46248f816022cbd7c07b042294033689e858cef00f62ad24dc57c451da39c5a1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 01:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_7a691647e4c0c2993639ae24803f2dea_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 1.3MB
Sample261030-bweybsvx2n
SHA256 46248f816022cbd7c07b042294033689e858cef00f62ad24dc57c451da39c5a1
MD5 7a691647e4c0c2993639ae24803f2dea
SHA1 34c98e168a147b43691a904059887ef3d2b07f7c
SHA512 4ded7b527883cf6b9674da65131118c1f58b0f1e8aa8863996569dcb5b87f0bf3e54f4e35f20f06f6304c43d984b9ff2592ff1910092c6b7fe3f8c9b57d41e06
SSDEEP 12288:7HBq4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:44nQ/tbw/2Mkjy6Fr7g0ov
TLSH
T17755121475D3E726D412C5B1485181B15B7ECD812FD1D28B7A882F2ABEBFB9C07EB284
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
752	alg.exe
980	DiagnosticsHub.StandardCollector.Service.exe
4736	fxssvc.exe
5064	elevation_service.exe
1920	elevation_service.exe
680	maintenanceservice.exe
5004	OSE.EXE
4216	msdtc.exe
2376	PerceptionSimulationService.exe
3848	perfhost.exe
4696	locator.exe
3716	SensorDataService.exe
5028	snmptrap.exe
1560	spectrum.exe
1684	ssh-agent.exe
3560	TieringEngineService.exe
3816	AgentService.exe
3260	vds.exe
2180	vssvc.exe
4436	wbengine.exe
4040	WmiApSrv.exe
2684	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\62a0b92f288da564.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-28_7a691647e4c0c2993639ae24803f2dea_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-28_7a691647e4c0c2993639ae24803f2dea_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-28_7a691647e4c0c2993639ae24803f2dea_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-28_7a691647e4c0c2993639ae24803f2dea_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-28_7a691647e4c0c2993639ae24803f2dea_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-28_7a691647e4c0c2993639ae24803f2dea_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
928	3280	WerFault.exe	85

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_7a691647e4c0c2993639ae24803f2dea_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eeff7e570e68dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000852686570e68dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c61cb9560e68dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d72f1570e68dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007760a0570e68dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000055db39570e68dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000799aba570e68dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000001dd1a570e68dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000071bab6560e68dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b591ce560e68dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
980	DiagnosticsHub.StandardCollector.Service.exe
980	DiagnosticsHub.StandardCollector.Service.exe
980	DiagnosticsHub.StandardCollector.Service.exe
980	DiagnosticsHub.StandardCollector.Service.exe
980	DiagnosticsHub.StandardCollector.Service.exe
980	DiagnosticsHub.StandardCollector.Service.exe
5064	elevation_service.exe
5064	elevation_service.exe
5064	elevation_service.exe
5064	elevation_service.exe
5064	elevation_service.exe
5064	elevation_service.exe
5064	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3280	2026-10-28_7a691647e4c0c2993639ae24803f2dea_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Token: SeAuditPrivilege	4736	fxssvc.exe
Token: SeDebugPrivilege	980	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	5064	elevation_service.exe
Token: SeRestorePrivilege	3560	TieringEngineService.exe
Token: SeManageVolumePrivilege	3560	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3816	AgentService.exe
Token: SeBackupPrivilege	2180	vssvc.exe
Token: SeRestorePrivilege	2180	vssvc.exe
Token: SeAuditPrivilege	2180	vssvc.exe
Token: SeBackupPrivilege	4436	wbengine.exe
Token: SeRestorePrivilege	4436	wbengine.exe
Token: SeSecurityPrivilege	4436	wbengine.exe
Token: 33	2684	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2684	SearchIndexer.exe
Token: SeDebugPrivilege	5064	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2596	2684	SearchIndexer.exe	123
PID 2684 wrote to memory of 2608	2684	SearchIndexer.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-28_7a691647e4c0c2993639ae24803f2dea_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_7a691647e4c0c2993639ae24803f2dea_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 436
  2⤵
  - Program crash
  PID:928

