8fb2b373fc470080ec0c59cf36ee238f4b2017ea79448a63b0171073e33ca861

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 07:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop.exe
Size 1.4MB
Sample261027-jscykact9k
SHA256 8fb2b373fc470080ec0c59cf36ee238f4b2017ea79448a63b0171073e33ca861
MD5 be87471db4fbb8770fe7d5e1566594c5
SHA1 bdda7df1fee13a840c0fef30bedad222da3aba06
SHA512 cb1c5f8b29bab275026922b791c01bcb7186d71e42bef918d38bbcb90dd7f55d7c9c65237db01a3139f3f4249a97fbb2c33b62de3238990ed6e86ff9cb6cdc9b
SSDEEP 24576:0ZsqjnhMgeiCl7G0nehbGZpbD8l8eOKaa+EUmUGhtgs4NmXEbZsLTQK1:0dDmg27RnWGjeJZHUmUYyH0UbETQK1
TLSH
T1426523F87108D176D42655B25798D1A69C027D7A06340D63FB53BBFBBF318A4C22E227
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1868	elevation_service.exe
1684	elevation_service.exe
6016	maintenanceservice.exe
3652	msdtc.exe
940	OSE.EXE
1720	PerceptionSimulationService.exe
4168	perfhost.exe
4104	locator.exe
5652	SensorDataService.exe
4504	snmptrap.exe
4188	spectrum.exe
4476	ssh-agent.exe
344	TieringEngineService.exe
380	AgentService.exe
5316	vds.exe
2464	vssvc.exe
3928	wbengine.exe
2124	WmiApSrv.exe
1804	SearchIndexer.exe
5128	alg.exe
4732	DiagnosticsHub.StandardCollector.Service.exe
3132	fxssvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 46 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a16adc454bb6346b.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5900-0-0x0000000000400000-0x00000000007FE000-memory.dmp	upx
behavioral1/memory/5900-57-0x0000000000400000-0x00000000007FE000-memory.dmp	upx
behavioral1/files/0x0001000000017011-87.dat	upx
behavioral1/memory/5900-93-0x0000000000400000-0x00000000007FE000-memory.dmp	upx
behavioral1/files/0x0001000000017bd3-89.dat	upx
behavioral1/files/0x0001000000017057-88.dat	upx
behavioral1/files/0x0001000000017011-475.dat	upx
behavioral1/memory/5128-476-0x0000000140000000-0x0000000140167000-memory.dmp	upx
behavioral1/files/0x0001000000017057-488.dat	upx
behavioral1/files/0x0001000000017bd3-491.dat	upx
behavioral1/memory/4732-507-0x0000000140000000-0x0000000140166000-memory.dmp	upx
behavioral1/memory/5128-549-0x0000000140000000-0x0000000140167000-memory.dmp	upx
behavioral1/memory/4732-550-0x0000000140000000-0x0000000140166000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5980	5900	WerFault.exe	84

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c6a1e494e865dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001caecd93e865dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e25c493e865dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000768a2e95e865dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009387c693e865dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000283fe294e865dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a351f594e865dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb147393e865dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c5650895e865dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1868	elevation_service.exe
1868	elevation_service.exe
1868	elevation_service.exe
1868	elevation_service.exe
1868	elevation_service.exe
1868	elevation_service.exe
1868	elevation_service.exe
1684	elevation_service.exe
1684	elevation_service.exe
1684	elevation_service.exe
1684	elevation_service.exe
1684	elevation_service.exe
1684	elevation_service.exe
1684	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5900	2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	1868	elevation_service.exe
Token: SeRestorePrivilege	344	TieringEngineService.exe
Token: SeManageVolumePrivilege	344	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	380	AgentService.exe
Token: SeBackupPrivilege	2464	vssvc.exe
Token: SeRestorePrivilege	2464	vssvc.exe
Token: SeAuditPrivilege	2464	vssvc.exe
Token: SeBackupPrivilege	3928	wbengine.exe
Token: SeRestorePrivilege	3928	wbengine.exe
Token: SeSecurityPrivilege	3928	wbengine.exe
Token: 33	1804	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1804	SearchIndexer.exe
Token: SeDebugPrivilege	1868	elevation_service.exe
Token: SeAuditPrivilege	3132	fxssvc.exe
Token: SeDebugPrivilege	1684	elevation_service.exe
Token: SeDebugPrivilege	5128	alg.exe
Token: SeDebugPrivilege	5128	alg.exe
Token: SeDebugPrivilege	5128	alg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 5256	1804	SearchIndexer.exe	120
PID 1804 wrote to memory of 1480	1804	SearchIndexer.exe	121
PID 1804 wrote to memory of 5980	1804	SearchIndexer.exe	131
PID 1804 wrote to memory of 5880	1804	SearchIndexer.exe	132

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5900 -s 688
  2⤵
  - Program crash
  PID:5980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5900 -ip 5900
1⤵
PID:5748

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1684

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6016

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3652

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:940

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1720

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4168

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4104

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5652

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4504

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4188

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3292

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:344

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:380

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5316

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2464

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3928

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2124

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5256
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1480
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:5980
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  PID:5880

