19f73e3594ec4bdda444844db869d74e5f1989f8026e6d52d060a5e6d8e94f50

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_7d1e108960e6530cb2f145455923391d_elex_redline-stealer_rhadamanthys_stop.exe
Size 1.3MB
Sample261024-jalgzsav2p
SHA256 19f73e3594ec4bdda444844db869d74e5f1989f8026e6d52d060a5e6d8e94f50
MD5 7d1e108960e6530cb2f145455923391d
SHA1 edc66a1f9f21fc0e4935e10a142ffd5bbcbfc200
SHA512 595dd708f910f0ac047f943af9df0c140d1026454ac297cd693098bfb4e608da21df88082005f57e7d45860205d1300f6f215c184ef547c2bd8e625ea764b570
SSDEEP 12288:85YYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywL:w9e/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1DC5523967AE1C173C97652753438C7F1139BACB12A70B483F9853FAB6FB0AE1561120E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
4968	alg.exe
4208	DiagnosticsHub.StandardCollector.Service.exe
2120	fxssvc.exe
4444	elevation_service.exe
3696	maintenanceservice.exe
1200	OSE.EXE
1076	msdtc.exe
3224	PerceptionSimulationService.exe
2752	perfhost.exe
4468	locator.exe
4104	SensorDataService.exe
3044	snmptrap.exe
3720	spectrum.exe
2736	ssh-agent.exe
4000	TieringEngineService.exe
3560	AgentService.exe
1136	vds.exe
4552	vssvc.exe
984	wbengine.exe
4744	WmiApSrv.exe
2044	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_7d1e108960e6530cb2f145455923391d_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_7d1e108960e6530cb2f145455923391d_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\eeb5985f5ef7726b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-22_7d1e108960e6530cb2f145455923391d_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-22_7d1e108960e6530cb2f145455923391d_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_7d1e108960e6530cb2f145455923391d_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112140\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_7d1e108960e6530cb2f145455923391d_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1548	2516	WerFault.exe	83

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_7d1e108960e6530cb2f145455923391d_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ad298728963dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e32893738963dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000116831738963dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007edd46738963dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e032ba728963dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000547d25738963dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004a7d44738963dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4208	DiagnosticsHub.StandardCollector.Service.exe
4208	DiagnosticsHub.StandardCollector.Service.exe
4208	DiagnosticsHub.StandardCollector.Service.exe
4208	DiagnosticsHub.StandardCollector.Service.exe
4208	DiagnosticsHub.StandardCollector.Service.exe
4208	DiagnosticsHub.StandardCollector.Service.exe
4444	elevation_service.exe
4444	elevation_service.exe
4444	elevation_service.exe
4444	elevation_service.exe
4444	elevation_service.exe
4444	elevation_service.exe
4444	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2516	2026-10-22_7d1e108960e6530cb2f145455923391d_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeAuditPrivilege	2120	fxssvc.exe
Token: SeDebugPrivilege	4208	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4444	elevation_service.exe
Token: SeRestorePrivilege	4000	TieringEngineService.exe
Token: SeManageVolumePrivilege	4000	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3560	AgentService.exe
Token: SeBackupPrivilege	4552	vssvc.exe
Token: SeRestorePrivilege	4552	vssvc.exe
Token: SeAuditPrivilege	4552	vssvc.exe
Token: SeBackupPrivilege	984	wbengine.exe
Token: SeRestorePrivilege	984	wbengine.exe
Token: SeSecurityPrivilege	984	wbengine.exe
Token: 33	2044	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeDebugPrivilege	4444	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1452	2044	SearchIndexer.exe	120
PID 2044 wrote to memory of 3320	2044	SearchIndexer.exe	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-22_7d1e108960e6530cb2f145455923391d_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7d1e108960e6530cb2f145455923391d_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 440
  2⤵
  - Program crash
  PID:1548