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:752

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3280 -ip 3280
1⤵
PID:1088

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3212

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1920

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:680

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5004

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4216

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2376

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3848

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4696

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3716

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5028

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1560

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2688

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3560

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3816

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3260

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2180

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4436

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4040

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2596
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 37cfb63244d53593c8212221a32198396ebd6e29ee0d9d960baed128042112fa
MD5 c147da70214dac2de0debaed2a4ee164
SHA1 d262b183b6a36d91a0f5d1217f518da358bb5802
SHA512 d665e8dd1161cee645577925b3fefc42e1664a22fa227313ac3a497256d975f61fd41a6d3eba31337ac5d1898f89b74cc2999f7185d90dbe58318791ac29c0c5
SSDEEP 49152:wb+632BuPkFKRrdE6ohmstBhuXjfS4LWxneQ/lFTjN4:a3q6HjBiLm
TLSH
T137D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 883d7de24333d8e90334eb75637389e6e247cb44c2d538ddb1265db7dc2e71f3
MD5 1fcdb55e6869fb7b5434e02cd56f752c
SHA1 33b3f805118e1b771a4dab5ab5e621db7f28727c
SHA512 8c6eea0693ebc918f6c417fc0913a90ace2ab844765ac17db72d54dcb19a65fd1da657cdaad75e017729b431363b563cd5b342352571bdf386b44bb4febff015
SSDEEP 12288:v1XLsswWkxy2lRq2czAxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:NXYfDtczABnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T11E65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 20b1d5daae3cbcfcc536f98c3df3e393d1536e65299f20b3b07a7d284f9bfd5e
MD5 7cbc282a687275559f9bf5f2fe985d2e
SHA1 953fbecadcc4ca87c601bcf19dd0fec2156aadff
SHA512 f9c798e7060655cac4b48b81071c1ea1b5b85139198a55c33b4c98661e5ad6255f6a1b545ffc157ef3ed23b5723b5a596caeffc4dc1efa9176f573f67df68bf0
SSDEEP 24576:a0Le5ji0hmxLrMGnQ/tbw/2Mkjy6Fr7g0oo:aPji0AlbQ/lFTjN4
TLSH
T1A3859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c1211ebbc6616ad82c5931e3e3a737a2a45b5dd0610b8c21607d675f74481f89
MD5 e4ac8eea262a58600569e6933a33bb93
SHA1 af9b59f876f4b2e4b4c763be79433c28367fea6b
SHA512 8aa97da1dd037be368ea10852006019b953b3ae407ff2d98972a1d197dc365867755b2ef0cdc3119bff107136467759d23d97600bed38b08b10e17a1ebebf78a
SSDEEP 24576:va7/ezSC6vUyD/aqgrvWE6q8wyuknQ/tbw/2Mkjy6Fr7g0oL:i/ezSC6vUzPvxHjyvQ/lFTjN4
TLSH
T118755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1ab01bd8783141e115983716d95221cd14fb1aa0b702f90d5159953f9f6b2b7e
MD5 149228343883691a3abbd6051dfba9dc
SHA1 3ddcbc7cba4e2207d39c5ffb822bc55073203c7f
SHA512 2d32508cd76539849898e951478c41b08e29f0e3a17c4cc929b515efd32c608ff7cc49254b8aff774dd9ddf6bd9a1436d923d7c498e68f36c9dd2f6d8ea0b26e
SSDEEP 24576:1VbqPb88hv/l+69nQ/tbw/2Mkjy6Fr7g0oM:1VO88hXl+aQ/lFTjN4
TLSH
T1D4559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 84ed558edd5670cff69f07fbd3f845dd1877709da0f40b684c6d3eca42a5f692
MD5 95ac9fa3329c9254a38d266d4af38b17
SHA1 4c34c75a205b4ef160e815ee661bc35bdf012d19
SHA512 7966ce5199b46c357710901138aae04a28bb5b282c2b716ca82f23bac34a2085787778418bd2b1e00f6d57da60760ce6ccf18c4a4fc53de96dfac82ccab8fca6
SSDEEP 12288:1zSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:1zSnQ/tbw/2Mkjy6Fr7g0od
TLSH
T1285523696A24F897FF2B06B15CC284826B7B0EC1BFD4EB4E6744322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 53df04bde2841cb41284aecb4da7e86132b3cae7083871fd380e5fd208ab16da
MD5 901707e4b1acade51ca1b6507a0429f5
SHA1 38ef54f165f1e887a2ff6453bf616a0f2a4decf0
SHA512 54d51420e56bdef2fe8705d286b83d903edc1005d7d19259c5eff73885c879ea66e9bf2d1f099485768f1ae8eb415d6877af15e9d42d580011bb17751df97bbf
SSDEEP 12288:qeBNUbTVO86UlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:qJIUFnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1BE75CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 24bd79ae058a390c4fdd381461bc8280cd8f50ba04a01a40fe69347521f89e11
MD5 dc954887fd0225c5b75d628f6e6dbaf1
SHA1 bed039becac91df41b036a749d2655341a56c410
SHA512 46841439b2f515055fd7c2d172f9a353f59b51734a7d75554f3399b23b5f7186999885a762f5fa899febe889320ae602d9fd254ac6eda20bc3c860639dc17650
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THN:JQvGAdlCEL8c/yRNw5CnLm
TLSH
T1A2267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 94ad40e0ca5b02f30c1487580acf941391d1b63a3898f3539b981f99c5266da6
MD5 6e58991f56b7594f9fe248a1a44227e9
SHA1 6b6d18cb277618f23e42aa88205ca47650257576
SHA512 ef74688efa5f4f67c8e319cf50cb5f2b7dc6e89421b50853665dc9372ae5f7d380aac849063481cd72a2ca8f3760aeecf2dd2e3da5f48dd7a272a97d0be236ac