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5128

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5588

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a414ca9a34e307c5bb454e411264c51f2fd8c0d9d85c20b5b124bd2fe35ba757
MD5 481dbf1b5087ca56574a2216eb6b8292
SHA1 9eeee039d523862abbbf9400e094a880843ed777
SHA512 f045d9c05dbd10879b1b8a34932f7e0bc15999a0b1f5482f337d9ad9af93fa7d6dd778568adb1776382cc1ff9b91381c789f78208bdfeb88dcf62308a73c67b7
SSDEEP 49152:ub+632BuPkFKRrdE6ohvstBhuXjfS4LWxnDDmg27RnWGj:w3q6sjBwD527BWG
TLSH
T154D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 8f50c32c9567b2feac1c3674a385896de5149be688801f6ff3b21773a330293a
MD5 88b20bf324a12423cf9f12271c0df77d
SHA1 2c8d4b679505117e3df214fec025dd108eec2df8
SHA512 98e7d644b773809a813671d3e6ecd871153823929f7b957526ee77bdb997912f232d5f4c8e4b10d1bd361149873f9f7c235e648048f8840e8a4a97514718501f
SSDEEP 24576:0XYfDtczAosqjnhMgeiCl7G0nehbGZpbD:ztcdDmg27RnWGj
TLSH
T194050129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 6fbd75c6e99ec2a6acb0991c9f8ad1e2e500a03728dcece6dfe9bc6aa110b39e
MD5 721b50b051bc34ac9622650430c0f14b
SHA1 f0d218475dab485e88b8f259cd80f94988c34f99
SHA512 e29ffba73524a73ba9ab4ed882a8b4a3b7b57243efa6d3156c0cee9a64c9e9c057950b6903cedbea6f4a34f4550e294f753d3edf56808242bcc392ec6d796cea
SSDEEP 24576:40Le5ji0hmxxrMXsqjnhMgeiCl7G0nehbGZpbD:4Pji0AjODmg27RnWGj
TLSH
T1E6359E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8589f63175b6bd9a9d10892753adb9a80a2cf5ae50be3541b954a355ca4397e9
MD5 69455fd0df95b6f43bb6c1d1a5d6eb76
SHA1 7ea428a32a83025423d2db02e138184169ca8252
SHA512 cad8a90ceac8a2e4b40fc91e6d9b07d6bf62a612df8993aa5a5e4c96d2f7c6a1bc3416f7bcb81466f45cc219022c73ec6d3504f3c087ec56170d82fdb3c8af26
SSDEEP 24576:Ca7/ezSC6vUyD/aqgrvWn6q8wyuhsqjnhMgeiCl7G0nehbGZpbD:l/ezSC6vUzPveHjyKDmg27RnWGj
TLSH
T16F755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7352640d9ba2ea0ad2077179bb2a21575ad3042f60f6aa01af22d8c6fe0dcc9a
MD5 1cde0ee403df46109d09343682ca0d10
SHA1 5ebc6d49ec969ddfd58b83fd324fe1a773ba7ab1
SHA512 296bb50ab3d8189b9b130cef29d33b3240d381617ee7b75b196d363804e728848ac3c8f25611884556764934a3b353e17164e7283ad2300f0e08dc9e1383fc7a
SSDEEP 24576:nVbqPb88hv/l+YIsqjnhMgeiCl7G0nehbGZpbD:nVO88hXl+dDmg27RnWGj
TLSH
T171559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 68c3d2265264feb488cb836416bc42bbf66b930a5241450f23b65335e25b455b
MD5 33e5949c62b22aba63d79fb22affb997
SHA1 d1f533db26f606edd91cd42485bbefa502b614ba
SHA512 2e788336498fe7e511c79e726e3aabaab59620bc61fd7e309ddf7e03ff72ae0a62a42be2ebce7556df1ec658152dcbc4ce29e525b41f2cbcc998e0884d58e07f
SSDEEP 12288:6L7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6L7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T131C423BE824C11CAEB7608B5C3E9F51EAC177E5698200C436A637DFDE6B5464CB39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 dbaf945f42a889eae3043383759c968b91519103907918db37714b3e10449e42
MD5 0fd35e4b573896ff40af24c8bbfa0ed7
SHA1 67e05e7f69357fb9e98392fd30f7bf4f1adfb275
SHA512 24be95ec5e26dd951ee64866b4616c39d036f0cc2038e6044ce5eeacc251568b7504a58e9f1dc9e8529d3b4d62c4bb6c61e727e66fe7571a4c6af7b078fc4e60
SSDEEP 12288:PeBNUbTVO86UwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:PJIUwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16005CF7BEE28FCD2C27A8DB95791C600E77278314B21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ea06a3e3456336fae913ba7bdacb9ed9bf3e914bf3776a7a0f16a6bf8ea6b525
MD5 bed21e86439741f57bfe5cfc44d3cdf7
SHA1 7f2a53e2728b6887b78498472cb65926c84166b4
SHA512 ed4c511e4d68f17c64157ea5988ac70ab43303b405d36f51c1aa986d572e8978741cebd5ba9a6a474cbfaa425cc3c742e54cb21a3119d74e86bac72a536daf63
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH/:2QvGAdlCEL8c/DRNw5CFD527BWG
TLSH
T1C9266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 434714813b3200e707945cf687c46fc3dcae908e6316bf622eca30b6db090671
MD5 f5a3a499006925c7e9cf44bc60092b17
SHA1 2039f9c579719125e76e8c61fac56670783e1aa4
SHA512 b8057f4743f76dafe760f6a013ac9fc779bf48c12ca16437c9fdfe92482207006531fd9326a4907a59ac5c488faae11da38db0a7587edd0a9478498729683d9f
SSDEEP 12288:bAwSfxL/2Dc3RDLLmt0LDQewsAjKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:E0ewsAjKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19615E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ef061d4eb56a5acea3488c4db1f2c682b07b7306d47501067229928fdab9c2c7
MD5 7320ba3b9425b640beeae57483120aa4
SHA1 bdaa5b2981ccfa4a5ed2cc7f26feddafca530897
SHA512 47c1c2c7ed0eb308573572f533d04c06987736b33ae9af17eb5642d4b20dfa5d762984973746f5a781523ac022d826cf2dcc6d677856479f27e903fc59754379
SSDEEP 196608:GUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHmVQBWG:GUEtQevvqc2W1cpV2tI325B
TLSH
T1E9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 27c47d91bf632cfb9b6626e9ef5406bc040221fb2a245975c12067bc8a8d50a8
MD5 e1ceead9765a1c8998a45a5c002733d5
SHA1 f54b763222755190c042e3f44fc1ebdc00793300
SHA512 aaf7eb5104354957544f7ee490e1431940fc0d1e062c93dd1d929f2a96b0783a3fa7b308744e53135acb714302125cce8b29b196ff9f4f505a424c0414cde5f1
SSDEEP 49152:qCbRquA/m2yL5zQfFiV+XenmE3/z+Dmg27RnWGj:foqtVjnmxD527BWG