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2516 -ip 2516
1⤵
PID:2804

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4208

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4892

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2120

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4444

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3696

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1200

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1076

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3224

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2752

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4468

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4104

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3044

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3720

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2736

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2008

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3560

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1136

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:984

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4744

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1452
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4356a153bc7d103071cb45d8b95291ccf86af1647d79d76e60a86e6992a930aa
MD5 9ef83e2f16909b6063a6ac14aa4c1bf2
SHA1 e8508be9de64170db76969d2f9cebf1aa502852e
SHA512 ae3b8d0f5781d8896f23da4769a34787120bdb5990f9b09eea5aa77f47f767f2d67aff6050e0bd9ce54bb009f3d797c98ac8508aeb5867e45986ed964b75e28a
SSDEEP 49152:Ub+632BuPkFKRrdE6ohmstBhuXjfS4LWxnVeN7xB4dcUDb4kw:O3q6HjBzxAcob4
TLSH
T10DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 dcc0c59e7279da20a0b66f31623605c445b3cf4cb376d9804643abb89faec5e4
MD5 ba58d33b3391f724323a02041cba38d5
SHA1 d96f3f0bd6b71ee1fd8ef5870b87623249701ed8
SHA512 1bcf59f1ec6c8fe8e385a6a134c3ff0a13b0e4d8b72fd0a4fa0b35bec85aac6c13a62aaf075d8b998e7a458f3ad93fbcbbb8034dea7b825ff24253cf14971e6b
SSDEEP 24576:5XYfDtczAIe/fvF7asVSyRmdcG/DH+M54c2yw:8tcXeN7xB4dcUDb4kw
TLSH
T1D575F12977E405F9ED778278C8B28502E673BC910760F68B03E4AA661F736D81E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 d019756342ed7369bff02095b6f042703f40988fca5219b94cc41748076a02df
MD5 08f228a3c226242c9a33aa85027b3316
SHA1 59a805053809c5dc22bbb3b819f685bfd3a521cb
SHA512 ea38a0e3982857b8f8d6bf12a23c5d08aa480c64187102708197af9d20d0a2e933344f322de6551b553c9e9ae71a1744c5cee52b6dc0ff4b91221296fb4edc01
SSDEEP 24576:C0Le5ji0hmxirM9e/fvF7asVSyRmdcG/DH+M54c2yw:CPji0Ac+eN7xB4dcUDb4kw
TLSH
T1FF85AE56F6748331D073C0B9C5D2A68AE97234861B308ACB4286D77C7F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 cbe9bf55f765fb0d2ce344deedace91da6e46f0d36453adcb6792c0d96fd0826
MD5 726c558b7ab2abaf84fc2185b29ed508
SHA1 dc24f5d4df2cdfdd3e07bb58f035f5f6f4643877
SHA512 b99c3ed72ed6f98a8535160c3e50978806348c8c7c778233839938d205acf0bd8b227223184c4b878f470e46c5ddfb5ca90a9d0746a9b7eaf391cc1a82e93258
SSDEEP 24576:Ba7/ezSC6vUyD/aqgrvWE6q8wyuHe/fvF7asVSyRmdcG/DH+M54c2yw:A/ezSC6vUzPvxHjyKeN7xB4dcUDb4kw
TLSH
T118756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a250c0fd09132ca6498ef44a9357810675bdca9463fd4ce4aa391351165acda9
MD5 e53ca47f2a90fd1f24745e8d713317f5
SHA1 268781e1cab6bd7ed095f89ec7bc49bd4c31f54d
SHA512 2b1df6fc199e35ef4f8c1cd773991738799316d8707deaa4c1f37f52e8d2d40960e67d9bc1c74ea163caf494ee0074246cd35dbc610a11206ebb389b65237aec
SSDEEP 24576:1VbqPb88hv/l+6se/fvF7asVSyRmdcG/DH+M54c2yw:1VO88hXl+peN7xB4dcUDb4kw
TLSH
T13D559E66F5748331D073C0BAC4D2AA9AEA3234425B318ACB1246D76C3E77BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2112d67151d634a78c44a2ddb6b2d32168c5a3df8ab7383bb5e81d44f0c7d457
MD5 81dfb914e33dbaadce27127e316ffb54
SHA1 b954e2d9118156b04eba943a53a00e8614acd1db
SHA512 62d358a4c0793220ffc8676f6dd3c57b9134d911acb069ab133c391968359298357b32e4c656bcb92401ae5c4dd8a6bb39b8c1441299740c13ad562d4f9f6954
SSDEEP 12288:+RkYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw4:+RBe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1495523CFABFD12B3EBB6937134711A9211C39CD42DA0745B94903F8A66F8CED948025B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 ce4f823c12b0fa86c8f8174546b497da7fe45782f39459ca8a6b5349b3123cb9
MD5 ece609f09ff5374bda86ca44d4e46ff7
SHA1 3d1ffb336a61fb2c4e3b5667a045f7dee6a3c8c5
SHA512 f7ed5f7c7cdcff4129ea845ff80e639ffb853190823ea8409025ada2b57e843adf525e86e73d22e4fc82d727f670191ef7c0afcdc25f92ce58c4b92e82238da1
SSDEEP 24576:HJIUUe/fvF7asVSyRmdcG/DH+M54c2yw:HJIUUeN7xB4dcUDb4kw
TLSH
T1BD75DF7BEE38FCE2C27A8DB85A91874093A278704F61A3CBD164830EDE335E55D75825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 23618889e6e7d650ec91a3b692de081efec62eb9322db80dd3feff854e5cec91
MD5 1ddec2e3be3e6440807832c8349dd5c3
SHA1 1f6c2e717c8c4340124fd8260652c5c9c6d4c2be
SHA512 79777de075d66880ef236f3145ed80b3680ecce13d143619c05867b42f1845a80535592e44ed85c61ed7ff2cef168d3133ef555dbba96b5b36ab778bd9fa817a
SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THJ:3QvGAdlCEL8c/yRNw5CcxAcob4
TLSH
T18E266C656BF880F5E0B7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 0ccf5ce9ab88de596b15f05f3387d0dd119ab94d6b8e3f60fd6105b5793d9cc2
MD5 1c466b7ea27a2cd628798ae83affe6d1
SHA1 710b318d8e68347ec91ecd790f37f49dc258ea58
SHA512 91496c02436ab443fdbb96bee6aa0694dc2117746357e47992d87c831ffe1d2daea5c4fa8d97f69200c793feb17237a39093cac7e14d86b923421d4988dd9e03
SSDEEP 24576:XdewsAjue/fvF7asVSyRmdcG/DH+M54c2yw:tljueN7xB4dcUDb4kw
