3c3cfb85a3fc5bec086020972e40f39971713b13e335cf278febdcf9db99da53

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 12:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Size 1.7MB
Sample261102-p1ttyah16w
SHA256 3c3cfb85a3fc5bec086020972e40f39971713b13e335cf278febdcf9db99da53
MD5 a4f77e40565dbbf11aea14ce21934fdc
SHA1 1656bc822cc7553d8ed40764a5b3c167a338b020
SHA512 9c7202854aaa9e5d359a4eeee71bfd333dc09183b2571567eb2e730262d0fbdfa7197fa11df84cce2c9ea3146fa8549a7e213668c98149d2fb97191e5323d321
SSDEEP 24576:eu6S339SSgT78fhOB95Dr47iJ0nQZo2vI3:ecNSFT4hOlciSexvI
TLSH
T1FD851260B2C0D0B2E27745B18AEACF61897A3C7958A0044F6BD8767D5F723E1826D35F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2916	alg.exe
4780	DiagnosticsHub.StandardCollector.Service.exe
2076	fxssvc.exe
1540	elevation_service.exe
2332	elevation_service.exe
608	maintenanceservice.exe
4324	msdtc.exe
3772	OSE.EXE
3824	PerceptionSimulationService.exe
1840	perfhost.exe
2604	locator.exe
4280	SensorDataService.exe
2176	snmptrap.exe
4296	spectrum.exe
2720	ssh-agent.exe
3720	TieringEngineService.exe
1556	AgentService.exe
5096	vds.exe
2084	vssvc.exe
4272	wbengine.exe
4008	WmiApSrv.exe
4892	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d1ded6c1a26b1277.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105406\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000020affc77c86add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b51e6175c86add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000753b2276c86add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a9927675c86add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000596a8e75c86add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f0ee9a77c86add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ce18475c86add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005178a477c86add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
4780	DiagnosticsHub.StandardCollector.Service.exe
4780	DiagnosticsHub.StandardCollector.Service.exe
4780	DiagnosticsHub.StandardCollector.Service.exe
4780	DiagnosticsHub.StandardCollector.Service.exe
4780	DiagnosticsHub.StandardCollector.Service.exe
4780	DiagnosticsHub.StandardCollector.Service.exe
4780	DiagnosticsHub.StandardCollector.Service.exe
1540	elevation_service.exe
1540	elevation_service.exe
1540	elevation_service.exe
1540	elevation_service.exe
1540	elevation_service.exe
1540	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Token: SeAuditPrivilege	2076	fxssvc.exe
Token: SeRestorePrivilege	3720	TieringEngineService.exe
Token: SeManageVolumePrivilege	3720	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1556	AgentService.exe
Token: SeBackupPrivilege	2084	vssvc.exe
Token: SeRestorePrivilege	2084	vssvc.exe
Token: SeAuditPrivilege	2084	vssvc.exe
Token: SeBackupPrivilege	4272	wbengine.exe
Token: SeRestorePrivilege	4272	wbengine.exe
Token: SeSecurityPrivilege	4272	wbengine.exe
Token: 33	4892	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4892	SearchIndexer.exe
Token: SeDebugPrivilege	4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Token: SeDebugPrivilege	4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Token: SeDebugPrivilege	4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Token: SeDebugPrivilege	4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Token: SeDebugPrivilege	4372	2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Token: SeDebugPrivilege	4780	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	1540	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 3208	4892	SearchIndexer.exe	111
PID 4892 wrote to memory of 228	4892	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_a4f77e40565dbbf11aea14ce21934fdc_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4372