TLSH
T13CD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7d9a16e439f8842b2ce50eef1e915ee46a0a435bf8925b98416380f3c536bc7a
MD5 21606e8909d131da1e1d393ef468d492
SHA1 e0f70b752f20a9b0313a240b0ad7eb8cdfcf4dfd
SHA512 fb0e88629915e68b3d36dc27f8ef3a340e45b687913c011768b00a8404be2733f854a0962728779514b282b5c730be15bcff702899246497e101c91663a3be0c
SSDEEP 24576:VAhGL3IFoiwtA5l7S53tsqjnhMgeiCl7G0nehbGZpbD:VAMUFoiq5BDmg27RnWGj
TLSH
T1B9359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 a186d4c2d568d74b804405f3e0ebd4eb7f138ecf83d0e0344a3e034bb17028d7
MD5 0e7094dd3553df02e3052178b9200a26
SHA1 d3957696e74f54db44a82672860eb8db86c813a6
SHA512 4908a40156bbab868c2b5a517dd5de5fdc12d914c104237f915c9d858376335c1e0ac65c8573d67aadf4110cc75cb4f90c14d8b64de15dd2c71f1b4f9f9ddd54
SSDEEP 12288:mmw5HEjsChNVBFgl0WDm+CJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:/wu4OWqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13705F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 e975122ba360af4a44c29da8f2d8620c4eda3b17b62f58455e0178ba3cc710cd
MD5 c8155c223d518f2c4120a76292cdedc0
SHA1 79a1b5c84a17c6e1c5c78b3da188a148d1c0bdef
SHA512 e8cddd945fe774784aa881636f531f0dddff8d554bedd0af2c1635045745e746e8a20ced86f6ab95a91680dd08d0bf7e753bbc528fd9c96117669bf69d549670
SSDEEP 12288:ReZ1IyaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EZufsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C5E412AE239820FAE5634178C6E5D609E7333C63673003CF166656AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 de3fe0d4748641fde042ef2a6d17713ed384901e8b89648171f433cf6066e848
MD5 b5ba5fb6396042e3f0cb2a8dbf08c331
SHA1 0fbb5a24e586ae8a910627f9b4695475031c21bc
SHA512 b268f338ae6bc91b6c3794099535c467e385c41f2fea00ae3829382651a8dc03f0f0cef7cb1d2657c092462b93cc8a7af1b417c1c62799458185f9b42d78b721
SSDEEP 98304:vQRQyi36YOcPbLvw2gAf+PN34D527BWG:eQyiKa/X+PNoVQBWG
TLSH
T154667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 573e2fe504c8dcdf98066dfd352dc77fd901824545d790a0c9f89c4d7c48fee6
MD5 232cb1c3556766cc1edb1193b84ff18c
SHA1 899f35cb6f6a7a9d964327bda90a26629f4faf72
SHA512 ab3d9eab491d9c1798e059d0240cfdcdef931cabcf4fb670cfdce56a2a31629e661109fa8e49c13bb9da21c72de1299957c34acee3c30004091673dac07a3963
SSDEEP 98304:bQRQyi36YOcPbLvw2gAf+PN34D527BWG:qQyiKa/X+PNoVQBWG
TLSH
T144667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8e905442fc6fa281332c58aad1f4ffb75e9644939b1585394afb686f1fc83be3
MD5 ec33edd02131a2b8795ae7aa3825c6de
SHA1 90ba54dc780e750d4ab96c1aeaf7bb92412c1fb9
SHA512 ba95fd2213906bb010ee49303ef4724c4c679586942e25a41b1e9a996df14b38b1e94fc63f4c72939ef763204813c9a80d8623dcc2acecc655dbb89118b0c35b
SSDEEP 24576:pwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0PsqjnhMgeiCl7Ge:168Qg55nhceWu7PNU3/ODmg27RnWGj
TLSH
T1C7B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5adcf88f4308820d4ea3a90931250533cb4d66f8d7f5170926651e7210b83e4e
MD5 34a5610229127c8489415d486d48966b
SHA1 00e79a178854559ab37af1316514f510f70ed240
SHA512 353c15de2ac5be76b7a3c913730d58b6443866984131fda818bd2edc5c6d2b44efe818518aaec70934b1aedc1b3c77727be99ca9213b3f76df01d91313555e17
SSDEEP 98304:oy5112gYy5azzVvt69nLKnhZvD527BWG:BLIHEWhZVQBWG
TLSH
T192167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6cdc9e21564de420492a84adf64d3a41315d265fd413e7cfb2edd2acb2cd8d3b
MD5 39b51f1615296b1b5d90fbe5f89664f7
SHA1 cf9722ce1de8b057e7d662b76b4e11055e186e83
SHA512 ac995226534949d0c311b1ba4c4d7d6707b2618dad59a030a8d17a28fea741acbd83c756027038d9231406dbcbd7fbec1be8e9020fd831f1914743922e7d7164
SSDEEP 49152:GB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glEDmg27RnWGj:0u6Jmdxd2dED527BWG
TLSH
T18FD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a2aac38f8f1731cc96b3ac2246e5ab4e35b00af015da2c97482ef6ea10de1fed
MD5 e67ced9619b2a70205b66b6a577ea32e
SHA1 6ad097b441772468ed57bc568edaff1330e8e18e
SHA512 e50ea44ae009f3cd47cd2c0bbb9131c6a2b97f74697f0febbfcd62b82f15d4fd3128aa9d5498c247e5c249e68c5a748eb6583c1c5e660c4fe75b3ad351f7431a
SSDEEP 49152:l1hpsNoJpF1A63U44CwH7R4xMDmg27RnWGj:lmifPWRxD527BWG
TLSH
T143B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e542168ab2da35354de4b4c27991f0aedab589ea8540f3fb8e25ea35a465c458
MD5 08c5f69d8f15a375e971f468d4d6ce55
SHA1 e984cc03b6198a96267a1ea8c9079147010cd1e9
SHA512 87b37b08bf9d274c74e7b82d5775d14f08efae8d35c9fce0536a5c49c44f8b46712da040ad61ed31e36b878d8d0fbf930613d1105c5d58bd1c7409e3d6c147b9
SSDEEP 49152:aSuZQIY0Be2KcRVtOnks6NMHqDDmg27RnWGj:E5dKii61DD527BWG
TLSH
T1CCC5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 fa664cd1d77010e034f5f306d0c79f8429c933f841791abaea22951923eb34fa
MD5 29a66899158615376039fd005ba2767c
SHA1 68906b8e99946ab586764256845eeb79ec32b439
SHA512 be05aae68365f60d657f6324c432e311926c9304f5188ae0492ab56eb5d4e78f066909a4bbfcadad71b177100dcb671da74e909c1693b6bad854f31b5f04fa2c
SSDEEP 49152:JhtSn8EApI0fig3giDn0AP5wADmg27RnWGj:4X2imphtD527BWG
TLSH
T1B095BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 83cfa516ca08911088f299418bc580370d6b9f5903971d9205cf5eb5020513b6
MD5 f3a1573ee0779b4490f98a26645c96fa
SHA1 7fb371ae8c3510ee18ea4e503823b7e08a4c0604
