ca55c3fe7ba2f860bcafe727a11e7f13c58d5ae08f321ddc43f9ae373456cd
SSDEEP 12288:xgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:xAnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1955523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 4f448a30b4009e28d19d0a8ec056d80c8b0937c0a7996792f467c7cb5b8e0b69
MD5 1c94dde20dda6f1899ddfaff98fdd99a
SHA1 4b9f0b7d1be30a2265110646d709422377c33f3f
SHA512 8e9738136bf6f36f2a5eb33fa61db546c0a47a74a38568889e9174a2f2bf1ea752d869f7171dab61c2a3605ecb733e9ae282827c6401ef99098031a5c21d11b6
SSDEEP 12288:0yPz5L81GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:tzyVnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T16565021773A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 5e863949a97ef6c53628e66c631aa58cf2e4f1069871bba3e6af8d241032c008
MD5 abdd9a031cfb81fdec60975653121b13
SHA1 a020373c42d57ea7cd37211a1679cdff3c902817
SHA512 c3ddd5e93aacc98fc53f85da1bcc322c4b10945bda527f0b6f7012e33ed16dbbfd93444af69fb9434ded8a3cdc9049a4c008c30b9b980ee6d94e6d7b93687bde
SSDEEP 24576:UT0aLl3z0zDjnQ/tbw/2Mkjy6Fr7g0oN:UTDLljqQ/lFTjN4
TLSH
T15E7501A4B35068F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 04f76a4814c8c4de5381635a37ec84b8461e4d42e61f67d284e8b486597cb820
MD5 3c142aa5c940c7098d78605b4f0800f8
SHA1 22d4616f4e4a0f0a6d0fdaee9c4700c4f6c4573b
SHA512 850c44fc847101de76b98ca2f2540a337fedf59451718c58430ad6c1ea2f0c6cc3b3d96e665c13afd2a1372fbe4609285f174759487c4113d774c9b0ab62394c
SSDEEP 24576:j31d9CHKy7GZ/nQ/tbw/2Mkjy6Fr7g0oH:D1d9CHKyatQ/lFTjN4
TLSH
T17985CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 03d5d2d026b266112bb21b3148f60a88aa37a6bb49e5583f54d2537414d612d6
MD5 0723012a13ca2bd6171505e0ced66c32
SHA1 c27f35636f0fb1861fea1e4a981daada5779b16e
SHA512 ead97aec9a167eef4720770a697c2f498e78198e5127a8b1131efcdc2430624c01facb0a5cf77038aa6852000fa393e0db772119d4e70b5f814586bfbce29ce5
SSDEEP 12288:bjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:bTnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1815523697965F98BFA1706F14C8281829B3B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 942d5ae42f7f8286e6a00d07df7db38bf5f5031f198897b28153a66c54f3b2f1
MD5 68d3f4393c14859c04f023698b7ee99c
SHA1 1f767b6a503e65fe357e0610fa1ed6e115d9dca8
SHA512 2a2cfa3e51cb7a672a4765c9d929d17e34d296df129883cc779a88d4a17fe4d8495b5942ce3a8b7e25e59cbab185cdb8dabc67e8ba7a1815163ba2b70e34b015
SSDEEP 12288:mVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:m1nQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1615523797964F99BFA1B06F14C8381829B3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 f340275e0b601391b675fb3cb8b942795b6b9fd94370aea5a4bc654e68eac515
MD5 05c4fbab83528894d0ed73c761874cdc
SHA1 76f49d9d463d28b1c0875c0b94751cb58d801b6a
SHA512 0ef6c1c0713f925bad20a2e51595cce7886211010dd60e074428f8858660c81786038862c0e512a3add9f1d98a00224907ab6d3c8033642379f91c974b40470c
SSDEEP 12288:RssfQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:5wnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1E265F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 38587c7831c7e5828d4322de7485ad807b1bea927a26f743f993b567fae39f6f
MD5 b8faa5e7ded2f7198aacdd9a72923e24
SHA1 ba6937edcbb4bb757d938a3e9fadb141b8fde2d2