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2916

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2524

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2076

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2332

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:608

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4324

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3772

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3824

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1840

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2604

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4280

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2176

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4296

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2720

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1956

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1556

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5096

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2084

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4272

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4008

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3208
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 44f03e079d2c4e95b9d2241410c1bf187d8098377961fb07f8294cb2fccc76b5
MD5 52ff9ebe68c3bc6f86ecb21fbc3a2a8b
SHA1 220a5ce79f311808d6d94ccb4a1e1b1acf062bdc
SHA512 0ba928095284e5481e1b690a58c515fff73d3c90885c9106c6d571eec1ffac7c66a3628d94a8647f141eb20aac32a4d83498054e71e16ca006ba21b3dfeebb1c
SSDEEP 49152:Fb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnVhOlciSexvI:b3q6sjBQ8rSex
TLSH
T113D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 c990c1914410ce643cb586bb83e62f4bd0b70e5c52119d1f2096350ae4636725
MD5 7f876332f89e7616275f5521fc58b3bf
SHA1 baa8d59ede995bf7dd9c155f981bebf349916fd9
SHA512 c547045573592f03f80cd519e4ca3920d1954919daacef23ce7095ed16fa2ad0e63d53ba5fe4ea10299348c8450b40144451253999b12bf82a3638378ae4c91c
SSDEEP 12288:01XLsswWkxy2lRq2czA2XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:SXYfDtczA0fhOB95Dr47iJ0nQZo2vI3
TLSH
T19985F12877D408F9ED67827CCDA28502DA337C9547A0E78B03A096795F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 45f7c4e3f9f81b3699f15f82670b1905231451313a046f389785a21e2a52c24c
MD5 90567e433ffe49831476bdf89b915350
SHA1 e850f7062f3c2e39730f29f4a329ea9b0e87c193
SHA512 fadfdb05246835e3fb9c59f4daf96a0e8f3f11996dfc103116a12e977b891713ae6dd7b5b6aafe0765a0cf0860c975694163fa6040d5bc26b1e3bb8df1628ab3
SSDEEP 24576:D0Le5ji0hmxxrMZfhOB95Dr47iJ0nQZo2vI3:DPji0AjehOlciSexvI
TLSH
T16CA5AE15F6788731D073C0B9C5D2A68AED72308657308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a906eaf09e48ac645122e390ab5d5762123d65519cfffa0a4e503e18358f9099
MD5 45bd12fa37ab45bc3541e7b39087fc5c
SHA1 1de0843e2ca6ecc5c8198c3ac0120776ae86b66f
SHA512 0611050b9fe738e5c0c9291427a63cea9780991ca1ea7377e2eae188a88e1e80eca03fcd6aba60e3e6641d896cc43b823f76b8df44e553c2e6e0e170911a554f
SSDEEP 24576:9a7/ezSC6vUyD/aqgrvWn6q8wyuDfhOB95Dr47iJ0nQZo2vI3:0/ezSC6vUzPveHjyChOlciSexvI
TLSH
T145755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b0febc883cba5e3105cad398b691a6f27cbca560df1735634574465074ce118e
MD5 7ff5573b120384b87520919d64838773
SHA1 20bb2e72e81cf0570f653f93c70da12cf6ec7a38
SHA512 ede322382d62719e23e9d6672880645b1c6a6b902f62837266b1094028faa356a5571d9525fba0f8a75dfc4aa73850c899547f6a265bfcbeb214676cb1ba8b82
SSDEEP 24576:sVbqPb88hv/l+YQfhOB95Dr47iJ0nQZo2vI3:sVO88hXl+jhOlciSexvI
TLSH
T1EB559E65F5B48331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C3E676D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 d54d4d1073f25c4493f8e5fd0933052f4b8529f5b777adaef09d50003f549b21
MD5 bf8d16f102693ea09ed65652db22cc2c
SHA1 8c288f7d14b3308f5949c168934d328c87b6b2a0
SHA512 224e411f6c4c3d9f06b5b9abb45b38af7b41e7524b4f4f4e8f96ab414b48959eaa9cb8cb244c82aa28e680d4763b6c3032224d4d668c5313e26bcb888e779fb8
SSDEEP 12288:aLdXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:aLlfhOB95Dr47iJ0nQZo2vI3
TLSH
T1517523889FCC5DA6F3B7C7B97FAF8B03C8693DA494810E539D00B26DE535455C2AA027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 413df96713e842c8aeb91d7f7448857b10d7189c49d7d17bf109d4c75bfe7ac4
MD5 00d46c79782641076e9af8a661049ac6
SHA1 ac15c27b8c5d0a6b4a66ae74c21d205289f7739d
SHA512 407ffc23053e0977f5fb08908f1e85c4cf33f39d6d8ef61bcaa6ce7c341e5bee47e3ca96131cea872950668686482d677769d19a227b882dba2eaa939f21e7ae
SSDEEP 12288:ceBNUbTVO86USXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:cJIUIfhOB95Dr47iJ0nQZo2vI3
TLSH
T14885CF6BEE28FCE2C27A8DB85B918700D77278704B5193CBD164C20EDE235E55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 31b1da52fd036bce53fffc730792c8c747dbf8348228b96de85e0d91176c9932
MD5 22a0a4323e3188fdfbcc7f3336e21dfc
SHA1 6e05eb229785803b3017a5c0ee02e49b4a091f94
SHA512 79e795298ab930951f0d9e1aa6b21bece3f4f2d2407955eb4e99d4db11968f6c864905fabe2e38d366266c56089386085f71f0d4850ee18ae5f77d9a5c45904b
SSDEEP 49152:cQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THi:cQvGAdlCEL8c/DRNw5Cb8rSex
TLSH
T1EB266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 4b97af92a95e20e14044a9f65f3ad0aab95684ad5d35ba179dbb089e0113a564
MD5 0ecd32b5500ce7d068413e03d8da5b23
SHA1 54c561d160e1d3481eb6ea46eb3136b08bd8ac17
SHA512 07197786ce83b285011e4f718f4a1361c15c32d8f1233bad871ed19ec734505063f5211eca62d63c37925705bd7a9f85691b6a64e42c6eec597ca765d9c37b8c