SSDEEP 12288:KAwSfxL/2Dc39DLLmt0LDQewsAj7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgF:fQewsAjrnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1E575E031FE74E436C77F0DB21B22C706593D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 37c18db2cd31a8ea39583ad67e05ef2b47efa830ef07a4bfad180e0b70e7a207
MD5 661735ae092f3fa7ed9fc5e91c6d6602
SHA1 968485cc3ab0d3b7044a7bbda5e77af9098d990e
SHA512 8f96cd13d68691c9c8e0756e71712103ddaaa2cdb2a40038fd9ef97471ded019cf2a6444e7b0896ca17c08cb464aca35348402efc8666c038e9d6d3416177d55
SSDEEP 196608:TUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHoL:TUEtQevvqc2W1cpV2EI32
TLSH
T1BA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1117ca3028d50577112283f4136ab0f7d88ab31c8b9628c8e3957e8910ebcc3c
MD5 3d057392ea0a3b8b2281e8c80e314466
SHA1 06bcea43eff0b501c205b5bb480b9a1e87022d82
SHA512 8c9e29d436c5f2130c8de87a7c8d25494a696d063f2ce30846f4db99761412c3c4158fce7634972c1d73bc36b090c3f6d4a231c6589ec3dc293b4095f37f7d69
SSDEEP 49152:XCbRquA/m2yL5zQfFiV+XenmE3/zLQ/lFTjN4:AoqtVjnmrLm
TLSH
T133D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f483341423b29dc0e31c24db546b182377111da1be9f6da99dd5dfeac50abe60
MD5 0c0ceba19e2c48d444732f8672a94b8a
SHA1 8afd65fa7762ea1ba14649d74b95fa3bea7a432b
SHA512 6341f96ebacead5902304bc4e8942c9ce8c9e439580844e82054caacc0086c9a7e86481412865da8e618adcd32c6a4b1edbd6ce24de3f603115fa7f4ee935384
SSDEEP 24576:fAhGLJIFoiwtA5l7S53onQ/tbw/2Mkjy6Fr7g0oo:fAMyFoiq5YQ/lFTjN4
TLSH
T13F35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 b1955df8c682365606faff1c4624b8beb9df0db8cd1e8646e5b067dff31f8b12
MD5 ee584f817731e225a4946783ad9bf641
SHA1 520ea830e482c35addce9afcbf0b506fc8c72c38
SHA512 6b430785468a30b268bb6b55679ce704ce9974d0e22864a34cda58c511609d072f3cfbeaff9524786fcc714f524fd29c2b2d3689efc634be47ca0ca30c2f3d80
SSDEEP 12288:Emw5HEjsChN2BFgl0WDm+CkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMh:hwuHOWPnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1E965F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 aea03ae3522a185570fbcc519c314d9ad601cfc9958c6d936b8b276aa8299c2f
MD5 feaee813dc4a107f17a1d7872c47c5fc
SHA1 97be468156e972440dc72c9e3130606b997d0058
SHA512 a6d2950eabf8bef089cf736cb96f8dd72b5474180bf349d7769af351defc60e7e6d6baf19e3b0fa673a6d52d113415cb45f17c751aa9f698dd972999160e0e48
SSDEEP 12288:OXZ1IyLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:eZuunQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1ED55126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6b38dd0384d4916b1e5eecd775f35455214861ad1b727d1481bd3094bf868b5d
MD5 da82b22f1683a95020264d7ba8421512
SHA1 8aab1ac8038f0d963d35fae15545db3349db6df3
SHA512 f793181db56e6043986cc93c4e1d382a017824caec634211a05989f2b8414d26397a0b582c8f86503b7d466a487d43072e31149718f75a3218925e2ae8074d65
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UB:yQRQyi36YOcPQLvw2gAf+PN3+Lm
TLSH
T1E1667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9e4bfbbf730cc0a65d39ded93ad9ddecffe7adb8d0df7e7be454f78e1960b9de
MD5 f0996de4b59f302e3f1ba5cb6fe76df1
SHA1 6f38b1e0331fae2d11606e564e5048633e6eebd2
SHA512 0279b14ce80f00cd0de4e9d76f1f3150725e9c3154b9199e4d6cad0ec4ec7ee3075cfa1af4f7c6051b38bc0ee755f8dc95ac457d5cead12263b57ed07d98b559
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UB:wQRQyi36YOcPQLvw2gAf+PN3+Lm
TLSH
T122667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 dddc11cfc62acbbffbdcc88c6adf81cb1b1cb1d6493cd21ac32095a63dc274c8
MD5 4c314ce5a376e63c6faa255578a29d83
SHA1 3305276fe7c46d877e9f0b4adfa4530de9362479
SHA512 7e01af1d6b01f7808e6de5db9729a0f9c57d189e4b5db5f3d07ae2bb68b2cec03179c7d3882be498be02b565117fea3c5f1a34de9fa2e3140c1c197688dadb99
SSDEEP 24576:9wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0enQ/tbw/2Mkjy6p:568Qg55nhheWu7PNU3/bQ/lFTjN4
TLSH
T1BAB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3b36cd5582dd89924c8464eea4e2c21e6a4930166cef4ae2c9c0c60ab2d2a0b7
MD5 8895be4a2f731aa98c73cedabea04cca
SHA1 2c720dd99082752b74d48671c01bcf499af488b3
SHA512 b8dc35da4aa6983260fc6feb639a3695c317d88a13b2d594d872e632fc6779b4711c217b7ce74a415cf71f0ea85434cb72a617231a78210394764612f2569e4a
SSDEEP 49152:63aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99j:ry5112gYy5azzVvL69nLKnhZdLm
TLSH
T19B167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a2fa1401bf28585cfbed9562c8846d8148ce52acb560071a40a7bdcd15ba7a2d
MD5 0038e41a572aa79e636f3c7618408c3b
SHA1 298392f837dd41eb977f51de8e8c398648a21d29
SHA512 cc0a39072752d183aba103892c41ec925124ed96fdefe9a5942d6daab301eb5a85c646454726bf7adfbca2cd305cdb4ebdfae1be7b93332abdff6db90da086ea
SSDEEP 49152:VB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gluQ/lFTjN4:bu6JmVxd2dJLm
TLSH
T1A8D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a4466079457a41bee703d5eaff0a9ce60f55d4a9ed5497b6b2e9461c69a52ad8
MD5 8b89a6c28ef6c03987bbd53675614647
SHA1 235d9ea60d5f642b6377fb7bff5a646243104d00
SHA512 3fd9d7d20e150e92225afd50d4d7af632626fbe5976369ec00e08f36fdb3424e6552bb42dcd3520bcc8ba85dd9ec45747c4e8c08c2f4dd8de148023a4a4495df
SSDEEP 49152:11hpsNoJpF1A6UU44CwH7R4xlQ/lFTjN4:1mifPbRrLm
TLSH
T1EAB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4a975d4c8d8b6efe9a11681dc0000332ec6b2e9ccf72e4992f46bd74176b6146
MD5 443b0f5f81b9991b5e0b757dffdf37f6
SHA1 3e4261f6c9ec7caefa4bfcf9ae4057b6218b28a3