TLSH
T1E075E031FE74E032C7BB0DB22B36C716146DAD600F6129C3E3A85E8E59746D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 51bfaca128bda73fa0b182a18fd442f0a2520b902c227ebf039a5c5e1f16ef5f
MD5 63e21f16efca3a6f9fd4ea8767f9406d
SHA1 5f48168e25ceb452783e30689bda5b18fd6d2dad
SHA512 22da71ae95ae4d9dddc4440c85ea66f97a9ce8204ddd1e3155d9b807d817a06bb7c7a6b8821dd85991d1f148f83c37b197d1b42515baf6031247fa37eb1fe3a0
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHj:/UEtQevvqc2W1cpV2EI32j
TLSH
T10F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 002692bcea830fa6b8c134eaba7400d925bfc86c7fb9729fb20dc08a99085aee
MD5 969ff23bac686acafd5bc281143a432d
SHA1 13969d39bc1cba7e49b3a897e376982b21ff3e26
SHA512 92b082fe11a4760b096a936583902e3769ca4647e1ebf51afb9b2cf949ddcb9a5794382bafb2a838b8ec60c4e77a731b96ddb62b7dd13796fa3b6e18470d4bd1
SSDEEP 49152:RCbRquA/m2yL5zLfFiV+XenmE3/zOeN7xB4dcUDb4kw:eoq2VjnmIxAcob4
TLSH
T176D58D0976B8C2E4D1F6C77896A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5fca7a0fbe1747da932e013418397365447fb917a3b16596feb8b2117ebcb6a3
MD5 dd56c30cdd9b1150ce14bf3750cab007
SHA1 3a5203da02f08fbe7c6a2f84abf77e180e6c3440
SHA512 2f4958f3bbae9b57587385f46e7e2694b120d7f7ea7454b23bde2ba97c16caf6e934d9d078c3f7cec866e4ed9351e9e74e914f2afa0c8f263c07290702119ef8
SSDEEP 24576:dAhGLJIFoiwtA5l7S53De/fvF7asVSyRmdcG/DH+M54c2yw:dAMyFoiq5TeN7xB4dcUDb4kw
TLSH
T145359D81EBF951D4F5B3AA78A9B68171EA76BCA65E30D20F2150D10F1E33E909D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 f0cafcfe8438250fd48257c59553b6b5db3477d0a15e4d37d5b555355bd83e3e
MD5 7ddc42ab689b4d9cdf4d60078a794c2b
SHA1 83f8bf985986c7d4d728df390e9c3b56bed7495d
SHA512 703c2972b056b2ed4daea81bdeeae62e592397571606641db07378fce958b6dbf518dc34d5c5a3d14bfa8296e6cd69776a4f1b900f54af7d12f3afb700e0103d
SSDEEP 24576:2wuoOWqe/fvF7asVSyRmdcG/DH+M54c2yw:2wDOveN7xB4dcUDb4kw
TLSH
T1F965F14A77E908F9EAB7823985578532F3F3BC012A20E71F1760C65B6F772616D29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 0957336374aa76d87350e75ae9e0b582f9b120835dd82b6767cde70a01e2492d
MD5 ada9d3d6554d850e2985f60705e1c002
SHA1 055c0b60bc36d636a1795cf092706e3a95770dd4
SHA512 18e56d4dac757e5b9bcd6020d6b761616ba3befb4322b6f5bd9cf0bc51707585afaee716d61da2897c0580379e470e2f3809c0ac732680d45d905efd228e2577
SSDEEP 12288:JBZ1Iy9Yln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywi:nZuFe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T18255129E37F821F6E6B39379A8F1464193A37C92277063CF1064668A2FB1ED51D35322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 22984b17e8da5af499c9e51de6e20c726264988cc06b2752a1a0516050294ecc
MD5 f26937ce546aadf1f93116b4297baf01
SHA1 20824485280425aa48c621c4f59e892f57b3d89a
SHA512 5bb60d2a6f5168c06505f0ae549bb31d4d0c882eb7852baed6babf422b600aef48ae50b130c461261a4a236fef954a96c3abcbd93b9d83bd9636c998fc0c4354
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U1:6QRQyi36YOcPQLvw2gAf+PN3XxAcob4
TLSH
T108667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 55363870c7f695e3aa82e15f18899f400e9bdbce1a80ec7d3244f3358bef3b45
MD5 ce8c3faed06350ab6e6230cbb7e9b2a9
SHA1 b2287985700314b0587d9af8083befa8e8791bdd
SHA512 00c4aee0f1dd936d81268da8f04b767ac0dce2db4b8d1f45d39968467929e9a8b7717c0af723f9786e7177b10821873d3e1eac6c13a978497822af7afefa5b1a
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U1:hQRQyi36YOcPQLvw2gAf+PN3XxAcob4
TLSH
T115667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 924a186dbaff81c60f9d1d21726dcc760fba49f777d8aece6fe6ef5041c0218c
MD5 082831534f0ad98741fffc659c92c72e
SHA1 5d33518bb918366c78c711d7165bb55e7fe4c4bf
SHA512 f73dc6778c2fc92eeed9f71b16d3799bd8e05a2f4f75276b16c4a8b7f7100d10566aa845ba650b65709c2cfe2bbdf6a43d23d7d0e2a0142a0a47c7c7678321a0
SSDEEP 49152:M68Qg55nhheWu7PNU3/+eN7xB4dcUDb4kw:GthWRc/ZxAcob4
TLSH
T17FB55A33B2F600A9C45DE1769F4A873196D27C758FE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f42c1be748a92afd8cd636f65599de10fc83f05bbc9a1057e087eebd2adb123a
MD5 eb68b3e513f7e2f4de086c4cba66c03c
SHA1 038bb5a733e246ec19624a3d87a606ecec9788fb
SHA512 c9d19fc55a4c7392682f4ed9a6eee5cc8fbe78328c98f03cca48fddc40d1a37294a949ac391591fba8f2058fd6fb04529767010911751b0fc844f061d5f3ab01
SSDEEP 49152:n3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99v:Ky5112gYy5azzVvL69nLKnhZixAcob4
TLSH
T181167B13F29900E8D05DD1B9874A9232EA62BC474B35B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c2314395b1d7fb624bf0e3a2fc98a0738124e3b6f3207f13a62fad52204d6b24
MD5 bdcb032425e0de29fffc27d0e2b93c8f
SHA1 5987fe0189c3c117e9e2a132af885bf6c3951f3f
SHA512 4027f77bf8feaba98bb166f080f2c29574f09eb9c9b4110c5d08e0bf1e57857546ecbdc9cf619d574773fa44a7b51ff162b867b68d5b94f379b26beb8afed9ba
SSDEEP 49152:gB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glaeN7xB4dcUDb4kw:6u6JmVxd2d1xAcob4
TLSH
T1AFD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 61c685d3c355c8e5bb108a76e0276fad77b5ee89e72a5ced575b4bf075880a80
MD5 44370a38b7d4e9eca2721e4e0fce3052
SHA1 9e38ff9dd330d27cd060a96b583681425c155c83
SHA512 965d965dfaac3f1f8e5f99b087f4cd4e68ee108efa01299b779c4e825a75a24d914dfe1153ace835d50b5ff6a519ac90e80f95486febf9f7e5caf21486c80a89
SSDEEP 49152:71hpsNoJpF1A6UU44CwH7R4x0eN7xB4dcUDb4kw:7mifPbRIxAcob4
TLSH
T139B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f2654398e909057506b2320ffc79767b612554d6675bcfafbd0ec8be91f5f249
MD5 ca4fd5c55ae0ccb0a119c57f570bbe9f
SHA1 c64c03786a45f2f085c8973b2ae199c483a77de4
SHA512 1ed57127216d12c794e8292836be2c48b4ede530343dac58c42fbe7150306476b8a120823f29e5a8001763c944859a482a6e5e812adf502106df0c650a8fd8ff