SSDEEP 12288:eAwSfxL/2Dc3RDLLmt0LDQewsAjMXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9k:D0ewsAjCfhOB95Dr47iJ0nQZo2vI3
TLSH
T13995E030FEB4E436C3BB0DB61B36C706587D7D604B911AC3E3A89A9D99301D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 113dcf804ec1346c3c704529474d196aa69329f68693a084780e72fb101ad744
MD5 8c9dbed8d1e9c23be1b89a7344294c74
SHA1 f2027cba649b752ca760847b0917bebdcd071af8
SHA512 687b05c29f8510cc0aac090effd3058674f75f15086384f2a18a0a3f28ad1d42b84a2341a5ca9e5f2e472768219648a6f18ac53814594ad975a488e8bccfe9b0
SSDEEP 196608:iUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH1ek:iUEtQevvqc2W1cpV2tI32Yk
TLSH
T131474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9e95e258292d08feffd4cee3658fa68c5401035ec5cb1176f10f3472efd3adb7
MD5 3ad286912a7eb5eecfeb63fff33b8ce5
SHA1 a2e2c96e0469a812dee8e9532de523a01732245b
SHA512 16c4d9be4c6d2a6467e5e9c5716118e8f0102f279ff787f1717a6ccd599146022ae222bc35199618306b8ff594b4bcb4379c0990c729bba6c203ccda5e3065b2
SSDEEP 49152:qCbRquA/m2yL5zLfFiV+XenmE3/zOhOlciSexvI:foq2Vjnmf8rSex
TLSH
T12ED58E0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 23910566db499401a638e2441af463644c9044fe9f4373ec9cdcebd68bbe2f74
MD5 06e127f2655379c0e961a693624473b1
SHA1 2c2ecb638a66b4306204c8966caec04688aa83a8
SHA512 1ef8b38f74da59cfdf503862bc5a8326fc2566a26e1d1b0ef79dc6a2e61ca64669512be1d8bedb9bc4fad31a68d810a29cc5dd6cc21ce054545b53407ca6044c
SSDEEP 24576:IAhGL3IFoiwtA5l7S53HfhOB95Dr47iJ0nQZo2vI3:IAMUFoiq5vhOlciSexvI
TLSH
T1B3359D80EBF955D4F5B3AAB899B68171EA76BCA95E31C20F2150D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 37076cbb44133c763ef14d57b9db656f4f127c8f919e48d0614a4247503218ce
MD5 940d4da416bcd1ff0b563f05985dfd9b
SHA1 cf7c163ade072c21613d73f85537b7377ce08986
SHA512 164cc0727da6dcf10b12584289de0b7332f2ef8ca0928b9818d4e95e4af3fbb6708d9db2b2e7f5e2a12208ccd9518f9326ecbedfb8ffc33ff6ce7bfa08a5eed3
SSDEEP 12288:Cmw5HEjsChNVBFgl0WDm+CbXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvi:bwu4OWGfhOB95Dr47iJ0nQZo2vI3
TLSH
T19485F14977E81CF9E67782388A57C532E7B27C112A21CB1F1760C65B6F33261AD2D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 4e069867d5dccb3b5bf2bc027c3dd06efca0d7a6efb184999917d2c9dacc9690
MD5 a806518f1a2a03b4360f0d7fb3ba4751
SHA1 05494753489c293c4e9dce09d1d6b99772d0d516
SHA512 9240eb0577b301807e3ed6a0bc155eee571ce59d3545c9037663171d33969ccdc1515de56985c8d5fc93c4c0d8398052b7daddfa71541ae07a9bd4f06d2e66c3
SSDEEP 12288:6eZ1IycXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:XZuxfhOB95Dr47iJ0nQZo2vI3
TLSH
T1B675128927D825F6E2B3827C9EE64A02C7763CA5677143CF5910826D6F339D58E39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5d8cdc215f7ed46e65ba48a39cb9f4a9f5586f713f5db60743dc8179cd36dfaf
MD5 1479ccd31dc9fb64e447ad93b11ecec7
SHA1 4a4e7d2d9974cbf1c7c93498b7273c52fa96a7e8
SHA512 38fb725cb50244636172bf2739181c8189c211e6f6c5d2bc7d86a945bbaa03d713e1a03b55420706fca7bd6c14a4b99e5a2a8c85057640df88d888aac2032d38
SSDEEP 49152:/j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U+:OQRQyi36YOcPbLvw2gAf+PN3M8rSex
TLSH
T198667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c7ceae09ef32055cef7322543d253c72159917cee275fe985f876786dce0a622
MD5 2b63b49ab9e085406593611d65492a97
SHA1 7b607cc29640ad5c237e61bd37bd1194ea587c04
SHA512 901ddf7d302c1e8e40b9ffd68145e3476130916dfe1d223f39f95752f294ab71053f55cdc51b54cd50f0d46086e30094b3a445b2c9e4d63b5bec0a91eb43d3f9
SSDEEP 49152:sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U+:jQRQyi36YOcPbLvw2gAf+PN3M8rSex
TLSH
T187667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8f47ea8ec850794fd39042089263c7cf73b10da0f7c8f55535cac0fe36800c29
MD5 acf1f109e51f52eff2baf91aa96c4287
SHA1 9ef94ea878081cf3729a22b17b11dd66d81eac6d
SHA512 e33bb2ad04ba01280b7d503a8cf81520c9c4fbdf2b1d2b12b48cd11f5d352131b1524381e51aad2d29d402f3747939ec31769d66df15adb4c267c3b732aa9073
SSDEEP 24576:4wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0hfhOB95Dr47iJ03:e68Qg55nhceWu7PNU3/ehOlciSexvI
TLSH
T152B55A33B2F600A9C45DE1769F4A872196D17C758FE0E3DB8501721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 223e86f35b499584c8963e61179a9e62cded6328cfbb4ec3bd4f1443a2309ea6
MD5 c55dd246e3d808eacf8b5b2117d60534
SHA1 ad04101fd8486a11382b6fae40be00aa9a73e469
SHA512 a27cf1d7b3ee8466d9495cddd6ab0a0a85051d74853eacc8fdc74ed6c927e8b9867ce36d55fc751416952db578e4365cc83849c21068403d44109680b408c0aa
SSDEEP 49152:m3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99g:3y5112gYy5azzVvt69nLKnhZZ8rSex
TLSH
T107167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 38ffb3456de712be88b816368a22bfee8570edd4987ebedfd7219533678514a5
MD5 fe46b06a72e27f1c739093524443a39d
SHA1 3c1c80b08d490e23d5dc4fc719a53dd06b99b682
SHA512 23aba6a4a0111d6b1ed424ab841a01b2d59e23b5dfc725fb5cc9d0c241cd4658a83c15ac41daae82ff187d376708aeb52c5558031fa53d728717b3b8905fc4c1
SSDEEP 49152:DB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl0hOlciSexvI:1u6Jmdxd2d08rSex
TLSH
T1F4D5AD13F1DA01E8D06ED478974A9233E962BC490B34B6DF0A9073562E77EE4AB3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6cfa22926d52c33d747cf6ae3909bb790027360ef321c21711034f47fdcfa3f1
MD5 214ea1723b869e89619e83eecf75a6d3
SHA1 0115faea430a5703c350e767accbabce3f972a44
SHA512 5d5abf7f26f228a4e834659eb148e7ee616a67af7af7ad23ea0c226d2ecb2bcbc8889d82ed380d7fb94aaa536f5330af376ea6c933f77bff1f61ced6f6a96358
SSDEEP 49152:t1hpsNoJpF1A63U44CwH7R4xIhOlciSexvI:tmifPWRf8rSex
TLSH
T183B5BE13F2D801E8D06ED17887569232EA62BC450B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7053cfaeab7b2c360c6a04f94233cba6f38b0c1acdd0effcbe49202c4810ff79