SHA512 79ff0fe7de1b14ca543b52f4cacdbac3c7a31b02160b1e9b52696ee37bf944b342e136a546b778dcd08cde5c19eb5581b5c29dd46a62b86143778cca0c50a648
SSDEEP 49152:3SuZQIY0Be2KRRVtOnks6NMHquQ/lFTjN4:t5dKTi61JLm
TLSH
T1E8C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ae9c2a4f0082c1a2c24bbde6f8e4622697066cc74d87b9282abbb5ad13b8c244
MD5 cc06a09412f9f55683a0cfc95b527b53
SHA1 23eb7b6496c524a4caa21ad3a07ec64ae0a1bd4c
SHA512 23ca9ceea42633907046ecabad8854c0176dc175c3b8a53ef9ec70b280befeea821d984a8318631cc82528dea01c1e785ad90f3f839c3256cb367488e6b3ba52
SSDEEP 49152:XhtSn8EApI0figngiDn0AP5wBQ/lFTjN4:GX2iyphvLm
TLSH
T1FD95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 7d94a5fe7d3ceec7c21917bc4581c709a673504ad49b0259356af8199c599242
MD5 1af56acbc803588b357770c73ef22ac6
SHA1 a9674597854a6a83f9bcf82d582de120ce244d6a
SHA512 480fcf9d9c37068c475df1e61091267b9fb1645889738a5901795a8547a1f299a800d12c7f0dca03db193d1e12334c1ea1e23a835e991e87857050881a097bda
SSDEEP 12288:IaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:IanQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1E15523697964F98BFB1706F18C828182A73F0EC2BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 19a9881b9926b82b9b39b9f8bae384f69d688c560276a665eb0cc866cbe75dec
MD5 2488b055c20d25dbc05d66be15bb6b00
SHA1 614d385a7482d7e3b3e9047df2e0838561071a50
SHA512 72ddd1f3210b25ff11cd9b4c2732ed332e650a412ede09d073d21ae2618dd2254523ed47e2e2c3d6855632b890d52e3035f433e5f7cf49eed36413bdacd060cd
SSDEEP 12288:QnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:QHnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1885523697965F98BFB1706F14C828182973B0EC6BFD1A38F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 1c77a76e88393f77225a8b6d697f84f2a5012c340020efb9a5673def6f232144
MD5 a557d6db5fe22d5d7128011005595396
SHA1 03b0a02b0b65aaa9081a3ebc31da82bccfa621d2
SHA512 703b0183f13dba7eb6e29ecc74394846387716acdca37cc7d101fb91bdcce79d7f5e59b848a2efd29a9455f294b953baac6660af86d258900e8ae49abdfac330
SSDEEP 12288:2NGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:2tnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1E85523697965F98BFA1706F14C838182977B0EC6BFD1A38F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 d9b45b9f656a7bc24a470b8d5c9ebe280796d92e2ab8d384ae80b6d8c55f20f1
MD5 55dce9065b726f6175bb345c8590e1c1
SHA1 2b9b5c1aafde57f7562f6e1f1a650dcde6a38bce
SHA512 93a93ffdd70524d87a19f2dfd7f1a165091c49430485a0b7a57fd795ffca2c68c92e1bfe572df330a82792298148d354175b5af412a9ea6d380727085725fe12
SSDEEP 12288:hVIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:UnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T15A5523693A69F4C7FD2742B5CC938142E77B3DC1BBA1A38F6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 20fc98c1eb0d49541e2d115cf9b9a259ef6e4c61ac21ba29b0f9c5ef948a8735
MD5 03339ac5dcfdbe2569519d8266afaa37
SHA1 656f3b910d94c75bb6e1c2b218f69d7cfec6ff79
SHA512 ea25d66df5d2557872abe528ff5ec1c7de092bb1432931b95df8cbdf14adb75b50e5979c1e9bfe3c88e68464fbd93e100b5e8c6944af24291a62ee93303753d0
SSDEEP 12288:EAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:EgnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1CC5523697965F98BFA1706F14C838182A73B0EC6BFD1A38F77482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 4d8d7c00ab5d466add5a17565b212d29cdb52425260e010b9569c2d02bd90004
MD5 32208df86afe26adf07c0a3446fa4e08
SHA1 f8690025a6863a4caf474e53b64275f64681e264
SHA512 771ef1c7534106bd1943ef82e66c880900479f0f9628e251496c33a5e7cad897438d6df33fc171389e26e7349061a03a7e32b094966e5f2f51a61dfad8c62d58
SSDEEP 12288:JjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:JTnQ/tbw/2Mkjy6Fr7g0og
TLSH
T1185523697964F98BFB1706F14C828182A73B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 eec07ae18ee3dffad0186555fc29e64e4023c6fe5901599cb64da43ef62a88d3
MD5 160aaf6bc84ee6a9eeb2c4dc5fa92742
SHA1 2db7f0e2ec1eecb3efdbb5ba42982f6aafa7edad
SHA512 5e765127688a2d4f5bf870f25b162901dcafc865b09d58ffad2ea01fc0ff18f8fa852a4d0a4ceede4882a3cac587115f65698efce1a72ffad5b296c3feb6283f
SSDEEP 12288:rfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:r/nQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1625523697965F98BFB2706F14C828182973F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 edfe281c09128e46daf361d9d2429a2948debb43d808bc397b313a77dc83705e
MD5 b826ae49ff7f5e3aefa26c17b36cbc7e
SHA1 fbe731187752bea98853be901c5ab3dd0977696b
SHA512 82e4fae6abfe014d85204bc5e1fe72d7574e4bd557d200ff0611dcb6be4d6cd54fb26ac1cd860cb6e4977539067b1b59f9e983856f5a2d34f78ace64ad1eab96
SSDEEP 12288:iiZwbDzzFEoS2cPvyHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:FZM3zFVSOnnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1607501A5B39058F9EC67423ECC528906D7B27C5A1BA0C71F13A4362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 76b7c6525697bf96df101ed06f31f3feff9241c6aeea0be0ab2f3f9cff1ddbd3
MD5 ec963f2147ed7d2fcb34ced2078f79f7
SHA1 acddd677331537a12b7b8f14e03689dae86fa5eb
SHA512 cbec5515ced523b41778e8dc3c9d0117cfc45387d753d5f7f37b9ae28bc636fb60c018afc77332a1b96601671633609a7ac93a83c543842a8774756ef24df591
SSDEEP 12288:2+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:2+nQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1275523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 afba49c053172a0f47594b7c8b0da56fd166a3e3d96a2d6a0e8ee294776d6b44