SHA512 ffa841f05c544851ba62cc9ae2fdb27d9c149217f5189c077acccc077b5308c59ba0a19d25d3805b588ec861abc3eece609314a00e0ac79b16fd70e0305f28c2
SSDEEP 12288:QDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14AC423BE924C01CBE92644B5C3E5F15DAC173E5BE92004837A5B78BEF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 a7c49b1ca2d69a1649f9037c7b713ed52f0a4dee758aed4cee676e3a91b7ea7a
MD5 11b52a7fa12dbfc1915a0a8b85b4c02b
SHA1 6b7c0052a95f05c2be8cdc93e38ba54ff71e9ecc
SHA512 bdd9fb13cee827f5bfd6d1c015d6f53a95b63c75f7dbdc69aaa29ce67e76d75bb323df2a45d6177f6386d15bb1f2e4b72b12e46ea98a867f49dffe5556690389
SSDEEP 12288:w+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:w+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T167C423BE914C01CBE92644B5C3E5F15DAC173E5BE92004837A9B78BAF7F24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 05735bc1139be63ffec8b5482979aa7fb2776ea4277a9c461e17ce9a0443a28e
MD5 a41eac93554c799577df2f44a3804b62
SHA1 c338cda707cc028d8e4f5cefe11161af75ac6458
SHA512 ba5b0ba375b2f5f0707052d25337221d45e0398f43a91ac0fb14a5eefb6135208418cc49543e68e0caaec86509c649e2f6169fc411b26b94df709885eaa2ed40
SSDEEP 12288:i4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:i4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T129C423BE914C01CBE92644B5C3E5F15DAC173E5BE9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 02bcc956e1264fd15f13b0baca8f33ce025d3c2f91416ead3643751dc6d6f416
MD5 333f1f94f321563d973b4d90c305046d
SHA1 f8c93371cbe91ae7d7c1b7014c3db2c0bfa90a50
SHA512 695ee26bb939b93186c8445499cd7983e43f947e1f1e137d42023fa63663af89cdb24dc321b83e6052ead8fffcd340f8f975e9262acc487f2e619d18f6c6572d
SSDEEP 12288:TVNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E5D4236E535C01C6D83285B4C3E5E11DE8277D57EB3005DB6B532CAEAFB26944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 10b8d7c8d6d9e0d884ec1ab2b73e554636aba9433c5d9b03c471e66fa6eb8f71
MD5 f9a7eb84aff355a24367ad930438e56a
SHA1 a06c28be70107a3ab36a312816ad018723aedc9c
SHA512 e7762fcd34de370589c9b1cd27c7afc0bf24d30badf8c3d95fd03b8695f63b625b418f7599302fa696295355d8c06bf89519bdd75a9bbe5401c888853fe14d2d
SSDEEP 12288:1FXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1FsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ECC423BE914C01CBE92644B5C3E5F15DAC173E5BE9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 c0380b02d39865ecd09e6c866d8b7f1d55a0e219c5e5f2ed1351a65116eb87ec
MD5 aa03f7a7e22195f639e51e95b604ba75
SHA1 8003bd707a946a46ee970e6d6a0a35b207228a49
SHA512 a500fad799e44d09635a487131ef4c795e01430205838fa7079de6f71bdef817b3e8f171418776d6a70eeb81dfe0bab27c5f72c2c3c2171ff433982ae758bc8f
SSDEEP 12288:iyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iysqjnhMgeiCl7G0nehbGZpbD
TLSH
T14EC423BE924C01CBE92644B5C3E5F15DAC173E5BE92004837A9778BAF7F24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 2f3d8c6e8e32480ac5dcfe241bdbefa7f3dc5565193dd5b0f1808ce660ea482e
MD5 3af365725afc1465393aa16c88cf7e31
SHA1 6df5eef31a36db5644b6b965bdb0933b14bab37a
SHA512 c7524ce3852e5297402928e2db87c28fd3b51d6becbadf564b1648812c7276cb23e0b9d39c53f4fd9dcea5ac43441163efb12c392b504fb41241f5cbd37b3487
SSDEEP 12288:PWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T177C423BE914C01CBE92644B5C3E5F15DAC173E5BE9200483BA5BB8B9F7F24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 029b5ba3dda229f1248344fb0aae4e4ff72724c19f1d79f4efee0afd50ac8cda
MD5 e9b0df7b39bbbf59ee3e43da46061a49
SHA1 a8cc630ef9e7774e402b52c1b9ef9d97caddd571
SHA512 8cbda2110f91d6c57a4c325cbe843b050c294f9e16e7ce5fd7cd831995fab305e3b0307271d4d3d2f5323cf3680930a7e5c96045eb562a398f630ba60b57f86c
SSDEEP 24576:gZMRzFVSOesqjnhMgeiCl7G0nehbGZpbD:gZMRzfGDmg27RnWGj
TLSH
T1E50501A9B35418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 cb956dcfffaf42fcc93d9750b4bd7573680bc5d57df5e009df10e63677c820e9
MD5 de880beaa5d5b738c10e66871110399d
SHA1 42eb682f43dfb2722d1b8287684670027ea1e10e
SHA512 c53879639f811c6d2c6d6db8de1635c4602a44444b5410386283f88302d8e36c6199395fed1b82bad3b12b5d988ac0a633eb72231c8ab5baeb58bf1f1ed8dbd4
SSDEEP 12288:EvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EAC423BE914C01CBE92644B5C3E5F15DAC173E5BE9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 ba28a1b5d131f1da886af3512f6afea5aceeb8feb17999172c8db1d938e676ef
MD5 e5e0b70ce62718282c36604261020e77
SHA1 a52fbe01762b2a6b15d95cf4f19a8834649b3bc7
SHA512 69c219de3a59efb2af93089c42c306a3b66d369a7abd192b29368d08d63c40187d220641d8f26ee51cce5e1a9177f0073a3ecbc4dcf7e1a9cbbabe709c112f88
SSDEEP 24576:icP4mcvIjkGOxhKP2l71nNKbrh/8KBHsqjnhMgeiCl7G0nehbGZpbD:NP4m4IpOO67W8KFDmg27RnWGj
TLSH
T1E865BE2DABDC0096D0BB917886658A49FAB1742A1F3286CB1160933D7F77EE44F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 20af7681dd98845b2789563decc09c8da47c524774e594a7dccb5280757c9037
MD5 f18b24bf826908d8be8e8f2c71bad146
SHA1 2f9edc06fb2cfb0f5cad94cfd1670cf81699f161
SHA512 f001c108b7559b7c80931f0645cb1f1debeb8458f26165f694b064740c0624909940a55282f6080427dacff4f1dd40df2443fb1afa1c9c09f89fdd950966ee2b
SSDEEP 12288:DbsffXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18EE4011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 0aa15328b57ad9dc12c3875d6407e4be5f480517ebdd1ff939152c60e750547b