MD5 7302cfeb527bd29db62e80999fb9159b
SHA1 b1ded7d7b349242762d8f66d5930a8bd1a16016f
SHA512 19e17376f9f9ab2a6cab1f9d1304ab6bcac2b76551499d98db0c9eb3cac8c5df6e1b670bfaf35e1fda053ccf6a45c21f35a0c606b9f7d74b8d18004ac8dc948c
SSDEEP 49152:ZSuZQIY0Be2KcRVtOnks6NMHqlhOlciSexvI:35dKii61l8rSex
TLSH
T108C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f43eaf6667f56c160023bfceb58c19708a37041f22685b7c7b5fcff3beb2370c
MD5 6bee7f07449da9d1bce9331253422e07
SHA1 2034bf4e896cd585acc15bc5ff327c03ea51f551
SHA512 f58eb3e67ff0c1051fedafe733b05ad4b5168a7bebfcb5d784df85f37b492178408a3ed826a09652706ee63ee56f28a7153cf44d88bfd09f210f41d1044bf355
SSDEEP 49152:WhtSn8EApI0fig3giDn0AP5wEhOlciSexvI:3X2imphz8rSex
TLSH
T18F95BE13F2D901E8D06ED178C7468632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 9f08d15cee14dc1ffe5b7a2a2cb684ace8eaea747da877af84e7ee05e7844fe4
MD5 b1f26c8bd936c0c890091a966afe595f
SHA1 ce6b5b363984da0699be99ce09c8ac510d4e187b
SHA512 ed100c1ea339b181ed4890554305737b8fdf516cbfcbcaa5abe8e159ec5fe58435f26d421ce559753423aad4ef29b60bc9d9f18105dfc3006c0d89381de48439
SSDEEP 12288:gFXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:g9fhOB95Dr47iJ0nQZo2vI3
TLSH
T15C7523886ECD5DA7F373C7F96F9B4B02C85D3DD8A4C10A53AE00A12DF53585582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 e5f986917139131722f21d29a4e34a839823bf636eb6ede244485c7c167a2847
MD5 2ee9c3d5be83071818ca53ccea7f1bea
SHA1 22acb08186fc53e963817de2df06191b3576c91e
SHA512 fc49201e9cd7e6db1584122d7bb4875876da3dccb07984a80d2de66aa7c1c53f448b23f86d1c76d6579c90779627621c70c987bddd0d256daf0cdd251c728c27
SSDEEP 12288:qgXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:qufhOB95Dr47iJ0nQZo2vI3
TLSH
T1327523886ECD5DA7F373C7F96F9B8B02C85D3D98A4C10A53AE00E12DF53585582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 13ea2ffa9a1f61f052d8f3f9f9bf50ecebd90fc42cc7c9f312215b87a0c61d4e
MD5 50c3ebda0533357b88462dfcc95ca180
SHA1 1edbe5c406093b59f0eb4f62f4191c2731723c50
SHA512 9776de8c51c5f06841978c74a78ebf226c1fc3158908eaf4bbd2795829855d8124253daa5dd6ba743639085f0420c646d1dac4c68f2f30b7b536ec916701ab4c
SSDEEP 12288:t6XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:tAfhOB95Dr47iJ0nQZo2vI3
TLSH
T1447523886ECD5DA7F373C7F96F9B4B02C85D3DD8A4C10A53AD00A12DF53585982AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 3b54e68591bad2fbe2f94b71dc447bda3168045cbe4937aff8c263e47e009064
MD5 affade0cbf4711fe4185a45beaa1908d
SHA1 97e5ba62c8ac6f04129d2ec256a3d0728282b547
SHA512 a1a2c57ec46be971578da250f348fc9bde5f38d0ae24cefb640bf943e611c2d8ee6961dfa7d08472bdeb72fbff3b255f08d6d7bb0b6b34b3adf97bec84c9c032
SSDEEP 12288:2V3XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:KfhOB95Dr47iJ0nQZo2vI3
TLSH
T1567523446FDC19E3F3B3C3F89FAB8702C4793DD4A6610B9B9E00516DAE316948279627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 b0d467fb55310121f7e46675b9e7be66d93b8d8a398b8a5a7150a77f25dfd657
MD5 19fae497be0c50f2b98715e338cc05b1
SHA1 8274a412c457f1283951f3e6b247d17f12a96f0c
SHA512 070de5587b46bdd697033731a4a911d09e6e7049fe6dc8dda72292bcfab1c5dcfd5c18aad41a434b62a0ced5eb8fe75f6bc7f57db1fb5e95c77f5d103cf7d71b
SSDEEP 12288:tPXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:tPfhOB95Dr47iJ0nQZo2vI3
TLSH
T1E7752388AECD5DA7F373C7F96F9B8B02C85D3DD8A4C10A53AD00A12CF53585582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 447b452bcc79f74a3f80ea8c189b05eefbd11692315ef7433b68b86d128b6d1f
MD5 ab88f2f6e2eaaaad853aa53eb8cd982a
SHA1 08f404ee47d27cd2329b0810a631e57b61a14eb6
SHA512 6665f66935f1b79ccf9a808ceffc76a9a00220ecfc203d275ac1e63af379648af8359f04d1d9ea66ad0bfadf85379a5f4528afa31bb909232d7017bd2aad6c8a
SSDEEP 12288:uUXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:u6fhOB95Dr47iJ0nQZo2vI3
TLSH
T1277523886ECD5DA7F377C7F96F9B8B02C85D3D98A4C10653AE00E12DF63585582AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 1ec8423e2f66c04dda027799ce2362b938a302e4268aa49d48249741832a7e82
MD5 d133337578fda55f03d3267065fb69ee
SHA1 128bd28b4d357f01824378a9446ff44998634bae
SHA512 33ce0be098cf8ac8bd644f9a6d5399b9e4140354c443f06d4185de610bbe54be984867b454ace7e2a2fd6e87994d95f93d3e851e493ed70f4e33d87be4a8a575
SSDEEP 12288:lYXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:l2fhOB95Dr47iJ0nQZo2vI3
TLSH
T140752388AECD5DA7F373C7F96F9B8B02C85D3D98A4C10A53AE00E12DF635455826E067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 7c5bd7a69233606907b043a3f0695194aa560e6a452d5f8bc75222bdc710b755
MD5 6b09c284a3cc194a7871994f5ce6310f
SHA1 83ec1e442fb367946f203067cff9b436340cd5f3
SHA512 c918a9a8902abe3d0cf1859c58254f2ef2fc26939210913c88627fa957f4de2cdc13faa95df13c5e4ff266f647c95ae9100feb485a9756ead610f23b6d2634b1
SSDEEP 12288:ciZwbVzzFEoS2cPvyAXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:/ZMRzFVSOOfhOB95Dr47iJ0nQZo2vI3
TLSH
T154850294B3941CF5ED73827ECD568906D6B23C5907A0CA1F17A4322A5F333A14D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 3b38c66b0ad14079fa9497f1415f7a516eb8624afb3aead6cf5ebab9ac916050
MD5 7ac921c04e6844d81b595f4208f1125e
SHA1 a554cb559532dde248d2111d969762c56e950f14
SHA512 b64c847ad1144291d257e2b7f26995880c840132cbc1e59bd848ddb7950505ad4295389b7afb1fa6ce9e865f3a0e170469b115291fdfb0f158aab5672843522c
SSDEEP 12288:ehXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:eBfhOB95Dr47iJ0nQZo2vI3
TLSH
T1E17523886ECD5DA7F373C7F96F9B8B02C85D3DD9A4C10A53AD00A12CF635855826E067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 efd42f1ecefd1d68086520c804d7c607abfedcac16a97f445e61a9e5f41450e7
