f6666461d9b2b90cef980cea395874c1417410ced9c7514cb65b7b0c3e459b4a

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 23:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
Size 1.3MB
Sample261104-31rlgaet4v
SHA256 f6666461d9b2b90cef980cea395874c1417410ced9c7514cb65b7b0c3e459b4a
MD5 3512bffef5e6442dd2ad3bf3b5eac8e0
SHA1 56772735a6337792771e20b725427cd3c3dd9f42
SHA512 ff21b9e2e2abb7e875d45e6db60c300ac6a34b8c865d6362d5dc037795787a53dac63821bd2e9d40ec331eff4a1441658faf95a214a85f5f97708f48e4ccc9f1
SSDEEP 12288:kBHL7NCGg6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kw:kVLcGg6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A6551321B2D4C0B2D8A102768591D759AD37FD325F3488937BA539DEEEB01D48F3A292
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5196	elevation_service.exe
948	elevation_service.exe
4524	maintenanceservice.exe
4548	OSE.EXE
5284	PerceptionSimulationService.exe
2344	perfhost.exe
5476	ReFsDedupSvc.exe
3740	SensorDataService.exe
3284	ssh-agent.exe
5452	AgentService.exe
6104	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2fef52de3a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe62be85b86cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a2b1d3c8b86cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
5196	elevation_service.exe
5196	elevation_service.exe
5196	elevation_service.exe
5196	elevation_service.exe
5196	elevation_service.exe
5196	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
Token: SeBackupPrivilege	5476	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5476	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5476	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5476	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5476	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5476	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5476	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5476	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5476	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5476	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5452	AgentService.exe
Token: 33	6104	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6104	SearchIndexer.exe
Token: SeDebugPrivilege	4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	4416	2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	5196	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6104 wrote to memory of 5056	6104	SearchIndexer.exe	100
PID 6104 wrote to memory of 3452	6104	SearchIndexer.exe	101
PID 6104 wrote to memory of 1692	6104	SearchIndexer.exe	102
PID 6104 wrote to memory of 1972	6104	SearchIndexer.exe	103
PID 6104 wrote to memory of 5864	6104	SearchIndexer.exe	105
PID 6104 wrote to memory of 4104	6104	SearchIndexer.exe	106
PID 6104 wrote to memory of 4664	6104	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_3512bffef5e6442dd2ad3bf3b5eac8e0_elex_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4416