SSDEEP 49152:nSuZQIY0Be2KRRVtOnks6NMHqFeN7xB4dcUDb4kw:95dKTi61GxAcob4
TLSH
T1D8C5BE03F2E941E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 605ddcefae79cc6283c97443e9a28326d656d509a62488164126b9be5efe76f1
MD5 43e3686cc7930c93e8e860ac7c547f5b
SHA1 bcfd97173ba7867efe8ad44180c64c01f2eae5ca
SHA512 45805d838076b8c93fda4dceabb62d7f3d934478b6ad582de41f8d9f876ece28c80c7d902ea7c66fdaec2b436a78bf8f2afb6659b9de83083187776f3326e343
SSDEEP 49152:whtSn8EApI0figngiDn0AP5wIeN7xB4dcUDb4kw:hX2iyphExAcob4
TLSH
T19795BE13F2D901E8D06ED178C7568632E962BC160B34B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 8995c520f6d672ef0722e856ac636f5fd394e3e0215cb7545346d6af93bd0eef
MD5 6c99292c3ac0775f769943c08d40eb3d
SHA1 a34cfd6d917024492cf443a40cf4c3b7f08dee60
SHA512 46545d65569493e212e23d05ddf97b0bd562ebd9ee9e4b33aed61756402b351faa1c2cdb22229848008d3dbaf5be3d67ef4cbb5b0eb5624d175a7c73948cb695
SSDEEP 12288:L8Yln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywS:Lpe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1F45523CFAAFE13B3EB7693B17471168211879CD63E5030ABA4983A4667F8DFD148015E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 2423c6e1677a6198b7dbc686b780b14ac433bf83cb0c2f12c8d8428327e99506
MD5 f45c76fe31a0431491a5cd4638bc1f58
SHA1 b5e749077f3d693158b65ef39c882de5613bcb3d
SHA512 594d8d7fcc749116e1c1bb0704f3b71fab878be5323b7d6f88d1d95926a103e212f30b46dd0c405859a47c90fa7243a48ee6a831aa53ad024558b36b7bfd5a9c
SSDEEP 12288:vZYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywS:vCe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1D55523DF7AFE03A3EB7693B1743116C211879C963E6030ABA4987A4667F8DFD148015E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f8b227376748482ed7c15743593721e14e939679ce50376c4149b023fe631b5d
MD5 7a714bbc42400c6e02f8d67b31a731ae
SHA1 05e716903700c9137add5f31e535a44da66225c2
SHA512 74c9f048b9dd9d6c9c5cfec334589516e5492e27e16c60f20159ff9a823992a53118ff5c2a4ed6b8379e797abd207a860b708473de9b2612475f8835a874da70
SSDEEP 12288:ETYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywW:E8e/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T16D5523CFAAFE13A3EB7693B1743116D211879CD63E5030ABA4983A4667F4DED148019E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 de3e789140fe23c26d68a156c1b5d8be774df7bf2cb0d0c4c19da6d1ed5a4b0e
MD5 a793ee3300c984611101e89c7a0cb73f
SHA1 f069203f3ab1cdc0ce31a0bbe11fbb25733dfd57
SHA512 4be2f230eef0c385faec4a058e75dc4fcfdcd128976b23397f67f2c15638b51dd9f7bdaa8a5d691f52a2b9d3605685689756bcabdf15175b74893eb749ef4205
SSDEEP 12288:ZVeYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw9:fe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1D455238B7BFE02E3EA72D375A4711691A2D7BCD52B30729F94403A461FF0EE81860359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 3bee90b32e91fa0e7626ba466eff76b05a2e6455eebac40ef687a2a2be73e94e
MD5 d2e2b1c0a4c6b3b97ec95e176dd9942d
SHA1 faccb616c9c7148fd07b713e06961c7299f5bf5e
SHA512 14760789b663f3a7f772188e89aeb6d911060bdab18aa4aa1cb400d4956b6be8578d6fb2d6dfa0edfdc930e7d63e404c445875f44470a03e65b9d3809b2ef9b4
SSDEEP 12288:xGYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywW:x7e/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1385523CF7AFE03A3EB7693B1743116D211879CD63E5030ABA4983A4667F8DED148019E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e74a9d932c5bda1ed235dffe3d59ad5c0994c4d53e07107fb5bba7247cf9d023
MD5 8bba62e4978bd9b1c7d7c8c6d3b968dc
SHA1 22a96a2720786350949658853404ee4d9e3c85ee
SHA512 0c326030cffd84c8d1336f4379c1bbc80cb4ba72493886810ce340ed7ad87a8aedf25eb9c2d0adc8d4d856efe79dcbb6f6a117ffdf9520d0dc4b97f8ccf2eacb
SSDEEP 12288:2FYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywJ:2We/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1CE5523CF7AFE03A3EB7693B1743116C211879D963E6030ABA4987A4667F4DFD148015E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 8c1dc57722b291fb8367def828596015fca0dc84aee7cedcc5a2682d638976b4
MD5 fb82a2a9e7fa0d3448029f655848b6c4
SHA1 da0700a102aa26e4e317c73628c4e63bb168b188
SHA512 4588fdb14cd5e178610d170259addfc9ba7b3f33836e4291b004d0c25e2c380728e91ee35e82fa587ccd99e60938e078767da5f2a0d91e995c99d347460e1954
SSDEEP 12288:ihYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywB:i6e/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1FE5523CFAAFE03A3EB7693B1743116D111879CD63E6030ABA4987A4667F8DFD148015E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 438ed045841106568533d29eda0f67e53c94fe10297fd35d19a2ac36fd87a0dc
MD5 1313ce7024e35edacd6153afdfe16292
SHA1 e95fb3f1fa48aa4ad0a0bca5d0a769ddbf9d2ef2
SHA512 0eeafb793444d6a537122ad742186b8966517c8c4ceb93eaae4ce5f1c971290c11d80ff3c761e9b7911afee5cc983ac3c826194275f7528aa8f9582980368f47
SSDEEP 24576:CZMSzFVSOie/fvF7asVSyRmdcG/DH+M54c2yw:CZMSzfGeN7xB4dcUDb4kw
TLSH
T128750199B3A018F5ED77823EC8214906D2B2BC5A0B70D61F13E436575F737A11C2DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e0d4f1debc2b271f42c3baa6769783ac0adeb00b852b634a3a9d71d71aa594b8
MD5 505ea580ca6b28d237a3ed652ffe7cce
SHA1 867b2787570afc159b63737f4572b070345a30a8
SHA512 085dbe56b4161089c9cbc2e45370c3802309ea6e1320ff9aa6297d77a1bd585099ae2fdd6eae10f38d9ebce6256a4a696ef98a2d0dd38e56585e46dfedabfde9
SSDEEP 12288:hAYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywt:h1e/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1C25523CFBAFE13A3EB7693B1743116C211879CD63E50309BA4983A4667F8DED148019E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a3df02683cd56ceb3cbdda5e0853b5b163acedf2ce2995340e8ae3d77960f7bd