MD5 5d8cf103621a92db96347858412c4dfa
SHA1 a2bf44cdd805484dfe02ba600e4fed4ab901da64
SHA512 d2c561918f163feee2054e02b226761a9ccab87be5522310c1f9b3a8ed2c5a45de60031b76c05ff082856eb8635d079a3fee1a35343edd2a3a804acff6ff7527
SSDEEP 12288:ttXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:t1fhOB95Dr47iJ0nQZo2vI3
TLSH
T1237523886ECD5DA7F373C7F96F9B8B02C85D3E99A4C10653AD00E22DF53585582AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 9e566f351e16e3be97cce9da17a7ea05addb8ac46e68bdb28fca12caa5c830ce
MD5 0d82f5e2b4951ed18a68812aa86d77fd
SHA1 86ef6c9e71167e52b6ee11967b09099d2d2fb7ca
SHA512 14f24c1ed2c240605d651f936e37b75ec93e18f057875838cea61d7a72f73a1a2db9653542b4994a90ca8ac672b195837fcf2d103a26aa4cae810fd6d7f36388
SSDEEP 12288:gyPz5L8cXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:RzySfhOB95Dr47iJ0nQZo2vI3
TLSH
T13085024777A530F9E27782788DA30A02E7763C7547608AAF5750437A6F336909E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 210b49482c4a719101a42a83740691517a30591d3438b12b85b42236bb746565
MD5 f5a88a1ecb625ab6a295ca7f6e43518b
SHA1 d3b07e5a71d95c660022406d3842c003dbb72082
SHA512 d4047a3b80a28dd9fd672de1673a66ed45e5e42acf922c77798cb1386df0e5173d833c64e3370f742e0bf369f0bbf635b3e8b94e94e82c1600e5ffe2cad59f6c
SSDEEP 12288:PhXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:PBfhOB95Dr47iJ0nQZo2vI3
TLSH
T1567523886ECD5DA7F377C7F96F9B8B02C85D3DD8A4C10A53AD00A12CF535855826E067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 812143c3564f79442c992e8f2f154e83d2307901a9a1e532ef7ac43efe5a5cd4
MD5 d244de84bb6d6e426618d316ec86d60b
SHA1 f144f024a57407dc637aa9a9c58e5958fb727833
SHA512 692b1bbc4ddcf9c2128a57644253c7a271ec8f68008897ada80371b719ef4d1151702332f4b0e19795c275f28e1f4fb86448f0199bff08017957ca44c3841ee9
SSDEEP 12288:rhXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:rBfhOB95Dr47iJ0nQZo2vI3
TLSH
T11D752388AECD5DA7F377C7F96F9B8B02C85D3DD8A4C10A53AD00A12CF535855826E067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 4442fcd7874249424a47481942b52206a63f147e20f96b8b0e029b1ededc787a
MD5 7c2656993f2034970474b849c5d12beb
SHA1 d61dadc6083fdd9ffc9a85679051c870a70d51c8
SHA512 15cabc2bd7d5428d8c28b48d514bb957454a2ca20be1ebbcdf017810ed1eadf4abe4e3668d0535298f252c6c3ef560c2dad71445ff8746f26a633a4aa7c2e789
SSDEEP 12288:vyPz5L8cXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:CzySfhOB95Dr47iJ0nQZo2vI3
TLSH
T19785024777A530F9E277C2788DA30A02E7763C7547608AAF5750437A6E336909E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 11950f393b6597d2e0859a6165c2f0b63b771fe74390619e50593de0095cd79e
MD5 6a223f0d616eb5f194eaba5c6006941f
SHA1 57cec6515f19c764fd70e0c6966fc23511b28b57
SHA512 d28041136a6b1176a5a995f323c4ddd91bb64896c3e746b93c855dc9835af80ba4435071689cc7fb96d9d07b3118182a1d5352d7f444fbd1e588ab27d7b25b67
SSDEEP 24576:9cP4mcvIjkGOxhKP2l71nNKbrh/8KBJfhOB95Dr47iJ0nQZo2vI3:CP4m4IpOO67W8KbhOlciSexvI
TLSH
T10765AE2DABDC0096D0BB917885658A4AFAB1742A1F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 7763f17b7f299368c181d42d916345f908e7aa39c32b80a02bbac9f9f16dfa33
MD5 74c3139cd6575e3303c93854196a3f51
SHA1 edb94d38ddc4cc0aff36dabcb1fe9b2ff7d0008e
SHA512 7f2afc629b1f8b238ea480ab0f37869bba24a249db7c98a03f31bd85fd7ec1a5bdbeb5f3a4d725531b087ff6f98e5df8b32430c229cbe5d533e1531c5eb28c24
SSDEEP 12288:QbsfRXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:3xfhOB95Dr47iJ0nQZo2vI3
TLSH
T183750149D29802E9D16E92B9CB568A01F3373C6493E1D3CB57C0F53E1F366909EEA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 e10a6fef42a80401629801f159235325c15ba40abbc2d7a80a62922a406775af
MD5 ce1a766d7e7f937d005d2ae73f1c141e
SHA1 d523e14760e45485ec9994a38c501bb329da4675
SHA512 415d7b073a12d31fe8baa5227b4142ff4e9337c8130b841cc3351e3433b5a61548f63b0c992f4f3af5da88aa98fe2a7f4b879892698681e48165f78b44045a81
SSDEEP 12288:IxXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:IRfhOB95Dr47iJ0nQZo2vI3
TLSH
T1EF752348ABCC5D67F3B7C7B42F5B8B12C41E3EA89A814943FD00A26CF535895C67A11B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 710084e8ce05ca6d142bbbc56d80fe5c69111eadeedd5f2cbe52adac9c4514c0
MD5 42643fe23670d1e531be61b759d25cf3
SHA1 91fa7fb78be19c505a97a40033b580142cb7befd
SHA512 31831fe6ce50727185ecffc5c1f4e3a7024d9e1348476edfdf3721b6311a32e06e669cf3485ec471d620666504d506b8e8f8844299ba107259d4d7fd2bc98dd6
SSDEEP 49152:4a0h2GEkuAe73q3pp46zwwQ3hOlciSexvI:4a0hNYG4JwG8rSex
TLSH
T13385AF1D67EC82B5D0BAD278C9A6854BE6B2B4260B3156CF1150853D3F37DE84E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 331084c0c3e483fb3e82de63ad54993b0b3292040ddc24f8091fc756f0fd5c28
MD5 4a998fa46d634abcfebbd757caea74a8
SHA1 66641a482da9bf6f9e94708c2add81a839979693
SHA512 7743d96705d8137b6085d0dcae8d4b40ab64f1b41f8c8e59d4cc5ee32f65eaa1a17000ee4cc14d8047ace3f80e4116e1118e4763481bb41b0d5f4093a9cc16f2
SSDEEP 12288:nhbHjfXQXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:nhbHjPefhOB95Dr47iJ0nQZo2vI3
TLSH
T1F27512AD2BEC24DAF272D2BC9A968606C3317C64171153EF2680827D9F37DE44D39A53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 04cdb079a120c6286e455755addc9af15cf9bdb1bbe88bdfeec4b8e5303f89ca
MD5 b618d1b02d72e9d7fd753f64c02be5bc
SHA1 cbd3ecf87b570a7b3faaa2efa6178b98b45488b1
SHA512 fc08e3b13c487398e5b8cc1609ea118a183148c4b2f161c05283b3fff37e5fa050dcce06b2fd798082c3e51bfb1a0d160cf0e826c9b9418a1d9a0cebbdafb70e
SSDEEP 24576:i3YgnJcRTk4yti+R5dBR/GfhOB95Dr47iJ0nQZo2vI3:iIgnaTk46pBR/ihOlciSexvI
TLSH
T16645BF2DF2B910B9D4A6D236450147B5FB71782D1F209ACB0170C538AF1AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 2348eaaac27a458ce04ec0542f0756e35e85f8d583be07b63e1f63ae75300959