MD5 2c518b5241fdc014609ab7e1993d4809
SHA1 d47671df5d6da7232a2f3248e72469c75ba72bbb
SHA512 6c8d7ea45dc5dda538cceb471750d09e043674d10ae92f88f7b00004be7673ba47db4b508c71b1626b0b0d8f76d4bfb6bfee66ed9e7e19785e16a8edb2de6b36
SSDEEP 12288:/iGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:/inQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1AB5523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 a957584e6415454b705b0d60b7e8234df78abdbd28965f1f35d496e006f93bdf
MD5 98f98f8a1005c5a28631e3680bca6d10
SHA1 2383840062a4ec2b55a77d9c8305e2f069480c45
SHA512 c6feb86b84ef18e386e686119f0dc9b29742098e2a30a673e4c06957e2a9627e8757b368ccd8da82e7a55ef9bb693c6fc935ac496c415d0508679272b38d6af8
SSDEEP 12288:PyPz5L8LGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:izy7nQ/tbw/2Mkjy6Fr7g0oI
TLSH
T14965021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 497863e59acda926e76b2aba74dc0e270701e6ccd1ec62f03e6131986057a909
MD5 c29c2a3c8b758c71637affaa0ac66077
SHA1 26f363b45513af1e73b6d107572cc875531f24b9
SHA512 976e412e85ea65bc4aa68b3f400a3924aefe3e3f2750ccfa6eeed856f0501fd727f97167b71f99e8c92afebf89f330b3f16a9099cb6b6d5d825779ff44a1c178
SSDEEP 12288:T+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:T+nQ/tbw/2Mkjy6Fr7g0oy
TLSH
T10B5523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 419d20d6510fccd00c4c4e90346ec9baff6de2dbd5c0462832167acc097285a1
MD5 825558b3679c3d78faa2282d257c6965
SHA1 dbe00f3d6e19d28c5aedd91090fbe7628314dd9b
SHA512 28876334683664d162ead409c0025f1300a036efa5a07af31f4283221f88fe35986bf6ae218cff49884cd9f8947bb0cde9d2d04c3a966a6bf4de73525645d3c6
SSDEEP 12288:L+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:L+nQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1475523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 b0b86e02113b422c9dff9b8cee87e552dfc34f9db584204c184780fa707e4169
MD5 6b6d32050f1286ff5d1980ad074ea2ec
SHA1 9eaa3bb0753fbbe43bca7fe8fad20023b0d19331
SHA512 2e7f02e67531a921ded40f2ec578d2341a6ff7fa5012f18b1266057758303e2f8ebb5b6d4e698d6c26c3d9a93702bb3f3312ae9e14d75b410f894576fb4dcdfb
SSDEEP 12288:MyPz5L8LGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:Vzy7nQ/tbw/2Mkjy6Fr7g0oq
TLSH
T18365021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 36fcf54be26378983e4c251c7502137a0f75ace41c2d1b1c82bba4276b361533
MD5 4fe22123a4ccc9bc51e96e9623a35c9a
SHA1 22f8be81ff808d79a813cd898392d8c48cb043e9
SHA512 694dc90d7c692994b3f125ef0ae155db2c745d58402220be9c6ce1b400ed455ecb9f9e9f5749f1937432758b4bceec8f6e17fe806d5189bedd494c08dafdbc71
SSDEEP 24576:8T0aLl3z0zDdnQ/tbw/2Mkjy6Fr7g0oJ:8TDLljkQ/lFTjN4
TLSH
T1A97501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 c7e2a6855f6dd28955cb07deac151e88d486ca9c74e1ed627541497958aa3c2c
MD5 a68c90b6113bc2220994cbfdd1492a9a
SHA1 90af36bef4cc79c122944d484a8c9392c18320b8
SHA512 66462eb968ee51b01f59873bbd988b26a15296c01d7ffb0e4fc737c4bda97974b544bd675bbaf4233c86b09b4abc6c3f3b56210f8049f22aa3db3c407021724b
SSDEEP 24576:x31d9CHKy7GZpnQ/tbw/2Mkjy6Fr7g0oI:h1d9CHKyajQ/lFTjN4
TLSH
T17C85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d2d73e55573ad31ec5e120d308bb04405be252ee6747baf0b1449ed839b7b7e3
MD5 c46e29fe5c6ad56781f30b9e7e2f1c85
SHA1 faef190b3fd70d9afa00d2a3507aeec492204307
SHA512 707e466e821dda413dab7e3f6b5acc2e45d3a99b058045f9ce454e63f0a8711a74c933354aab8e10f556f2c91d88c3d77979d8d8ecda5758ff4f3fd1f653ea6d
SSDEEP 12288:AtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:ANnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1585523697965F98BFA1706F14C838182973B0EC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d1ac97afd899b00b608a7f21cfe8401dc0c44e1d977c754e34bd52de54dbf356
MD5 0325923df3c990d1bb890fa115d56c74
SHA1 1ea1d726771ddf3403d24b8bffb63664db1a615e
SHA512 c00fa7bb9d81b148f389b180a631fbfbfde76a01107e0a3f8ca78cdde5273e9c4dbb238b06e73307e069b2cb5488ae9bfb5069e0b93effc6be547565a91c56a9
SSDEEP 12288:qrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:qbnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1675523797964F99BFA2B06F14C838182A73B0EC6BFD1938F77481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 f1e8ae07a5dfe31a49c4b8e7e39c5c2a7125200fadaccdb3e2b50b77f11783fd
MD5 226af3beeb9e392a100556816856b66d
SHA1 473715df62948f6f9132bf01bfd85616c84fdd47
SHA512 80853719ae6e4b6067ead9e87eb88e42efca08b72af9badf5b25b53390dc74ab3725e8228f4a7bdd096fa71cfbaedf0f64589b9f61e1a561acb66288af9a82cd
SSDEEP 12288:YcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:YcnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1085523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 0f0552bde92011840e70498c8a4484ba045c5f36d2d6b77777b9af1b1e928881
MD5 e2e72f4a2ea83b2f4966ef8d7d84b0bc
SHA1 90af38be9ada73fe9ff9bb717ac50645e3cf1708
SHA512 dfad59c888283083f4f53636b13ae91130dd71cd03b0665681f1e7d4269507cc7b5666fe82297e07462d73518c2288bf8e5282b255f32e55fed795d992d126b9
SSDEEP 12288:HssfuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:LunQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1CE65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 99cd9fe75c8caf70b7730b9c8d47f2e3604d2e1d443e25e6b9c4fefc99a6303b
MD5 7e3df1471154581a67f503e41646fd3b
SHA1 772eb02f3bdca55e98ce8b7541ee85a11e827369