SHA512 c168f0a918077309e30130973266230175108962e651d317baed96cc25e45ba6cc403ec20cab26eed1737f3f8766c3c57d80e241a606b605f2988d51cbc26352
SSDEEP 12288:eIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:eInQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1AD5523296768F94BFA3B06B05892C151673F0EC5BF91D38FBB08222D957C3D40EAA745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 b498a9235d48da1c5dfc7ec681264fe3de8182e252dc2f3c43c9c965c40aa22a
MD5 9ee5ac86252092570ff531fdb4938a39
SHA1 191190282d9a3c8ed9a9a2a06b7a4eb1ae7ad35c
SHA512 cc1882787ab2599ea19321d586a52f1e3fc3e257d18e6aade8c86a11a4df7904f8e1ca32d485d9e533dcc82b650708492e4e641f8981bbbc61124da67a7ab669
SSDEEP 49152:wa0h2GEkuAe73q3pp46zwwQeQ/lFTjN4:wa0hNYG4JwSLm
TLSH
T1F6859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 1.3MB
SHA256 74bfead52ba024db2251676fc7ea2fcce0b7d0837a6743ac110b5fb99464ef23
MD5 971a6c853f59e216f7b07935006162f1
SHA1 1d6dee3801b2166ea9a831691bd60fc6bb2d088e
SHA512 2e162fc1479049b6f0d0e8220c7dc33f5e08ebce5328c58ed98da4a4fff9f48f83062a697106a0a990c7e690edbd3a4fdbef1e13dddb3e957669bfe614cdbc88
SSDEEP 24576:41QT7EcpfxR+N5AWAz3ooiYtjMqbxnQ/tbw/2Mkjy6Fr7g0oM:FTDxR+N5YzTfjMoQ/lFTjN4
TLSH
T16A55B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 728f02ba349cec09bce60c91c597d4615348dcbca0711183d84d50f88b0e32f1
MD5 8e7c97e7aef030c25b22d4b7ca3c19c3
SHA1 3c376c210c71a199d367379209aa2e8fab0c45aa
SHA512 a12be62e496d1f8a413e15e55f71b77f1bc57d1fe48bcabdf45185def0c4e563d7fbe5ff7284152daeda50fff1ba898e4ad8f27f9157a473638dc00ad9563eca
SSDEEP 12288:GhbHjfXKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:GhbHjPKnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1A655027D26AC30DAF63692BD88928546D7327C552B11A3DF2381823D4F3BBE40D79B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 2675f3db3e8972c1e8845fa093ed72740875451abd7512b97a6029b9fef68b4e
MD5 2824659977f2812f00d87c83ba0c2d90
SHA1 3b15e453ac0cc267233fe6df954ac976f0e55deb
SHA512 6743b78eedf20c58c954f46f15c93598a8841785a4f952816c3a17f337adf69f5ee2a903925d84ed6529e93265959f7d4ecc85fa5d4467411fb413a691531c94
SSDEEP 24576:33YgnJcRTk4yti+R5dBR/ynQ/tbw/2Mkjy6Fr7g0ok:3IgnaTk46pBR/yQ/lFTjN4
TLSH
T17545BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 56c8640d27da15e7913d4eee04d47f557d539a8d8c9f4457d0cfccff63e99412
MD5 3bfa17f4e1624d44eb648ee1aea1d8e2
SHA1 dfa80d18279e17879b0d62b5ad5f1f86cef4ff80
SHA512 e7472402691474dd2c1f863f5023ddf8906e179d2ba150d8c8252cc6881487f123d6017784c7a878a0d2e366debd26da2560085276b473b01646656341eb2961
SSDEEP 12288:1kGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:1EnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1AA5523687658F98BFA2706F54C838146673B0EC17F9193CF7B482229967D3D41AFA780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 5c8dc54c7cff4719cd6dbd1ee8ad178001200be21967cf98811f3589202f5674
MD5 525958eb55a9ea3ecd8373891dec32ff
SHA1 5b447587865927178e4bae6c47c66b659e1b688f
SHA512 10be032fcc9eee3be00192e4493171d8dfd3d214883d51dff07db94b09fb747d7a49db1c5c29c1470698f0c7fd520284f78f8369e5140b33ae728cc4e470572e
SSDEEP 12288:nOb4A4LWOsvAYFT/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:IwL3UTfnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T18975F155F7A450F9E92B813CC8A28616E772789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 d4efecb6017b585139d828ea277815dc64d0cd79294963f5a77168d9fe5758c3