MD5 1b2d65fe4eea8c5b0bfb57e803aed826
SHA1 f743a4eaefe3a33fab45f04b321678c2755c62c2
SHA512 f66281e3ed476d6b8f0e866010fd94a9035819391ad1d6613fede366341748c2a801a82735ab07dd4b4f09bbd6ff08d7fd98d58bdacf77a340a392398bce2345
SSDEEP 12288:S/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:S/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19CD4237ED34C118BE97649B083E5E12D781B3E669E204483B94778FDF6B18A48F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 cedfe587280f2cd9954226db26a197c07032662c7b29ed9a7d031ab2e4a819d4
MD5 37f52f41264dc510f77509a851a11baa
SHA1 05ad947b20bedded9661969714063f9d4bddaf73
SHA512 4086121c7d7ee1e644486a35c5e86fcba777b7e89ce9a8013fd0ca49c0aea65f8fbd02b71cc18a76ed03d9845d82a10f213ec116b3269361fd15af379f7d3331
SSDEEP 49152:5a0h2GEkuAe73q3pp46zwwQ5Dmg27RnWGj:5a0hNYG4JwmD527BWG
TLSH
T10585AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 d6e89eed23553aaeb52edc319f0b625622937698ffe819f9aa94c77866d274ff
MD5 0e2a0b222d9cb86f064e091da0050221
SHA1 bb45a2ea9ee820acb63e6873abb604061ae8c3f7
SHA512 ae0e0ce6dbbd2bb3c4a6e06c3455bf8cb9ed5bc4d33c5220e3c10696d7271a818164c3abeb1be59ee73475b68f6373a3a760724a31c11358c094b6733730a351
SSDEEP 24576:chbHjPil8eOKaa+EUmUGhtgs4NmXEbZsLTQK1QsqjnhMgeiCl7G0nehbGZpbD:chbHjgJZHUmUYyH0UbETQK1MDmg27RnN
TLSH
T1426523BD125C21C9F136A2B99695D14AD531BC3A072017EF739392B96F33CE88D39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 b2dabc394218c9e5f35b3ed904409225223a60954432e1677a8ec9724167e98d
MD5 86674af8946af74e044d724eab256ba7
SHA1 b3edeb2d67811837a3e3ea0f25e780ab2f56ef3a
SHA512 f59074e5b3854327c2c9342c22e28015b59817133588099d712010f39bd4fdef5132f33ee96e6922a0282c18bcfe46b561f105947f44576649914de6c7ed67d4
SSDEEP 12288:HbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T108C423BE924C11CAD93649B5C3E5E11DA8073E56AB2004D3795778FDE7B28E88B38523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 3a6abb2e247e300cfc65c808371ad25af68ba4e1f59de759ab50091c9defe277
MD5 684d72dadb01864b95e6bbc7f1ea5ffe
SHA1 5992f211b60da57dbea8273780f14fcce8b15575
SHA512 80e2dd409c340e68072fa5f5bad0adeb7eff42fdb22166a9f7d641317e1432c10826d5ab032a3a8687f55a05868ab8db2ad62099132ab083320df2eeebc7a013
SSDEEP 12288:SObfA4LWOsvAYFTkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:DbL3UTksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DD250159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 056a34e71d82805c38a331ae2ef961b3f56587ab0dade44f25e74547b47b095f
MD5 b2292052158ee73bd3161110b0d26261
SHA1 7c10f9bed86f650e1cf8bbebaad4805045454edc
SHA512 ec8f6b0cf254b7d10757a8b554793c5c201214a7dabc95f153b4a93c4b6101444c0a65eb47047f5a4e836cc6ea49458f7fcefe48308e4d6b8bf59adcab2c0b2f
SSDEEP 12288:dpFtIOQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sOQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T133E4022E32DC10E9E536917C8692D20DD6327C661B2117DF06D180BE5FB3EF84D3AA62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 39a28e4dbdaba041df5480a771483a51d571a49dabf4d0b725de3ea3496c0fbb
MD5 a4ac4b63be2f365b658dfc13b8a51045
SHA1 b6716a05357122837e78ee57d0612269162bc038
SHA512 c459e7539f27c7477c3e3f8db3276541e17735908ca5e02159631b82f4f0d68397ade5d78a679e71b200ede477da02851f07aee116253b396637caad81eb5cdd
SSDEEP 24576:k7NM9YqZqmWMUkPjZM48Mv6bEhsvsqjnhMgeiCl7G0nehbGZpbD:k7cBWMpPjN8DbEhiDmg27RnWGj
TLSH
T1AA659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 5950b79bdfb902b3c47ccd24b00931e9a63d85865c705686835834c5b505e985
MD5 807b484e1a3c72040dbd9fd39fe1dac8
SHA1 cb04d595397cc45a4f38520e612f0704ff39c240
SHA512 bf0746d6711010c75548b37d25162035a77b630db152dce92d9e41b83e7066fcc44cb9633d88e4f79487af67e89f2591d8bf5ce0997c760a940573abf7c2460d
SSDEEP 24576:MW6BApg2YuyuNDYTabvcdvNYf8km1ZsqjnhMgeiCl7G0nehbGZpbD:MF2YuHNETovAvNYf8kmzDmg27RnWGj
TLSH
T17A857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 29582085b08ec3455fcd6065d4fb9dc309aa1b742ab3ce0d4072b762f73d7497
MD5 64c7e3045bce68c31895e5149048d867
SHA1 7eb472d2b8a92225b00654c2283f9c18dbacd85e
SHA512 943198ad48686e794cf4ccf0f3c0be0647ba265f1b470e2f240145823cd511390a8d38f945541b89c136b78af64c2437dbd5ce2c6d0cbe68791441f131183a39
SSDEEP 24576:mAFs06+OmlfkNXEbTossqjnhMgeiCl7G0nehbGZpbD:PFs060lwXuZDmg27RnWGj
TLSH
T1BF65BF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 395ae7808298ce37dbd0d89998fa028729c19735e3d8fddfaad205aea4b3b0c1
MD5 a5e3c952abb1e1c1e8ea243267358faa
SHA1 c0e27a1a8978a1b84815a71cc8f62eaca1df73a8
SHA512 86977f3708487c0be6b211a428c4d8077b42169d4af4805e14df67af901e4eea30d0f0784a681d8a12dea4d7b947527defa53e9504dc4003de0560447cb840cc
SSDEEP 24576:NJnJ5D3WXlsqjnhMgeiCl7G0nehbGZpbD:NJnJ5DGXZDmg27RnWGj
TLSH
T1EF15E13DD2A810E8D4B7C2B4829A5756FE72383D2F2169C728B4D4357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 26405e0ecf3ea544347b97f6d3d48d613e731b8e3b4b6b4dbd401bc88b58785a
MD5 9ac9de3e44c9fbda1d38278c2d5d35e1
SHA1 141c3f198bb70aefb5c4cdc9e0efcf2b6d9a2cb7
SHA512 9b7370b7cf5566044e8b7a433bb92da5cf2133dad7ab42138a4f2a1d00292f4506c6195fcce7e92aaa297076f9cb0222a08c8a0ee08a680fa5bc00a83a71d2bb