SHA512 2efb322e281a7d235997eacd262deb7108c29af7350192d20c9668426d0e4fc94bd56549b0b7666a5530e4a8eb932457e7f60f124197fc543ec97866a7c6cf73
SSDEEP 12288:RbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:RLnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1A3552379A668F94BFA3B06B05892C151673F0EC5BF90D38FBB08222D957C3D01EA6745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 7674e82830addfbccae96abc583ba78481728e6c938a3d1d0053d2052e3e9ae2
MD5 06f13a99b5d63b0362eac19c728015a9
SHA1 fe6502ff0342bb92e0df5e34b7055631e499a532
SHA512 1edf46e6929910891b4d01e9c2299852090b03c9c8321cb4e27aa989fb7bd119c405231abbc40316a63f6e86839e2fd972619a52b49fcfefbf795412732cc25b
SSDEEP 49152:Sa0h2GEkuAe73q3pp46zwwQ5Q/lFTjN4:Sa0hNYG4JwJLm
TLSH
T178859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 bad81718c4f44d373845652e2550ab67f872cb19d67e8d0bfc93b01a724b1f09
MD5 e6d0ea3c0bcea3de6cb893c8bbebb2c6
SHA1 3155785c2e45fc16e558ef10db5f4a38c61dc3ee
SHA512 b3d4301ff69de8a51cb4b8f82ddadbc3d504e3f1b65c76fe1654b17009158104077db558849a28033caf17a61d772ac85da135899634a7b51ef50fa75a3cc93a
SSDEEP 12288:hhbHjfXwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:hhbHjPQnQ/tbw/2Mkjy6Fr7g0on
TLSH
T15455027D26AC30DAF63692BD88928546D7327C552B11A3DF2381427D4F3BBE40D7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 4d452416a7069b887ff5f05fa80d2ddb2f01c2e679366f6d36ad5a7ecc514d56
MD5 3e0268ba30c567672629cacee1b9642f
SHA1 89668eb943fbad60bdb33a012d3690c864ae25f3
SHA512 8a7b07f9f73347c6a5a7897544c8cdab75c26f088cd5202fae5c4fcd120fe3e7f32db39ed5266c6ea5498be289a3573cb5fd68b4969a904466ab25bb579b7e72
SSDEEP 24576:b3YgnJcRTk4yti+R5dBR/4nQ/tbw/2Mkjy6Fr7g0ox:bIgnaTk46pBR/4Q/lFTjN4
TLSH
T1B245BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 a4c2b4299a255afbe1be04bc91bc2fddcfd73b55c6f8145c542d1b9c7a3aa33b
MD5 8ff9d87373894e63f007ead6e4eda5dc
SHA1 0b4b359bad20c4ef26b5879f380ebadbc3fa62cf
SHA512 6606dc5b6f16c3d1339b13290c94c963f3cd96138202cae8b8f6881d37f95b6a007ef736701f54b7be92c14bece465478870e45ed91a1e2439a86877163a7d86
SSDEEP 12288:WHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:WnnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T19B5523686654F98BFA2B06F54C838146673B0EC17F91A3CF7B48212D967D3E41AF6780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 d7d5f45f1de6ace23d8751971fc16e3e9442fc4b72ee13b80c2496601a5c98e6
MD5 e0c2af7a97f22e13b9c202302d396d59
SHA1 b80c9b379761be334078e96c607812788ef109c9
SHA512 f8dac77e7e09936dddfcda612a31d7faf6b5e960ff8081b67e30078b54a8cc516eb96fc8fed1cf276e6ff882710cc1cdbd975a23380dcf1bc431b576de7295e5
SSDEEP 12288:wOb4A4LWOsvAYFTwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:twL3UTQnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1AD75F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 5f35ef7bdb2bbd16343fe69cb7c5fbcf3f08e9d37951e699219f6a473f20b140
MD5 8d7b391781c6aa31e3bcc603b0e6744b
SHA1 c6f549df739eee85c52ee77feaeffee211c01a34
SHA512 8cb73fba7afcb54d47a5fe1f259bde9feff7d01e72e50e14a311b61d83fb90ef1466b3f2aa64e770679957622e677dad8936ddb5107e2d20cc9db10cd85d7346
SSDEEP 12288:8pFtCOMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:FOMnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T14C55022D36EC60E6E536527C89838249D37278921B6253DF0780817E5F7BBF85C7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7a4d6eb74568578f4ed869c887d42d62757d060b688acb5303371527fe740de2
MD5 13a9a31fcd718741d5cd747ecc10dab4
SHA1 6326e736dbf2f79b5ccc4c83ec0126c5f1c27db5
SHA512 88012dec0804116e47f78c88cc5b06fdff1879633ac66cf8692c6bb58b74b90225148e9424475741a575af2ff309e5cdb2a632471c12c36abcb262ad60908ccc
SSDEEP 24576:g7NM9YqZqmWMUkPjZM48Mv6bEhsbnQ/tbw/2Mkjy6Fr7g0oD:g7cBWMpPjN8DbEhKQ/lFTjN4
TLSH
T198659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 198413f3e1ac5503fa960d0bac1d464bb1552ecdae80b80399fca76691fc62b4
MD5 0af16f4ed078b7ed4f223bf0789b6727
SHA1 fddb87ddf57023c2eac045f563b8c06e605f6844
SHA512 97d8b48849bf3d4cf250a50563a2959341af0c6577098fced0adcb7447fecb9494c9605eea859c0c4d3e9b9a2c067b9353df2d129a1a73560fd97aba69fb48ea
SSDEEP 24576:kW6BApg2YuyuNDYTabvcdvNYf8km1tnQ/tbw/2Mkjy6Fr7g0o4:kF2YuHNETovAvNYf8km7Q/lFTjN4
TLSH
T1DB857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 b363aea64e98df8ed14b85c03325438dc84840d38dd982c5faab712d83dbf53f
MD5 591dd464e28fc8058e31b5099bef245e
SHA1 1cc9e524462cd56b0051b2d2090d8e77afea41aa
SHA512 a8ddd9e4c0952f24e62666e1219a8cac5472e1e94be65dc40b8d222a0699fed1f59c9ed73e7b8101ba70c31ec4330cd6af5defa48f66efa9d0f39f4caef8b7d3
SSDEEP 24576:qAFs06+Omlf3NXEbToYnQ/tbw/2Mkjy6Fr7g0os:zFs060lVXuZQ/lFTjN4
TLSH
T1E765AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 af80038851e34b14bb2352794d697eb47f264a1be288b09d098039b3b44c3d7d
MD5 11da7a92918bae869b5f1af8bbb246d7
SHA1 f11714e7e8cd0dc71b5c701ef10b7eb82cd2a7e1
SHA512 23954b0d7241f1c0c7ea7912cad3b3b6eb7a6b777aef0d00698f9a89065d0573f571feffdcb60668cbf6d11e47e5911b6482ea643c58e4aaa2b47cdd9c1eee51
SSDEEP 12288:UCJnJ5D3VkrqzxLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:5JnJ5D3WaZnQ/tbw/2Mkjy6Fr7g0od
TLSH
T11C75D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 aed2d3f316a4145c22ada8a04367102bd97c982879a06365db92231139040276
MD5 57eb11ccd10910b29ac5ecf14b8e501c
SHA1 3de71e46c25f4b4f28accd15a5f7de095180b0ad