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5196

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:948

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4524

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4548

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5284

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2344

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5476

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3740

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3284

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5452

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6104
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5056
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3452
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3064 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1692
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1972
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5864
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3064 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4104
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 09c3414d3b1f41d78fc0d331ebe7a14e337308706c62e60352a925f531a3fb55
MD5 cf5c2257de90beeb3c69cba7a32164bd
SHA1 5db5eea5ed43a31f00f65cb408760296103ce3fe
SHA512 4f6480db8eb5d932eb2f5f992658655bb9b229b368f32092d56f43c66bf4b4e5d7acfb95e483bae861267474dd618d68f980fccb719698c99b1af73b3897b21a
SSDEEP 49152:cb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnxDmg27RnWGj:G3q6sjBqD527BWG
TLSH
T1BAD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 0b88df2678ec6b17178f07bc1494e49814ac9c632276b1f09e6aa5d10ee9137e
MD5 cc077297d3259fb4d165369a9892a999
SHA1 d892b754a5b559317b80cb86642ac9d70c93e5ef
SHA512 98760f53c11a9c202f0e88ba974ffdf2aa3a1faf4cfaa93e14bfe18c94ce3999df2aa5237ddbf43b9f880bc6678fb214d8572633bf64abd581f7e05e273bd466
SSDEEP 24576:qXYfDtczAKsqjnhMgeiCl7G0nehbGZpbD:xtcDDmg27RnWGj
TLSH
T11B650129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 a49e5e609a4a44297c0f47eebe029f7bacb5f235d2f4249300e7010a5a96e4c6
MD5 6c5dda4df24faddeba68711dc3adec79
SHA1 e7aea5fff3d5af5d79736f7f7883552f9b44f06e
SHA512 3565ec349d7833d31d2bf5d561a3fb2005d44f1257ab3de2dddf92726f6817bc677b05f329b0647ff08f3c541a55ea8c9b7ab2d6995d5ca65022128e68ad2d45
SSDEEP 24576:90Le5ji0hmxxrMVsqjnhMgeiCl7G0nehbGZpbD:9Pji0AjUDmg27RnWGj
TLSH
T15F859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f4a246c44fd67163f7d02f9dc277a65af01bce826b96c0d916005ae8788a4a67
MD5 354ed77e47dc88d5883df84beb3ba4e8
SHA1 6ace93cdb0e5750d54c403d986f9ae920c69bb32
SHA512 0cf47cac9cd177452a69684b242ee0b380fb670005d1bb4af89081ffec9cc6d2399a5529758962900a0f94ef45edb62c2744541c85e01d007fbd85c50ae356d6
SSDEEP 24576:xa7/ezSC6vUyD/aqgrvWn6q8wyuvsqjnhMgeiCl7G0nehbGZpbD:w/ezSC6vUzPveHjyIDmg27RnWGj
TLSH
T1BE755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7a12502feffce7a946b9b8c2a940f5cbc1f8d80a62b8bd4a7b599ab3c7471e17
MD5 20ce9c1a582127479baab07cc7b92c11
SHA1 c8a77734df784cec1e604b37e0a42608f882e17d
SHA512 f83a6ea494e8d3607fc1d97034329ee989a87b08a637923b1844683dfc051003362d777e0ff32c9e2c7d4b1a4aff425a21c47f79ac029cf97d90030bfb04df7c
SSDEEP 24576:0VbqPb88hv/l+Y2sqjnhMgeiCl7G0nehbGZpbD:0VO88hXl+7Dmg27RnWGj
TLSH
T1E9559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 5ef588de6c112c070a8e92445861e50f71f238a467b744958b21dcd0141fc7a1
MD5 31b1a97bb259b9db46d94b59c79bb79b
SHA1 7ec1d48d0d6674ffe33c546d29216de2318f74be
SHA512 afb0912da317fe1fc3bb96f0e9c5d5e4c0b12da16e4b1cdc53fdb31eed642c4d121828e9b72833e1d8693939621d07c33effa4651bb4d693fa383bf1068242ac
SSDEEP 12288:2LxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2LxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14E4523BF964C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 ef081d3ec902a4bef74fe10e8b466d8ec295e2d53818e498ac2d4d3e9d69a061
MD5 17116b5d770c7f892cbf3f17766f84c4
SHA1 bbaa847751c82d2c99aed19ea211f7162e3c31cd
SHA512 cf4429d392523edbad5fb85e17917ca35657cb18226f27bf6f9d2311a43f1686fd9da8a8808e7f932d4f027144dd5ea29074914065d013c468701a237c0b7111
SSDEEP 12288:PeBNUbTVO86U+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:PJIU+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13A65CF7BEE28FCD2C27A8DB95791C600E76278314B21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 300567c910505e880a6d94f5fc395340b228ce3f1003b455ff1d5bc4b332ab58
MD5 063761dafc11c723bd30f68a01b742b2
SHA1 e7c13d91c994d92f7093439fdc8d4b883714f1f6
SHA512 1da8795de2e3a8f0062d03f2abf615be44acc3d15862651d5946b2aefb4acb6a827af1ef8970e5d18ea08764c0e0a13d99db37195900a869a9317669d7136ab0