SSDEEP 24576:1EPghm6/7IIXdwcXrif7qQncjlP65i3VumsqjnhMgeiCl7G0nehbGZpbD:ig06DIKdwc+eQnSt65aVHDmg27RnWGj
TLSH
T15B955C15B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 5870800da0df8eef7b80b894b5549529e1382c4fb575199b21e41c767274f590
MD5 d9bc3372f0b8e7083605e52bd5928ff5
SHA1 99f3956c1071be41bb72b71dd64033365b7c7643
SHA512 74de2741c76f093e753d98c3504d1a7cd68fa4ff89e346f4cb6461dd37b003a7093b8924eccd22e4e27ce6cf22c62f379ac2c5e5acef058e1d9f018a9d227341
SSDEEP 24576:spUl8eOKaa+EUmUGhtgs4NmXEbZsLTQK1QsqjnhMgeiCl7G0nehbGZpbD:spuJZHUmUYyH0UbETQK1MDmg27RnWGj
TLSH
T1E16523BD230C70D9D13691B98690C149D662F47A0B111BFF66A2D27D6F73CE88E3DA12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 850KB
SHA256 0410aa3f8c5e27c124c0ab702325dd8c5481defd290d797462d04e7dde7a8f3d
MD5 9ffbbe9a640fca174e7eb6f79f4c741d
SHA1 6e497c519ed3dd92babdfefac43b32a7270c5ec0
SHA512 522bba337843ed4585fc85f8713e98e819a025d60803ddafc0de4c12070e15c55aae802804fbbda8ae4915d3729884b0df9add748d487b3fecbcad95f3b23706
SSDEEP 24576:jiUl8eOKaa+EUmUGhtgs4NmXEbZsLTQK1:jiuJZHUmUYyH0UbETQK1
TLSH
T19A0512BD274C70D9E13AA1B96A908146D371F07907522BFF62A1C27D2E23CEA5D3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 be23f0aae49f2319911c49236ad7fdaeb2cd5ea3ba7166764421c29107a766ab
MD5 d88cf1e589d74d935b6977e56e282ec4
SHA1 dea4beb83f3d3a264c5efc2bd11cd4a30e2b3caa
SHA512 d9b6f9058dec4f9ce23670fdb30b6ec67646ef3a1175ffcae758e97b68dda92d92a0840237bfc95c59d4b666c5ae7c483448c92ef34edcb42357927bebab86f2
SSDEEP 12288:7jkyyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7IyysqjnhMgeiCl7G0nehbGZpbD
TLSH
T14FF41259639C50C9E9760578C6B3D1589C32BC31AF2046DF6191FA3EAF73AE48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 79bb16afbbbcd95dba22873674253fa336758f665e7d2e3a3b868237f7426743
MD5 0640c04cb7709642a44c2496d7018e21
SHA1 107ac645288fc88a19be5f2aed89532bd73385f3
SHA512 94f03733f5d799d3e932e55b29bf8399c9fef5bd4126e10d503f300ea8c60b949ba454a6c36e26d3d6d9b981c355520b6d01a480e3c7f5e6c84c9d389a8276e0
SSDEEP 12288:SygXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E4D4237D525C20CAE93245B4C3E5E51DA8233D36AB2018E775E7F8BDEBB24D44B39812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 7d0b692384c770afd8ffd6e26cff19961450689471c8bb0a9b194472f972f3ee
MD5 1fc1aace98ec9a68b98cd867d9c516c1
SHA1 4024c67a38b90722571db2e561ad8ecaabca3ccf
SHA512 5c68a0adc36e8932450a7e3ecdc2243ac1f27c7f5979e6305d1b4070aa33741f4deb30451eba69f31aaf76bde586b29e7e5ca4c8f81b582807971ae6bce7a44d
SSDEEP 24576:zQ9MxZKdcz9dw33sqjnhMgeiCl7G0nehbGZpbD:zVKZLDmg27RnWGj
TLSH
T179558C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 aa924ebae2d57f437ce17094f75f6008df296776edd77ecf4930db7f3c59f83a
MD5 fd11b120d518a61d4a5b1a1c4d1f8c6d
SHA1 8bacb60ca47b238da596d62c60e6cda2e895a836
SHA512 433f2d39dde3be7eda73396578ac9e1dfd660ba12e9c87ab342b261fc1f5676cae4577531921d3b69dbaf2285cbfefaec3184ad91c69d01f6476ffd779862164
SSDEEP 12288:uyoKo2JRple9pKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:uyocDApKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B9F4E01FB76D40E2E176813C8985C249E673B4315B2257CB6692C73D8F639E8BD38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 fee0e3003846524d0e8fbbf24ca108f80b4b1ea24436b3d8611819e6e0cb1c6c
MD5 5c4c24578ef780356e72a15bf2389ef3
SHA1 ae06565ce20035651a5e0edacdbcf701e508b51d
SHA512 8e2eaa3857eda1b2ff4876f1b05df0f14cecfb71525ca1b09f0c9597ba4cf1917ef35a748ce5b1e02e5bb96bfc92367362e807da97aaf3dd67ea1a3fd90f5944
SSDEEP 49152:YWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKeDmg27RnWGj:60zuNIAD527BWG
TLSH
T1F9A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 ec4a17d87b6ca445756d6612e53391b5454279cf056802dc45bcf42306f31811
MD5 d7c889d054d197675f4bad0c5e2c9cf3
SHA1 99ebc264f4d05410bf5d8d7f6f94de6ae02c964d
SHA512 eee4d095538cc728cff6afb338c2302d2c9b916c316273ca3cd5c9a787bf339b04324541bd623f2a3e78fe654b3707b18473f3cbea781ee554713ba879febf2e
SSDEEP 49152:fTDxR+N5YzTajMgJZHUmUYyH0UbETQK1MDmg27RnWGj:Pu5imUYUWdyD527BWG
TLSH
T15EA5E12EA7EC15E9E17E86799B23C502FA727821033153CB42A0C17E1F679D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 610dbc666f63e507d8799ac3282fe8386651d0fd022e796e7603597036b408f2
MD5 d84ff3154617d14e1b9f0d90dde1543d
SHA1 164b6f2dcdf07b6b02a99b6858549fd146aaba1c
SHA512 f57310ec7e56f7628ed20c4c8d49e997484e125924e513755c57494380303dcbd8fdcb09ae72b75b45275d40ace6e3775eff707a767ed76b468c052370d7a9c5
SSDEEP 24576:Y1QT7EcpfxR+N5AWAz3ooiYhjMqbzl8eOKaa+EUmUGhtgs4NmXEbZsLTQK1:lTDxR+N5YzTTjMgJZHUmUYyH0UbETQK1
TLSH
T13F75C02EA7F815E9E17EC6799B23C502FA727821033153DB42A0C17E1E279D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 849KB
SHA256 898922796a15c4154d4119a44ee2e19d030a0db0b96925f5896e86942e125911
MD5 7c81dfb5e362f00a76e4313198acb66c
SHA1 8fa57e2c122f97dc9d4f2494ef9acc0cd7b5da2c
SHA512 e9b9a0688f1a717b7cacdf996d17654a93bfdae58864c9fe3c76b1f29f660a0bf43739e11739a921e5c16728cbb082e96071934deabb0fe5675900e3d29b1c33
SSDEEP 24576:2hbHjPil8eOKaa+EUmUGhtgs4NmXEbZsLTQK1:2hbHjgJZHUmUYyH0UbETQK1
TLSH
T1960512BD265C25D8F136E2B96A918147C330B83A071117FF639282792F23DE99C79F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 61b656db2c5edd4b3a657ae11468151eb9120308175be3837deb862bd849d3fb