MD5 c77c707c1aaea014576ada56a8f87cf4
SHA1 f64f7c581afdc5818dd2e6f51711b30cfcd87656
SHA512 8fef227099264813c9163e74b1a4545c34489a12ac1b2445808fb193a649745749c6be4bce05aae2381a2553fd96aafbaa07b1d84ebd6c8d3a3a55152fc3300a
SSDEEP 12288:q9XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:qFfhOB95Dr47iJ0nQZo2vI3
TLSH
T1DA7523886ACC5DA7E377C7F96F5B8B02C4193E9457910AD3AC00E26DF6358DA827A017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 e4a4e0b208087f23da7eb5946614ea5c2eb6e8d122ffb5816672766553ed1a26
MD5 2d5c981ec583ce68ea1edb4a8516b54d
SHA1 d38bf990a6ae566ed94706f61826e84d67a1a16d
SHA512 ee38b314a4ca46575b8e9833cf863e1299d6e1d1d2b8118785c2d9038ff710ebe7862f5f648cd8b00169248a4507266e67dcb5dc1c19498ba449ae6711825df0
SSDEEP 12288:rObfA4LWOsvAYFT2XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:0bL3UT0fhOB95Dr47iJ0nQZo2vI3
TLSH
T1C795F144F7D804F9E977C27CC9A78A12D672789D0360E7DB07688A691F236E18E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 1fed5945f0faea6a0e63562a9da5ce229040068b07534673ab8136c227d0078d
MD5 87a201bb1ed2994458ea16775e8bcaf7
SHA1 85aa88adfdb0d47f1f700c026f5d7daed7bed8c9
SHA512 eafe62d6fc14801cfbb7b5fd50b3230642b1e49a67da7b8a581e3b6352ba6bcb72e71906d4f44d77e7d65acfba1e04e828e6f825d6183a0e4baeedb66f3618e6
SSDEEP 12288:upFtIOyXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:1OofhOB95Dr47iJ0nQZo2vI3
TLSH
T1BF75011937DC14E5E276927C8E97830AC3717CA5075217EF4680817E9F73EE89C3AA62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c9a981c4e5315021d85bb8784edadf26078ea9a8434141621d71dc8f6241d565
MD5 61b658d11cb9060c1e037d21e929152a
SHA1 eb4894a1562a3d24e4dcaefa0dc4ed237745ad02
SHA512 5d13a48a90471e4918e413f8114d48247c014d22a15e3eb32c805396fe2ebc953c1279450004a10abe9b4f3f7574f30973e45508f2c04647506b732ead17f301
SSDEEP 24576:p7NM9YqZqmWMUkPjZM48Mv6bEhsBfhOB95Dr47iJ0nQZo2vI3:p7cBWMpPjN8DbEhKhOlciSexvI
TLSH
T13A65AE2E6BEC81E5D577D13DC9A28206F6B2B4611B318ACB1152833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 a0fd237d3c477e78f6c94d5d92ebc459718defb48364dc8d9a27b4ac9c25dda6
MD5 36e0d7f00789127d31900a1e0510cb2d
SHA1 cb258a025349e655947d2f6892dfe0ac28a866c7
SHA512 ecf152b941be509d8e08d1108bb3880382fdea630e1fd1bfc5e37ad72d393ea4b02e2b8f96c7770bc2ad6f71d0a4bcae9b0c8547865fd35a8f57963826da4bdd
SSDEEP 24576:pW6BApg2YuyuNDYTabvcdvNYf8km1LfhOB95Dr47iJ0nQZo2vI3:pF2YuHNETovAvNYf8kmVhOlciSexvI
TLSH
T18A858E6927ED80A4E0BBD2BD45B7D246FAB2B8511B3056CF0255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 e660d97b409ef4bffe5cdc76241e65bbcf18f7bbd38777db66f0144aa5331996
MD5 289345587ba1aa541cb10867bd31ed07
SHA1 4211cac88658522b38d7babddf70d7562092997c
SHA512 dbee9851182eb99c13f61ce4c524969adfbcc61b39e588bac187cc1952e3cf570e29ccb7c3af46041715aae4639aa24a2899bb289b81a8c12713f3a5dfd556ba
SSDEEP 24576:wAFs06+OmlfkNXEbTosfhOB95Dr47iJ0nQZo2vI3:FFs060lwXuXhOlciSexvI
TLSH
T12465AF2F66EC00D5D07ED17D8A97C91AF6B1746307215ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 012ee9917b000f93986b86f2f953490039806af0df42c2156ca62112cbc0be9d
MD5 b203f2227d24bc6fbcbb9e1d9ff01d45
SHA1 c4c971a7647a7d28f45fe5047005af980dc61ff8
SHA512 d6c5c708f46e1e2e6c64670653dd909155ca62b4d5cdd76ea660d3e56a24afb2866444ddaac71dbd7cfef11684d81c5a64577f0015a541a5a102fadf43b09c2b
SSDEEP 12288:TCJnJ5D3VkrDzxBXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:uJnJ5D3WXvfhOB95Dr47iJ0nQZo2vI3
TLSH
T12995D02CD2A810F8D0B7C3B4865A1B46FE72387D2F226AC72864D5357F12EE09979F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 8de4ce2860a213bad92846df617dfaad85e61d17f5bfc0006a6c37d65c4bb479
MD5 fad016c7de307444ccdd8ace095d57c1
SHA1 b1f78b3ad0e68ecd432f28bd34f83c0cf7945bb8
SHA512 3f9ef591c6ea3597c881417857d662c90d14a05d72a52e0a6c7a867505c9c03e6d2a61b43ce6886109e1a141b3accbd2d960748ea9f978661be66b39e257b76f
SSDEEP 24576:0EPghm6/7IIXdwcXrif7qQncjlP65i3VuGfhOB95Dr47iJ0nQZo2vI3:bg06DIKdwc+eQnSt65aVBhOlciSexvI
TLSH
T14B956C05BBEA5294E8B3CAB1CA6295169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 cad4b9f53c2919e2ef2f9c10fc1fd16febacbb1df506028d178cfbde43ee2033
MD5 1cc9d43175a95364a8f0580388c55204
SHA1 493b8fa984bce645e61905eb7402b3bb1deec479
SHA512 582bd98ec84527f165c5fe15cf0393a873a66343e9bb9e3e81f8bab2c4ea6aa34507fa76d7c3b15c854046aac11c1e6b975285afef6003a07e807b6010239431
SSDEEP 12288:dEP3RnbXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:+njfhOB95Dr47iJ0nQZo2vI3
TLSH
T1F475125C2BDC70E6E236D27D9A928601C372B474275227EF5680C23D8F339E95E3DA12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 86ce4c0d92a4b89d322509d40822752c553038036d735d5ba15b599c0fa1e779
MD5 2a9d4af7d00f52efab88997b3963bcbf
SHA1 deff40346eb721e47243c1647ace88f0290988ff
SHA512 c5be34f87d92bdf2bcdc9922840f4fac3afe3e17fb919f1d5a456a835f5f2c2baa459e3b5813e87070099aaeb8e680f8070036089db9aff23dcbeb65a2816718
SSDEEP 12288:bjkygXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:bIyufhOB95Dr47iJ0nQZo2vI3
TLSH
T1FD85124867CC68D5E3B687789EA78241C9393C709B1157DFA440F23EAF32AD49939B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 f31fcd6bcca7c1155d77bc1e8936d3df534d42e5b13e8e85d4540e241b38484d
MD5 e88eed09190759d5a609480e90d41078
SHA1 3118ea594165beb4618f5e85fd74eafbd25135d3
SHA512 2df03341e114c5cb68380e7b88ee8e7aa47bd5aa00eb62ce6483f638b618cd8a99a91fb3d6c4a2293a2a19e74da3f852c67062337c8e72112ce410ef63ffdc2e
SSDEEP 12288:DyCXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:u4fhOB95Dr47iJ0nQZo2vI3
TLSH