MD5 af6a915950207483edac05da0cd3d258
SHA1 7b7ddd50dd9665709878146ed7d2951471515b2e
SHA512 98ede90e0682d9861ef1b07ecd9ddf7f7fe790b4492b8cb3082f9990a6d25e738d93e6d628df237449675c274c42407ca8c82c110dab5030d849cc750ee198a0
SSDEEP 12288:20Yln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywt:2xe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1045523CFBAFE03A3EB7693B17431168211879DD63E50319BA4983A4667F8DFD148016E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 872c82922eb16066b8e697635f51aaf696adc2add42f25e6e59931fa00327e2b
MD5 d56bfbbca12b88e47604c90a5b3d4905
SHA1 91fcfa74fc23b52cdccf6015032dea4d90035a2f
SHA512 e8a9a9c033eb71d19a5b52de7e5687a9642299de4ca3a7c20ad7287874ae9c4503c09d5230bd9ede646bd9d08eee38458c9889ccb6da307abbd70939cf0c1f00
SSDEEP 12288:ayPz5L89Yln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywu:Hzyee/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T11A65124B77F531F5D177833498610A42F3B2BC721B209AAF52A027762F76AE05D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 3951899f88221527f393079454442e98792124f902f2af0351e380d573066d50
MD5 86b771eecce1879615ba518b466c956b
SHA1 90440f1bff0332f1156c16450bf6519a74b528b8
SHA512 631106c850196b86bd8748579889d6d745fd4edd3e320b18ea31e0a24974dc0f65c6b5209861acd44e4982080d78de031a048cf3d7a9b48a82a86ec98c7e7008
SSDEEP 12288:+AYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw8:+1e/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1E85523CFBAFE13A3EB7693B1743116D211879CD63E50309BA4983A4667F8DED148019E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4f681c13039ba0550f4aeff6ce1fa57af567ee1349113e83f41d41284e6b3e90
MD5 9269d329c76c0f29e6af703463610d11
SHA1 67a3107a5054e0107031c9089c7745e634ddeba9
SHA512 ca995c596755cb049b499d21ca65b19046f066655580daf78448ec6a0b12c88ea84831106c30519bef6b91cfb1b576adaa8b0fdc66c39cc2ea74ae7e4df2adb1
SSDEEP 12288:MAYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywT:M1e/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1F15523CFBAFE13A3EB7693B1743116D211879CD63E50309BA4983A4667F8DED148019E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 1369b2021278210a66d4fe3f03c1e2f80218ba160507c1f90aa21aaac5c5d51a
MD5 9f8373a046f849f5f42dc374a2afbcfe
SHA1 f7802f5411b4ad5af5ee4b0feba0e6e701c10e94
SHA512 2a34c43dd7139e27c3c4bc18d9c1ff217ef00344d6fbac5e41ce2823665e1f9c17fb775de1bd0fe37319d029eb947fa0c2c7071415a09d8c22febd9e639b332e
SSDEEP 12288:AyPz5L89Yln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywh:xzyee/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T16265124B77F531F5D177833498610A42F3B2BC721B209AAF52A427762F76AE05D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 3d9408338234ad0815ed97d721725654ef7de1072f4c4317427cf4845907d3b0
MD5 451a6494329906116c56cb71ff560307
SHA1 98fa6ff49ddd9ef35b04bf4c2881d717f33958df
SHA512 d6e8f8b2b86e0d2dde8eef5ebd52d60a578dac7386e033655db53057045b30ac3ffbd7f89dfe6b518a1b7bacd9ad46dfbd409b4f5c748ecc11e8d6939e374a7a
SSDEEP 24576:CTHaLl3z0zDMe/fvF7asVSyRmdcG/DH+M54c2yw:CT6LljHeN7xB4dcUDb4kw
TLSH
T10F750199B3A018F5ED77823EC8214906D2F2BC5A0B70D61F13E836575F737A11C29B9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 76cd1524e395c192cfbd536660153e877f6812c8b11090f09d882ba63b9ad9f1
MD5 3f974ff5abfc916447d09cb82b80a150
SHA1 c1cab34a120fd6d0514b31e6eef9501e6b478018
SHA512 3ce6cf4c97e2c73db85b110332152fa12b308ee8f54bf1427324d6a3edab0421687ca78898d5b307b60a0607dcd8038f7da207b346ca8bbf3b5a261feb1bbaa4
SSDEEP 24576:P37d9CHKy7GZQe/fvF7asVSyRmdcG/DH+M54c2yw:f7d9CHKyaGeN7xB4dcUDb4kw
TLSH
T15185CF91F3E811E5F1B7DA3598724511DAB67C9A1B30DA8F03A4265A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 b2603af3ca028c86854a3d50c6f24d357b46bd8ea694b537d29410cf1fb0d34c
MD5 6db1cf3deaa1aa5f81886102ffb2328c
SHA1 761f0f35b9b7e611f3af073b61ff1af7b3470b94
SHA512 650a490c6ef6f8508e90d35adbd1385e137c8e3dda57bf963b8e5f6d2467f947105f23ad1ea8f4ac4cbfcc018a6dc4f80776800533c7c9a70ed822f2218e46bc
SSDEEP 12288:pzYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywf:pce/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1A35523CFBAFE13A3EB7693B1743116D211879CD63E5030ABA4983A4667F4DED148019E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 e73f8ec97a6f3ee2fdac5baad6c532f647af021c3b7b952d2da3ca237d99625e
MD5 043d8cf28bd47fb91556cde95c8bd111
SHA1 8c2b1820d41ea5b47b79bdab439eca285385913d
SHA512 691cc550191d73723d28770845cb291a5335500e2c1357c52604dc3c4220623a0d6b69ce1a985ffcda854aeb8b85d5c4b9b4ef45861cbf6466b39640a25f71c2
SSDEEP 12288:MdYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw/:M+e/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1BE5523DF6AFE03F3EB7693B13471078211879D963E6031ABA4983A4667F8DED148015E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 e1ec9c69fdbc14f5aa3756b9c761c940e9b06197e2642d99e73884a26c77aa7b
MD5 8a9bcb2f6dbe7f89c432baeac7322e67
SHA1 cf114ea5fcd395ff80f3a360dfcb1c993e799b8a
SHA512 0d8d253d03dbcd0dd569f0cfdd3b3b237686f07bad5a291bcfb357ee073c6dfc077ab14564d735423efe7bdf62d002a2e94f598f594f2479515c4f531589bb0a
SSDEEP 12288:QyYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywz:Q/e/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1855523DFBAFE03A3EB7693B1743116D211879CD63E90309BA4983A4667F8DED148015E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 b462953bd6ef94052d2e9152e6b52f2427382aac99737e11fb4f054e22cbff21
MD5 bdf967274e257e895c9d543958c80082