MD5 dd840e252a60eb3cfdaa3642f8335499
SHA1 34e2c8550da5899a081e98d2785d1c4b0002befa
SHA512 cfce2710621dc4dd2bdd2b5b2ceff5a39d66be0a3ff6989e46b9bbea36c6d03a4e602b95402c87968d226d0d2b9f2524b6b057bc0e4f33ca9847e4f29a0922fd
SSDEEP 24576:VTMdOz0FFS+bmSLNsqjnhMgeiCl7G0nehbGZpbD:P0K+bmSLxDmg27RnWGj
TLSH
T17215E17EA36D14E5E47BC17CC653D90AE9733862032166DB0690C0B97FA7EE46A3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a16adc454bb6346b.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\a16adc454bb6346b.bin
Size 12KB
SHA256 a365a687bfb18d526abb1d384c91aaa6ed18a033189ce1630917d9c134ffdac9
MD5 dc49a263a5c1f17a065ecfd7c4618741
SHA1 3485b0b076ea8d9f32ba7dddfcd5469da8668e46
SHA512 e856e5379bfe5c50f3e51b1188cea400b58223624efae56d56bc3e479314c01e2a6a589d0bc585bdc4a28e6658ccf8ac4a6731ffeaf36d089d22f1ff692fb3a3
SSDEEP 192:SW6WQ3ZwnV8JJ1eBc4VlwCPPgyCCjmT/3P2t6X0Ldp8s+Av88Wthmgpoi4k:k9ZTYc45PPgvnLP2SUKs+WWthmEoQ
TLSH
T12C42D064A67C39521EC8BB0C1BF9B2773A5470250EFB22D48423DF8416C3067A5BC369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 6b976fd019c3ede9968c03e4e64c01bb4273ada0181c73cd255bf76d68788e4d
MD5 8fcc53c2d4c30acbed00ad7de5858519
SHA1 c62cefbd0a0717db73c43a6ee9bfe8bb95634fbb
SHA512 fc48a28d31971596cf531840bb23d3cfb2437244a1a06c98614c8e1367042b9bc477092eeebf5d44e9841214891f22fcdf2a2c6ae14416156c02a56fc7f6264c
SSDEEP 24576:93YgnJcRTk4yti+R5dBR/zsqjnhMgeiCl7G0nehbGZpbD:9IgnaTk46pBR/3Dmg27RnWGj
TLSH
T1D945BF2EF2B910B9D8A6D136850147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 ae1f71ca6abdd1ad2e3641b2ead46079fde5017a359f4189c4ae1c4aa54bbed5
MD5 c863e7eebb8b844f8211ba87c6d34ae3
SHA1 6649d04288c53f4887deb523b130bb62f5172ba8
SHA512 7d3e2cc3e37a44c5528a0a753517842e4aa88c9eb570f9fc000b76da40ee231ac2d35a4036900852badb04cf28fc5480b801f86eeea3121dc33e3bcff1d13761
SSDEEP 12288:X4KoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LosqjnhMgeiCl7G0nehbGZpbD
TLSH
T10DD4126D53DC20C9E4729574C3A6D1199832BC36272019FF39E2D9BE9F739D48A38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/344-162-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/344-380-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/380-167-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/380-165-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/940-100-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/940-169-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/940-94-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/940-103-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1480-406-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-402-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-420-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-423-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-422-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-421-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-419-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-416-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-418-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-415-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-417-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-414-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-413-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-397-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-398-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-399-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-400-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-401-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-403-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-404-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-382-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-381-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-383-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-396-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-395-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-394-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-393-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-392-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-391-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-390-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-389-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-388-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-387-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-386-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-385-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-384-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-412-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-411-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-410-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-409-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-408-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-407-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1480-405-0x0000016131450000-0x0000016131460000-memory.dmp