T19C75234C6BDC69A6F373C7F86F6B8B02C4693DB4578119E76840E23CEA318D5827A417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 b2076f2db46ea7427361ca5f9443d1c3ad903557e7ae430131c5095ace8dc4a1
MD5 92b555b1560f94ff4f795503633a0f34
SHA1 d91ed5ba223d4a1497d1666af0e9c0e62cf4a92a
SHA512 2c6c3e2e005aa4b842b77efe8063dbbc00d76d4b23030beafa718b394b9323a2275264ae2d65ef7d8ad63ac65c417350fccf6a8c0cbc8db32e09e8423d890327
SSDEEP 24576:4Q9MxZKdcz9dw35fhOB95Dr47iJ0nQZo2vI3:4VKZdhOlciSexvI
TLSH
T1C1558D2DABE9099AE177D27595A250C3A633B4301B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 0ad9039b39f0bf1a7c614f7beafcc3033bf395ce8d9e3700a40e38a42e116e5a
MD5 43d2f0611832cd34ca2592fe9b9d0aa4
SHA1 0c7bb64bd21889db07a20a9b2c1e50059fadea71
SHA512 53895c1d1969d509a195c4be3329b1c39cb3a64f05254139d7af7979550db80851f9fefd6a9a766f49f963cf4b12fd7c4874da03049935de7ddecab67f2e6a0b
SSDEEP 12288:QyoKo2JRple9pMXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:QyocDApCfhOB95Dr47iJ0nQZo2vI3
TLSH
T16C85E00FBBAD40A2E176C23C89868745E77374705B6257CB6581C33D8E279E9BD38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 56ab2bc279ee21dd6f7058a6e4aa1999c94070ddc206bc4780bef7fbcfeffbd2
MD5 229ab1cbe23c530662d779d503b309c6
SHA1 77087a2701dd6a9b07d39b0633f4d50997b1d5e0
SHA512 795705e5177300a8f00421b19835d16f6233b30366a142d6b6b1b3242f0651a7bb7be02c6982ffbb113a404943b348b37bd0e9527b875218b1b2325ab37c60c9
SSDEEP 49152:ZWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKuhOlciSexvI:B0zuNIE8rSex
TLSH
T1FFA57B3DA2EC00A9D9AAC375C5461366EA71742E3F2055DB01B0C57CBF2AEF19A38F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4d8bcc893aae9cb36400077448e622676d5775ec58d4c67cb55207941e1877bb
MD5 17017c1495158c1726f6c172f25e9a11
SHA1 89acf8694c352920b4928cc130fc8e39d01f0e0d
SHA512 7cb9a5799fcc458692abba97dbedbed41609581de6df3ab80e7f1710b3a21160cef4ea42601291ab227f37a0e9540f0f6e943b1c171cfd70aae9f216fd4ae7bc
SSDEEP 24576:J1QT7EcpfxR+N5AWAz3ooiYujMqbjfhOB95Dr47iJ0nQZo2vI3:cTDxR+N5YzT4jMohOlciSexvI
TLSH
T1B755B02EA7F815E9D1BEC6799B23C502FA727821033193CB4260C17E1E679D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.8MB
SHA256 8e55162e986d7a14e7f86f88c80e82f0a7046a406dfd8109dbb973da9785a112
MD5 138762b049933047407aadbdd7915b6a
SHA1 08425dfad1f9024f424f918eab8fdce27837acc8
SHA512 5597f71d5cfcdf64053de002455b999260329734849a74d9541320312a3b7b041a5ba2d7c3a3ac445fcaeda85bb12a0f651a569ba807a067c9ba82ad490f4bac
SSDEEP 24576:gTMdOz0FFS+bmSLnfhOB95Dr47iJ0nQZo2vI3:I0K+bmSLfhOlciSexvI
TLSH
T1CE95F17EA3AD14E5E57BC27CDA438A06E5723861032266DB0690C17D3F67EE4793EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.6MB
SHA256 92d1e3d3fe80613be04a97e5907a2ec941b2dce6373af5552988118401adc155
MD5 216cc2f39151dcf13331b7c6e7619393
SHA1 103c1606d317c964669eee5e8dc8cf72acbaf867
SHA512 7fbc4307d22cf39e11897f16b60e6748998fe3490a9c57db96c22f80db0c357ca60fb3d416e233f9952960420820aa9f33a9b2e17a35f9d41e456705bf0e0e9e
SSDEEP 12288:u4K2XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:c0fhOB95Dr47iJ0nQZo2vI3
TLSH
T10875124C67EC28E5F2B2D2B89B6B4602C5353C7523511AFF2980D27E9F369D48639B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/228-373-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-395-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-406-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-407-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-408-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-409-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-410-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-404-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-403-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-375-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-374-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-383-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-384-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-389-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-390-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-391-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-392-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-393-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-394-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-396-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-398-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-397-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-386-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-387-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-388-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-385-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-377-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-402-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-368-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-369-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-367-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-370-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-372-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-371-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-405-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-376-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-379-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-380-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-382-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-381-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/228-378-0x000001688B390000-0x000001688B3A0000-memory.dmp