MD5 859e18accb4833ad72a0064943f99dad
SHA1 85e336e08f4e253ed4663e49f2c210b4fdbab683
SHA512 bd54a17a6192cd00e364fc33a9070db1f6acf9997b8b76139e98a4be926962a027a0e1c7dd971fd7a515f10f2586a9ebe42b1fbdb0e5076ec5835e81983c0da5
SSDEEP 12288:PpFtCOIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:cOInQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1C255022D36EC60E6E536527C89838249D37278961B6253DF0780817E5F77BF81C7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7153efbd9b03ba346b94f96b8f39eefce3b75dd8004f0fde1678eb01e999391c
MD5 9340a922324d1b65c68f344179fd9210
SHA1 2ea00846d3e0ec1966c3c91ba3203115c1077eb4
SHA512 38cfd21605411c7c6339f778c16ec0a0e64c16efdae725e4b123e67603f4fad96b0f9ad28404fb78b3a33f1cec50a29256d05916b82b581f66b0167ef4bd0c1c
SSDEEP 24576:F7NM9YqZqmWMUkPjZM48Mv6bEhs4nQ/tbw/2Mkjy6Fr7g0om:F7cBWMpPjN8DbEhZQ/lFTjN4
TLSH
T1E9659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 cc7f48e9c627db0aa962f5cc89f75654fc637cb97e0a17602e10e71b16635ec6
MD5 6321d08d9dd46aa66ec846fe96df7c47
SHA1 bf037f123847aca0eef611870f0207f2082bb8c5
SHA512 e6ff0ac42425bbcd6c01b1ebb2003471d814492999d77f3e6a30fd94cda66d52660c4535e9bfb6448797defd285d20c5c5c505d11ab8bcb287bbff900aa8fbbf
SSDEEP 24576:1W6BApg2YuyuNDYTabvcdvNYf8km1SnQ/tbw/2Mkjy6Fr7g0od:1F2YuHNETovAvNYf8kmYQ/lFTjN4
TLSH
T140857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 78495500a8254a88437b15ce874ea6e13807cc6fc283115b2a916b807ffd4df5
MD5 e5ce101beacb49b0e5e6290b6d3bcb7d
SHA1 c0fe0396538995667e1b063626284ae36a52f29b
SHA512 2e59dae01e1cb20de5b9eaa6c09fe7ef79c6fab192fe8dc8563ccb847e725e1fd8819e504265cb5e98468b57d7fef206667c1b4a71b1f53a7d0ae39832521e28
SSDEEP 24576:mAFs06+Omlf3NXEbToHnQ/tbw/2Mkjy6Fr7g0oS:PFs060lVXu+Q/lFTjN4
TLSH
T1E465AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 70311d39ab2c30b0f292b7409a33be13d971e16dfe40455c8fba563fa54af27c
MD5 e5a0045e85186aecfe4b22ea2f5f6402
SHA1 48d60223d12e767d18414168f88a0db991e4988c
SHA512 ab36435e12ae2e28bac6bbe6738b9a3493127c8ba137b84b92cb821cbf8832ce4eecf771a6c30c4e764bda1515c0abbd8a33cf2bb476ad9c2d6a36c19fc745d4
SSDEEP 12288:6CJnJ5D3VkrqzxYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:7JnJ5D3Wa+nQ/tbw/2Mkjy6Fr7g0od
TLSH
T11375D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 43f49ff824a1e2ccb09a36f68c92a7ed1948411fb5538c988ffedd99a1444592
MD5 b3641164a0ee55e8bfa76d76be6742e6
SHA1 c865bf81a8641729eb4af37feccee44a9d9abfd1
SHA512 f53805c443e8c4f791cf14da797b2449742c498d98bf5d461f50173aa8d41eaa5ebe0fa43cef89ae8d125f0330a3e47f010ee921c897d2aed8edb4acafc682d7
SSDEEP 24576:4EPghm6/7IIXdwcXrif7qQncjlP65i3VuRnQ/tbw/2Mkjy6Fr7g0oU:3g06DIKdwc+eQnSt65aVMQ/lFTjN4
TLSH
T19B955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 0c4cca3c7a1f06ea97ac9529d99cd4b391897633255d90ab923eb3d9bf570f49
MD5 7ab4517d77812b2b6390d42bd2e922bd
SHA1 f0471c2ba0f6341b5de8eb60e8e277fe1fe695ed
SHA512 ae0b56f7021d03eae934f646b70276e7cf620edcf39aec014be29b45661ee87774522630015caeab0b76c5f6fca1fdf2687cacd92060bcf069f828b55dfd8e72