SHA512 aee9fb76db909ffbbfa34027c565e027f7aa8ff790c09cb304049f9b52694ca46c5f47155279dcc40dc33016e8701d746d4560f67ea115a2818331abc7feba7d
SSDEEP 24576:YEPghm6/7IIXdwcXrif7qQncjlP65i3VuCnQ/tbw/2Mkjy6Fr7g0oH:Xg06DIKdwc+eQnSt65aVvQ/lFTjN4
TLSH
T101955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 e1d7e6b7bd1a2c6ab8f701b9c68b17c3bb499166cdf500c290a60314fa5360fa
MD5 26e20ca014a5b4ea5336e0577e28eb11
SHA1 826699c00e5986999bf5135757141dc3ad89700e
SHA512 55afe1c70da8870dba459f553ef0202922f2f5170c010a598e603d9bcd7a1e28894da8060c35c523041110df418e445b7adc0ee7a41e0482767c7255312388ef
SSDEEP 12288:cEP3RSbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:XSLnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1BF55126D37ACB0EAE52A517D84918145D373F4A16B5267EF2680823D8F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 786257d650ea5cd0de703aecae9bf121819853a34a37fcb06bc94c2cb6744692
MD5 d0540f58135605c3af712a8a83041459
SHA1 0eb0b85d60d7eb98219d0b202f571a36bd09e3f5
SHA512 c54bfd5268ea632f6b1a9d647256b90ba31bf6f6432c1ab227cafacc1768b5cef4e6296209a9d7e066e8b719c44037cfbb661fb4c41b2fc110092e8f4f0abf2f
SSDEEP 12288:0jkyaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:0IyanQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1916512186398F4C6FA7A06788DA381919B367C506F2193DF6280F23E9F3A3D46D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 19187b43da60aea400d2802119a266cf3928a70c2d5734e82e3a37de6783cfd8
MD5 1af1b112213e1fcea352e07df76ae27b
SHA1 a4686efa760c9cd2b99c225c0eda46fb8292564e
SHA512 07168eb04b81dedfb8b40155116c51dd54a74a370806dd7635f54ec367ea1f4bb1f957453a6c5bc35db80812ae1b3f771eb2ca1ca2ef42893556fd4a04b45740
SSDEEP 12288:T08GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:g8nQ/tbw/2Mkjy6Fr7g0of
TLSH
T1D555236C2665F89BFE2706F448528542973B0DC17F9163EF36886239CB7D3D416B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 2b5b6eaa6bdc625569921197477e0dd28589a3e6977b40eebb4ae0ad9f9e25d3
MD5 03aa3c730af5f1911f562f85e2bdcfe8
SHA1 ed363a4c29e8ffef562fda05e21be73001fb7c75
SHA512 7850f5a0ebfece41f872b37d6e3b826b1a7ae86a444e74f0c29471fa622561f978058338263feba28a1e1a4d68a78f8589d4255109f5decb8b0bdb0bebe377d7
SSDEEP 24576:7Q9MxZKdcz9dw3DnQ/tbw/2Mkjy6Fr7g0oe:7VKZDQ/lFTjN4
TLSH
T1B0558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 fb5457ac0b44a3afe51152404248eb4bd72fb79dc99b3ee44a73c2b0a8942c4b
MD5 a25d1557411049e3adc299763e4bb60f
SHA1 d7e6f2957590c0c63ce3d1f7d2dc82e40062d9e2
SHA512 b2c2ba95b1109a70d6e405476d51c52aa03401e842fbe5367ebd3d3d2d25ff8307dbc221ad96aa6a296ad9c18ecd108018d0a4390ff7c56f99329c39ab3f379d
SSDEEP 12288:ByoKo20Rple9p2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:ByocSApWnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1B465E01FBB6990A2E136813C89818645E773B4706B6263CB6681C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 632b29026a059781b85d1c48c73d212539d0d66122cfa542e30802d2da5165ed
MD5 013709983f29f3afb3b54a6e17957aac
SHA1 f082162a2ecfd87a0d3c316061740ee66224806e
SHA512 4cf2a4043f15b7177e5b5706aabe20165a2352732066ac6b9383ee7c31d61f094c9ff2dc8c7b291d7b7a50bd289bc2b12d52851954a1def159304d7cb02921bb
SSDEEP 49152:KWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKWQ/lFTjN4:M0zuNIjLm
TLSH
T1E8A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 15f561af1bd63cf4c14f3ebb420589b204eeeee879a7a7e43aa08e0f01918df5
MD5 ad7ca94f028cd9f38b14afcc37c77e98
SHA1 8cbd12e0bc4d2144cbd14fb7bd87cdf81bbfde46
SHA512 118dc4fcf73c1f16ab5f0cdd5771b62258768b292823b89617575f2895bdafe53830990dd2214d930d16712a80a30722c027d0945e8b4f6c7301934939c2830f
SSDEEP 24576:l1QT7EcpfxR+N5AWAz3ooiYtjMqbLnQ/tbw/2Mkjy6Fr7g0o+:ATDxR+N5YzTfjMiQ/lFTjN4
TLSH
T1BE55B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/680-70-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/680-59-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/680-67-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/680-72-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/680-65-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/752-232-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/752-12-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/980-22-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/980-24-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/980-16-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1560-282-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1560-288-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1560-405-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1560-281-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1684-299-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/1684-301-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1684-293-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/1684-412-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1920-48-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1920-234-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1920-54-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1920-57-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2180-479-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2180-316-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2376-247-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/2376-248-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