Download

memory/608-66-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/608-68-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/608-64-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/608-61-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/608-55-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/1540-32-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1540-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1540-129-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1540-38-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1556-151-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1556-149-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1840-100-0x0000000000870000-0x00000000008D7000-memory.dmp

Download

memory/1840-162-0x0000000000400000-0x0000000000676000-memory.dmp

Download

memory/1840-109-0x0000000000400000-0x0000000000676000-memory.dmp

Download

memory/1840-105-0x0000000000870000-0x00000000008D7000-memory.dmp

Download

memory/2076-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2076-53-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2084-158-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2084-400-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2176-118-0x0000000140000000-0x0000000140275000-memory.dmp

Download

memory/2176-302-0x0000000140000000-0x0000000140275000-memory.dmp

Download

memory/2332-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2332-143-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2332-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2332-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2604-112-0x0000000140000000-0x0000000140274000-memory.dmp

Download

memory/2604-166-0x0000000140000000-0x0000000140274000-memory.dmp

Download

memory/2720-140-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2720-144-0x0000000140000000-0x00000001402E1000-memory.dmp

Download

memory/2720-344-0x0000000140000000-0x00000001402E1000-memory.dmp

Download

memory/2720-134-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2916-13-0x0000000140000000-0x0000000140289000-memory.dmp

Download

memory/2916-108-0x0000000140000000-0x0000000140289000-memory.dmp

Download

memory/3720-362-0x0000000140000000-0x00000001402C1000-memory.dmp

Download

memory/3720-147-0x0000000140000000-0x00000001402C1000-memory.dmp

Download

memory/3772-75-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3772-154-0x0000000140000000-0x00000001402AE000-memory.dmp

Download

memory/3772-81-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3772-84-0x0000000140000000-0x00000001402AE000-memory.dmp

Download

memory/3824-86-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3824-95-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/3824-92-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3824-157-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/4008-167-0x0000000140000000-0x00000001402A5000-memory.dmp

Download

memory/4008-434-0x0000000140000000-0x00000001402A5000-memory.dmp

Download

memory/4272-163-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4272-401-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4280-327-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4280-115-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4280-170-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4296-329-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4296-130-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4296-127-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4296-121-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4324-72-0x0000000140000000-0x0000000140298000-memory.dmp

Download

memory/4372-1-0x00000000021D0000-0x0000000002237000-memory.dmp

Download

memory/4372-70-0x0000000000400000-0x00000000006A0000-memory.dmp

Download

memory/4372-492-0x0000000000400000-0x00000000006A0000-memory.dmp

Download

memory/4372-0-0x0000000000400000-0x00000000006A0000-memory.dmp

Download

memory/4372-8-0x00000000021D0000-0x0000000002237000-memory.dmp

Download

memory/4780-24-0x0000000140000000-0x0000000140288000-memory.dmp

Download

memory/4780-26-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4780-16-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4892-204-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4892-171-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4892-230-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4892-188-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4892-355-0x000000000CD00000-0x000000000CD08000-memory.dmp

Download

memory/4892-483-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5096-155-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5096-399-0x0000000140000000-0x0000000140147000-memory.dmp

Download