SHA1 779e8ec5b43fa700c2192b43e37d97a1a2833996
SHA512 5a7117db5adccd3cd6b81a62050014888af0706ac1bf960afcf508568037b7f2fccdb41222e64652182172b1b80c71c202733ae6584002fb7e6bb1cc9b49e547
SSDEEP 12288:1NsfwYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw1:KFe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T19465014AE2A802E9C17EA275D7624A41B3637C6557E0E3CB62C0F93E1FB4AD45DE5303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 7844b03e993383a1f3ea680ca45440090b8b279194b5249e1b894f39f6be8719
MD5 aa4e686482ed0716541e4fa9321469dd
SHA1 3d284462411e18b9193bf0c05e63e567c8fbdfcd
SHA512 25080ec9e11c147a94ca617dca066502ab2c347dc9b79bae98e7b25098760bc5184a043f35a75810eefe4d999bcb996cea8d6c07c2771bfea1391a519a842d4d
SSDEEP 12288:09Yln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywe:0ee/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1AB55239FABFD1363FAB6A37134314661214BBDA52F60B09BB444368626F4DF91C9021F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 8df85cd423b0f94cf875d9e20ed49a2d3f4e603822d6208a2b529e312bb057e9
MD5 3a25b6eadfaaf499e7f04ddf55fd6335
SHA1 3a6b4160c0a8db975e03b473c755824fed34c5a8
SHA512 be5fff2307b8af873b05d1f6091e5df4617e6ef5c90c85ed2403b6a2ef4bc35f0f03a03c9971daed102109e9234f724fbbe54b3a35ab394dfe7f9111a744ef9b
SSDEEP 49152:Fa0h2GEkuAe73q3pp46zwwQgeN7xB4dcUDb4kw:Fa0hNYG4JwyxAcob4
TLSH
T1DB85AE1E67EC82B5D0BAD278C9A6814BE6F2B4261B3156CF1150853D3F37DE84D3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 7811ec02767b60f3b85b98c9f1780c64a0d6cece11383f4ef17f3965f8dea934
MD5 be2051d40b468b0bbc23dbf9ba84f083
SHA1 5660f7650a46a82c27b1e5c022766be972a9c4ec
SHA512 66ca21c7356ec46757aeaa8b8251e5068f46a98738196150553988dc73b6603b33f8e81398a2208074ee3bf5f5c2fb3c9f0db3319165f6429ed53df2d8e4316e
SSDEEP 24576:EhbHjPke/fvF7asVSyRmdcG/DH+M54c2yw:EhbHj8eN7xB4dcUDb4kw
TLSH
T1DF5502BE26FC11D5F671E27D64614646D372BC651B20A3EF22D1A27A0F76EE81C30B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 47cdf9cf2a9343aa7222de7febda972c4bc1b3444c8b60bebf4b664ca4d2fd21
MD5 b3d699c5f2b35dc695b5408fb4f5f06c
SHA1 4971908391d1e109b052c0556ccb526381d47895
SHA512 757bbd9672ddd8d86370d87fb14d0cb36a6902226206348ee2ff2bbc3d25a2d4fb38f685511fc414cec68f3f4473ada23dcf7a0baa7e8e74c371747a8d207aa7
SSDEEP 24576:m3YgnJcRTk4yti+R5dBR/se/fvF7asVSyRmdcG/DH+M54c2yw:mIgnaTk46pBR/seN7xB4dcUDb4kw
TLSH
T1F945BF2EF3B910B9D8A6D236450147B5BB71782D1F209ACB0170C538AF1AEE85E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 dd3ca1bdee7380cbba9d650d9e190be72f387d076354b6bf24d57382d4af374a
MD5 096c2aa713a2e88dc7fc1492dc0f6fc9
SHA1 d3a92c5c78c0364d40740d18c718314547b474bc
SHA512 8ccd3c9a21f8788067d8184d350ff8535f71df0713854fe146fd7db740615278dfd922e0cdd7755a5dd833b29d1a12121b852aea3936aab878807a41dbe60820
SSDEEP 12288:3RYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywY:3Ke/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1AB5523CF6BFE13A3EB7693B13431069121879D952F6031DBA0947A4627F8DFE14B015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 bf5da74a0af5a2598608dadb070d22b15fb61054e840e44610b0a4b57d97cf19
MD5 a317a36a84b0a520d5dc4e3c1924a3ba
SHA1 fc7827f4abcd0b909a186b6e6dd0602855248efd
SHA512 d9eb02c7009ceb5f3c018113f097a3e9928f0e9935b250ef4140b082481306aa3639af59eb23a0e5882508f3165b7b28c2f3b996f6b9235b2555f79c57543984
SSDEEP 24576:8pL3UTve/fvF7asVSyRmdcG/DH+M54c2yw:8pL3ULeN7xB4dcUDb4kw
TLSH
T1F675F159F7A400F5E977923C88728A12E2B2BC9D0760E7DF03A84A561F736E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 0aee20962302b9127543a6c30af159594f6571979d91583d1323b6b19f10b55d
MD5 0bfa15d0e353be216de0a5ee98ecca1c
SHA1 e86b59107cae82f83e29382e0efa92de94c2d904
SHA512 f72e0b3d4e358b89e9fbb16e4f542062cbdf1bd9038ab9c2def80be3eb2712f9d02bf5affd2c18b842fa5ec7043b702c5e62e1849f3cd4d78dd7c6ea41e4487d
SSDEEP 12288:NpFtpOWYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywL:lOre/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T12655025E37ED10E1E576A23D98624349D3B2BCA61B2163EF01D091AE1FB3EF81C35652
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c4640fc4484ab67d8ef61810657f7433237565cd66f3c44cfa21a32acbf47051
MD5 ef828e41ca21cda9a0a98fa5da4d73c7
SHA1 29322a8d4dbffa366f693e69eb1bd86a98e449b6
SHA512 0add17882cd5400db6fd50fe764e694e1265314f7f4772ceb53f3fb89bd06ab43d14ff5c36bc308829124c680094391710b3f10ec0e74bdbaf1deb719410fcac
SSDEEP 24576:O7NM9YqZqmWMUkPjZM48Mv6bEhsOe/fvF7asVSyRmdcG/DH+M54c2yw:O7cBWMpPjN8DbEhNeN7xB4dcUDb4kw
TLSH
T167659E6E6BEC81E5D577D13DC9A28205F2B2B8611B318ACF1152833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 a7c8f757c41b95688169509a73e29882707f47548c6dcc5a8cfae6e713cf72c0
MD5 7d902ed45ccc6bbb6d388e1f172d31b0
SHA1 6b1ec1bb507a2b93c1df14ac6459fc1c9795e96b
SHA512 cde43bb5a2b2ac67a3fc5dbd996936a95f84e5e18d96bfa30b6359c78f9977595bd61854de6afefa065ddaab62491287ead167caee85968d1919fe4f5b91a1d1
SSDEEP 49152:EF2YuHNETovAvNYf8kmueN7xB4dcUDb4kw:R6BCf8kgxAcob4
TLSH
T1B1858E6A27ED80A4E0BBD27D45B6D246FAB2BC511B3056CF0255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 ffba0edaae2f77349daa0cb1613242c04edb7dbbd07edac9feadeecd70c46505
MD5 45b670bdf20d4cfbe20ac8750f3c57c4
SHA1 865ddbcc4f01fd1b1bb939203b9eebb28555e8e4
SHA512 ec40962d21c541805269c7b537b9713dee6084358741b48dea626f904afb91038c0385bb7c60ab06cb50e785d366a48ea98260c83a9f3acd04fb4dd5df20a419
SSDEEP 24576:bAFs06+Omlf3NXEbTone/fvF7asVSyRmdcG/DH+M54c2yw:UFs060lVXuAeN7xB4dcUDb4kw
TLSH
T1C765AF2F66EC00D5D07ED17D8997C91AF2B1786307256ACB0160867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 9dc13dd5189ff4a575a4f2c4f9c88d8cb2a287a90a1f57fe97ffa228d30e85ff