SSDEEP 12288:cEP3RShGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:XSxnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T16555126D37ACB0DAE52A917D84918145D373F4A16B5267EF2680823D4F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 07ecac145505196c16d056c7ea6c3b0fdeb4fe38db01492516bd394f6a22d50f
MD5 df724ba3dd149833a8632fefdc6937b0
SHA1 76772cf730ae644e31bccb080ab54a675d26cda5
SHA512 9065a31ccfc69cc43d8964485c1bae963cb66a50d96baf0a0af8e6d5496008f2003556ae1377549606fe599f3e2aa0187e27d18b13414b898ef2252618ba8591
SSDEEP 12288:hjkyaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:hIyanQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1A66512186398F4CAFA7A06788DA381919B367C506F2193DF6280F23E9F3A3D45D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 381f04e8171a8964ed210061737ed18184943bd403fff75676807d9869186a0c
MD5 03fd450b9d746e19506b94e3b942fc9c
SHA1 40960a91554a5b6434daeeedb16a711b405716b7
SHA512 2914c56cb98c55ff6679fc64606f4a7c94934fbcc06bb5d4384d1b091250bcd8e8c55f622246ba9da999778e48ddc14ed2ba0f39dd2b94f406643019160f4832
SSDEEP 12288:30rGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:EbnQ/tbw/2Mkjy6Fr7g0of
TLSH
T12455236C3664F89BFE2706F448928542973B09C17F9167EF36886239CB7D3D416B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e27cd1d4ae014bc3c3c10ff933d3b090f25be0006ae349bb3056b095cbc3863c
MD5 fcf778bc611000aeb10ef21c4729a4cf
SHA1 f5a2f07545faebb1e1f31d92d2edd8e9ec395cb5
SHA512 847481dc95a9ec5a9fc2b1b1b54a402cb103ad7fa5a4666f07a43479f1fdf0481aff9a7d60e4bba3a5bb4b10472295dda592919bcd57129b65ebb92bf92e723b
SSDEEP 24576:IQ9MxZKdcz9dw3AnQ/tbw/2Mkjy6Fr7g0oZ:IVKZAQ/lFTjN4
TLSH
T141558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 a121b39086eb9b430cae99b29767eca3c068af885bd439938a19ea5a7e1ed82a
MD5 f77fc4d2e5b391ae7e04f1d7ea0b55f3
SHA1 3aaf638fbaee313085923220d9dcb3129a401ab4
SHA512 8981f13bc1eae1755e720f3809331331434784d473e9b018b7d9d95823ceab0b0be1ba4a58c8d8d65e8dee594d49f5fa98c1e5e7e01d39e2d42d87a43a001c1a
SSDEEP 12288:syoKo20Rple9pFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:syocSAplnQ/tbw/2Mkjy6Fr7g0os
TLSH
T17C65E01FBB6D90A2E136813C89818645E773B4706B6263CB6681C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 a878a2cd11bc8541e5852a58be54bbdce3f73e892cd59bb924ca3e6720beb089
MD5 903b08e7141682769ed433132fc9a099
SHA1 0c27f480507b81527d34f84ce964d2912acdd1b8
SHA512 9fee0fb5ec81f2984df576582195995799306aa75f15d03cf29c576c596eb6cdab212b71309c290f0ba24d0cef8bd529c4a38e1efc04e01ff1e4b306b5aa8dbe
SSDEEP 49152:zWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKlQ/lFTjN4:z0zuNIULm
TLSH
T1FFA57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 6795d85a8ee5ebdc2a2027a577fa78f445f589611b939ed767fa9d15ccb012be
MD5 39683e5167a44ce510af99cea7424ec5
SHA1 beacfb7326e5b14ba149c5df9390301137a0f941
SHA512 ef671db241bae4cdd1c131c0eccf3f1afbc6189f2b7c1fd5e7a75483821df4006a72f73210e24b59c094af781dc86752164cc3dcff536ca8772ee3923fa26792
SSDEEP 12288:q4T0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:JUnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T10655122D23E8B4DAF93352B48962414697327CA2276167FF36C4C23E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1104-0-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/1104-2-0x00000000021B0000-0x0000000002216000-memory.dmp