Download

memory/1684-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1684-47-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1684-55-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1684-130-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1720-173-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1720-112-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/1720-105-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/1720-111-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1804-466-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1804-187-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1804-228-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/1804-212-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/1804-378-0x000000000C960000-0x000000000C968000-memory.dmp

Download

memory/1804-196-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/1868-123-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1868-42-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1868-41-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1868-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1868-34-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2124-182-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2124-465-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2464-431-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2464-174-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3132-548-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3132-515-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3652-76-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3652-161-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3928-179-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3928-464-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4104-127-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4104-181-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4168-178-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4168-121-0x00000000004A0000-0x0000000000507000-memory.dmp

Download

memory/4168-116-0x00000000004A0000-0x0000000000507000-memory.dmp

Download

memory/4168-124-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4188-358-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4188-146-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4188-144-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4188-138-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4476-150-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4476-156-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4476-158-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4476-374-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4504-303-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4504-135-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4732-507-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/4732-550-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/5128-476-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/5128-549-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/5316-170-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5316-429-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5652-131-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5652-186-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5652-430-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5900-93-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/5900-57-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/5900-21-0x0000000003210000-0x0000000003277000-memory.dmp

Download

memory/5900-14-0x0000000003210000-0x0000000003277000-memory.dmp

Download

memory/5900-7-0x0000000000C40000-0x0000000000DEA000-memory.dmp

Download

memory/5900-8-0x0000000000DF0000-0x0000000000E75000-memory.dmp

Download

memory/5900-1-0x0000000000DF0000-0x0000000000E75000-memory.dmp

Download

memory/5900-0-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/6016-72-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/6016-69-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/6016-74-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/6016-68-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/6016-60-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download