2376-315-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/2376-254-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2608-427-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-440-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-452-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-453-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-451-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-450-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-449-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-448-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-446-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-447-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-432-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-433-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-434-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-435-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-437-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-436-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-438-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-439-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-441-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-442-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-443-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-444-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-445-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-430-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-431-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-414-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-415-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-416-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-417-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-418-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-419-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-420-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-421-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-422-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-423-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-424-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-425-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-426-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-429-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2608-428-0x000001ABB28A0000-0x000001ABB28B0000-memory.dmp

Download

memory/2684-329-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2684-368-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2684-384-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2684-400-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2684-409-0x000000000CDF0000-0x000000000CDF8000-memory.dmp

Download

memory/2684-482-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3260-312-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3260-478-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3280-8-0x0000000002100000-0x0000000002166000-memory.dmp

Download

memory/3280-45-0x0000000000400000-0x000000000054B000-memory.dmp

Download

memory/3280-0-0x0000000002100000-0x0000000002166000-memory.dmp

Download

memory/3280-5-0x0000000000400000-0x000000000054B000-memory.dmp

Download

memory/3560-413-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/3560-304-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/3716-411-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3716-328-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3716-274-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3816-307-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3816-308-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3848-268-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3848-261-0x00000000005D0000-0x0000000000636000-memory.dmp

Download

memory/3848-266-0x00000000005D0000-0x0000000000636000-memory.dmp

Download

memory/3848-319-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4040-325-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4040-481-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4216-311-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/4216-243-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/4436-320-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4436-480-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4696-272-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/4696-323-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/4736-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4736-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5004-235-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5004-74-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5004-82-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5004-80-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5028-278-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/5028-402-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/5064-233-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5064-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5064-32-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/5064-38-0x0000000000440000-0x00000000004A0000-memory.dmp

Download