Download

memory/1104-78-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/1104-16-0x0000000002B20000-0x0000000002BA5000-memory.dmp

Download

memory/1104-121-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/1104-8-0x00000000021B0000-0x0000000002216000-memory.dmp

Download

memory/1104-9-0x0000000002B20000-0x0000000002BA5000-memory.dmp

Download

memory/1128-274-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/1128-79-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/1284-433-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/1284-327-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/1412-37-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1412-70-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1472-337-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1472-531-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1580-549-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/1580-345-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/1748-340-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1748-290-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/1748-285-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/1748-284-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2292-33-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2292-24-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2292-32-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/2316-548-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2316-341-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2320-123-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/2320-111-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/2320-117-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/2320-276-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/2584-71-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2584-76-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2584-68-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2584-74-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2584-62-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3248-302-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/3248-400-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/3304-344-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/3304-294-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/3316-272-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3316-48-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3316-46-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3316-40-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3816-311-0x00000000005E0000-0x0000000000640000-memory.dmp

Download

memory/3816-425-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3816-304-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3816-305-0x00000000005E0000-0x0000000000640000-memory.dmp

Download

memory/3824-96-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3824-98-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3824-90-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3824-275-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3876-464-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-443-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-466-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-468-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-469-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-470-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-471-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-472-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-473-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-467-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-440-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-441-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-442-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-444-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-445-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-446-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-447-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-448-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-434-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-435-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-436-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-437-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-439-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-438-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-465-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-449-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-463-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-462-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-461-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-460-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-459-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-458-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-457-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-456-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-455-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-454-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-453-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-452-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-451-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3876-450-0x0000017137170000-0x0000017137180000-memory.dmp

Download

memory/3984-334-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3984-498-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4056-323-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4056-317-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4056-426-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4056-316-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4392-298-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4392-427-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4392-349-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4616-350-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4616-431-0x000000000CDA0000-0x000000000CDA8000-memory.dmp

Download

memory/4616-394-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4616-551-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4616-362-0x0000000001790000-0x00000000017A0000-memory.dmp

Download

memory/4616-378-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/4760-331-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4760-330-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5060-60-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5060-273-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5060-57-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5060-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5116-122-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/5116-20-0x0000000140000000-0x0000000140155000-memory.dmp

Download