MD5 8e69b011845cc6b32e24db87566ceb3e
SHA1 d9e95a541ea9fbd0d96f48b32c168b5cf72c11d7
SHA512 72b8ef452bc35fac0cebc9353aac3cdb47e530ed0460b92a3c5adf11165f2979655477b82d457bce5e1d828a6827405b6586d19366f2d089a43829e3d71f969f
SSDEEP 24576:GJnJ5D3WXAe/fvF7asVSyRmdcG/DH+M54c2yw:GJnJ5DGXAeN7xB4dcUDb4kw
TLSH
T1EE75D02DD2A810F4D4B7C374815A1796BB72387D2F2269CB24B4E5353F22EE09979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 9697923caa745df366863f223f4cebcd34b1b4f779e185491b6c22a7b8741ca8
MD5 6846f3c776b82eb30768ee017aa8f0be
SHA1 c676c1ffb5d2e30e741080cc23c5119bf20cd8c7
SHA512 d671063533b7d14a926ae957a3246d6685ffe9773c0587ef0aeaab111a0ba3ad250041c5cf81d61d9f43fdfd27c6e9d655dfa3078fab05f2731a3646a70dd545
SSDEEP 49152:dg06DIKdwc+eQnSt65aVieN7xB4dcUDb4kw:2bxAcob4
TLSH
T176956C16B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 d9384ad0b25e73595d5ed0847d673ae85ad5e4bc69965ff94f5304718b848c30
MD5 000c41d05b0ec3eb227c2af1fa8a7617
SHA1 168264b8c295320d4c0b8f35b261ac73a0a85cd5
SHA512 e7fd949ba31cd392ac01e9215ade25ce5265db5f44350852001fc99102c60ca20ecdf83f32ae94178031d7002b46668983635203f315f60c8f2b313e3178cd2b
SSDEEP 12288:iEP3RnYYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw/:hn9e/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1A355129E2BAD20E6D536A27DA4614641D3B2FCB02B5137EF5090A23E4FB6DF91D38701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 75a844a0e477a2eea0f1319f7e4f89ea3a9fddaa70ebe8155ca4d23d3234bfb5
MD5 8a4e56bf7247336b6fdfc1ef8c006eba
SHA1 47332966b1afdf21951d0c1ec8dab6673130776b
SHA512 4f00ab2050a8ded91177286e1e150c0b66167f103544beb30280192422aafd58d918ac24a2702535f15bda2727bc8b7bf1bdae283dd81d1bd503b669cd6c1b36
SSDEEP 12288:DjkyYYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywu:DIy9e/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T11A65124A63E851D1EAB65378A87342915676BC602F2072DF6090F72F6FB4FE86C30716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 4ab375cb0e22294fb4a0fc0ea99c6dae2aaacfbf73a97db501d2c3e02ff79f67
MD5 5538a65677c63c42d37bcba9cd28c7dc
SHA1 8c79b346aa110546fce1de992b86e9da80031295
SHA512 739fc7244f0dbdf1901527ff8cbbfec09fd74cc62868d0fb06124a784b9dc439dce14995c017c0e309c662a848f33a4d41dcfb1f95b665dd03337fc18dbd5fde
SSDEEP 12288:tyGYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw2:M7e/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T18755239F67FE22A3EA7293B134311B811197BCA52F6030FF60D4B6569BF4DE914B014A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 3ca3ba0acb102cbbd94a21f886107824abac92cf912a2213da073590a8834626
MD5 9f556b1bed8334306ec4bedea22fda16
SHA1 1325db48a22d323ca0c11e6163cd7f9a1ea5519b
SHA512 e75d0fc50dec0a1311c2bc54b7150705e68df81efd08fc33da21a130458b143be859e1f8f19f083f249a2a92129851de0384af4e716fc7bd301d29a88d90f8b0
SSDEEP 24576:DQ9MxZKdcz9dw3me/fvF7asVSyRmdcG/DH+M54c2yw:DVKZmeN7xB4dcUDb4kw
TLSH
T132558C2DABF9059AE177D27594A250C3A673B4301B31D6CF2448D03D4DBAEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 af04ecec2364a28ea5d1490727caf2284fda95a0bdde0405ec7686817622fb53
MD5 45bd99be48b0d1978254b09e89613d72
SHA1 ae573ffed4bea91b3ae4f6a912f274a7d9068362
SHA512 7763dd355f012ad2ae4df2d932d2d2b88c67cd1e0f7e6abf8131c4737267d7374292741f7767cdccdd61936de17aaa37c78dbaafbf5fe0b308e370a376082557
SSDEEP 24576:NyocDApJe/fvF7asVSyRmdcG/DH+M54c2yw:QocDApJeN7xB4dcUDb4kw
TLSH
T1E965E05FBBAE00A2E176823888918745E3B3B8701B6163CB6591C33E4F779E97D34752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 995ccb7883fd049ee83b5c28c430b1811b7a771ecde428f2cc1a8e2f80f9678a
MD5 dc063e5c2708c7a94ca35e90f9d487bc
SHA1 fd535215e01acc64d86cad314694801ee19df430
SHA512 2fe0a93769a8470ed503e28525633bd7306f9176ace655ccd27ff7b87b7941f008a45091cafe607cf3a01bfe6890d2ba3ec94a57493182baddcce4a3df199894
SSDEEP 49152:xWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKJeN7xB4dcUDb4kw:p0zuNIkxAcob4
TLSH
T1D7A57B3DA2BC00A9D9AAC375C54513A5EA71742E3F2065DB01B0C57CBF2AEF19A38F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 cf0c420a103bb74a3960e92f913425fdadda0f87f4c22fb44ee2a6b03ac0d549
MD5 8ca8cdbb418937f8cf3ce6f3f0e093df
SHA1 5432356f8cf90e906e626646e8a8050a29763df2
SHA512 9600b5e3ff3f9ac0f089a1100fa0a9cbe9cb025318303dba87059688c4218a61a73502112c6a01db294785168f17cae0b66fed7e4b0e483fb87e06d87ede8669
SSDEEP 24576:Y1QT7EcpfxR+N5AWAz3ooiYtjMqb9e/fvF7asVSyRmdcG/DH+M54c2yw:lTDxR+N5YzTfjMGeN7xB4dcUDb4kw
TLSH
T13155B02EA7F815E5D1BEC6799A238502FA727821073193CB42A0C17E1F7B9D85E76F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/984-311-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/984-455-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1076-302-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/1076-234-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/1136-303-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1136-405-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1200-65-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/1200-71-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/1200-226-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1200-73-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2044-375-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2044-359-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2044-505-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2044-320-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2044-402-0x000000000CD90000-0x000000000CD98000-memory.dmp

Download

memory/2044-391-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2120-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2120-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2516-1-0x00000000007E0000-0x0000000000846000-memory.dmp

Download

memory/2516-35-0x0000000000400000-0x00000000005F8000-memory.dmp

Download

memory/2516-0-0x0000000000400000-0x00000000005F8000-memory.dmp

Download

memory/2516-8-0x00000000007E0000-0x0000000000846000-memory.dmp

Download

memory/2736-292-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/2736-398-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/2736-284-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2736-290-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2752-252-0x0000000000670000-0x00000000006D6000-memory.dmp

Download

memory/2752-257-0x0000000000670000-0x00000000006D6000-memory.dmp

Download

memory/2752-259-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2752-310-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3044-393-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/3044-269-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/3224-248-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3224-239-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3224-306-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/3224-238-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/3320-406-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-440-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-430-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-431-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-432-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-433-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-434-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-435-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-439-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-441-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-442-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-443-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-444-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-445-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-446-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-447-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-448-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-449-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-436-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-438-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-437-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-429-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-427-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-428-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-426-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-425-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-424-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-423-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-407-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-408-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-411-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-410-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-419-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-421-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-420-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-418-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-417-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-416-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-415-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-414-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-413-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-412-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3320-409-0x000001C831940000-0x000001C831950000-memory.dmp

Download

memory/3560-298-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3560-300-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3696-60-0x00000000016D0000-0x0000000001730000-memory.dmp

Download

memory/3696-57-0x00000000016D0000-0x0000000001730000-memory.dmp

Download

memory/3696-62-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3696-50-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3696-51-0x00000000016D0000-0x0000000001730000-memory.dmp

Download

memory/3720-273-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3720-272-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3720-279-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3720-397-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4000-404-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/4000-295-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/4104-319-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4104-394-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4104-265-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4208-16-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4208-224-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4208-25-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4208-24-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4444-47-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4444-225-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4444-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4444-39-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4468-262-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/4468-314-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/4552-307-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4552-422-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4744-315-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/4744-488-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/4968-209-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4968-12-0x0000000140000000-0x0000000140201000-memory.dmp

Download