SSDEEP 49152:yQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THp:yQvGAdlCEL8c/DRNw5CjD527BWG
TLSH
T15B266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 6644a6783a31ec01bcad66a33c54a62098e58d720adc07b7892295dca1eb1940
MD5 8ee45dae5ba582cb7369d7f5f2826536
SHA1 c8a378341d65fbdd1cbc740949bbdda64170b534
SHA512 33ee433dab2b1fe6f91f8a2ef9f766832a93df6b4d0fe5d91c7e4c89035bdefbf106f560b286d15c37fe844b53c4238175a2b40155157ea7e2f55e517e3567d0
SSDEEP 12288:aAwSfxL/2Dc3RDLLmt0LDQewsAj4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:v0ewsAj4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A75E031FA74E036C77B0DB60B76D71A182D7A204F6119C3E3E89D9E99702D12736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f124bc55c455e96692d5106a8ea08138325fc4d3eefd2b786dbad48a77d11ffe
MD5 55cb850bd1560e37daed5f4d78d66b7e
SHA1 276899e658c1fadbdc2e807300ae912ffd80e919
SHA512 1ac708f65693757fa9561021bdf1302900adcd212055b25a1be07c407a8dcddf70b7ac6c856479d05534064df3f003406a10ca914e5e1bad22b41b94621250ef
SSDEEP 196608:IUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHsVQBWG:IUEtQevvqc2W1cpV2tI32zB
TLSH
T12D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7b3363ff948039b9bac37f5c9259422dbd239c1ada5922f682aa5e9b828eb52d
MD5 01cbf7057acf50d777af108d8859e544
SHA1 21a364d7360fc2f59be04dbc491aebfb1a57c28e
SHA512 cce15dca9a735ae48c89e2272d3b3daabc02536e17e860fa1ee0eff1101b8c41906b48b4ed0037090965d2706c188f6c5ce6b0cbcf8d3e29c32d63ba3cc7a349
SSDEEP 49152:CCbRquA/m2yL5zTfFiV+XenmE3/zEDmg27RnWGj:HoquVjnmnD527BWG
TLSH
T1D9D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 929eb9d82c055497048753b08c0fb711437200a31c3a0361d7e4e0950cee1e15
MD5 28a996a34b9c27ed39cef40c30bff8f5
SHA1 559ed1df1d02ad7cb626a8319361be9cab93c047
SHA512 312b4aaa785998c6dc0f2ef24167bf15a16aeda15c2d2bcb5aaaf33790a8d5d9fb1afe01efdd54a933eeb832c4cb3a8814de9c3f5bf8b5ed96dff8da84588191
SSDEEP 24576:kAhGL3IFoiwtA5l7S53DsqjnhMgeiCl7G0nehbGZpbD:kAMUFoiq53Dmg27RnWGj
TLSH
T18D359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 89dca2e6d50fcbb0a0a14401e704f2db491f884de549aeb7224f7c584a932c56
MD5 6479d97c474e5715dc4103a29a16eb84
SHA1 4e3d4f7fa74d1557d578aee74ebbec87b4182229
SHA512 947f7e4beae7a6f6368a1782fc28895bc4c232c82a0af5e52512d240f1709d777b1f87f0410911ff465ffc2ad0b5a24cc6976db4e7170e2a5c87f89410a7c9c4
SSDEEP 12288:Rmw5HEjsChNVBFgl0WDm+CPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Mwu4OW8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12165F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f60c38c2aa3aa977ee628a6f206f23177ecc301d47ed234fd95546e3b2f97055
MD5 4d6e6bce2dd3c963e35bbcdf73154ef7
SHA1 8a841ab5c69a1972ab807d774b7d479d78a87db0
SHA512 e9d7e1ffe3991424c0851bf8d2997e2527b03b2e40d87e9cace2ed2e0e42bffc6f558e84bfbf50205725f4defa818bfa044e03134c1a4f0a83e7af6be4e50a93
SSDEEP 12288:EeZ1IyIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9ZudsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10D5512AA239820FAE163417CC5E5D609E7337C62673003CF166659AA6F73AD44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4172d441b063a79decd907b0aa001cbac408c3520eb965516f12c177a1828b84
MD5 a0962ef95fbf780d65ca6a65b4320390
SHA1 68c7912f9b32217550b5f6ceb38fc9d48a6e7c78
SHA512 00be14285b3583e22e5c5178c7702208a1b641a03f28c02c50c4d6b9b4a373db08624c1361d98f9c20a14b500b53e6b757014e5f7799f79a463403488215e36e
SSDEEP 98304:mQRQyi36YOcPbLvw2gAf+PN3WD527BWG:NQyiKa/X+PNGVQBWG
TLSH
T15E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 cf244b7eaa6c847add4d09d6dcae9a6006843aea7616b86f764d08c5d47d3dc9
MD5 67066dfe2c74a2d616a21a3af175c347
SHA1 d381eb184e54da06fc482ef508dc59cf7bdfb7bc
SHA512 8df10648c928c418a446a877d005a3b4baa7e8aa44a54d4e96ab6be2c67fd3786659509c304c8a3f287fa472a672563d77b0dd8190e28a448300b3ad5f9f8620
SSDEEP 98304:9QRQyi36YOcPbLvw2gAf+PN3WD527BWG:0QyiKa/X+PNGVQBWG
TLSH
T10F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 51f651c72eaf7dfd3a5b74cc7adb2349c828c25d7084c4ab586488307cd3205c
MD5 c1fe341194134aac10dfa2786a417d3b
SHA1 402c673ec34a8695cfb15314137daf41f6150b2c
SHA512 424a9baba9796dd35edc5c0ce764de19f91f98029e5eb7d162c3d84905fd2fe5d591ba26d7a9bfb4210356184906a0fd74cdb6378b169db6be29d7b12ff21fa6
SSDEEP 24576:7wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0NsqjnhMgeiCl7Ge:z68Qg55nhceWu7PNU3/UDmg27RnWGj
TLSH
T18CB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e33eb3d3c766f9f440045468426f3db1dcc6c6b0b96cf382ba5141d36ec09913
MD5 cb2fbdab3c9b628f10bc63c3eeed3065
SHA1 1f334e6b11ebd1d8c9c467135f0cd0ff1686150c
SHA512 df4c007e0f92ae26d9377f624a6742b8dd7965af293bd672c4b2dfd1ac77c3087fc79cb450e734a9a8a83c2f5f590c37d5f177b01329e3f03964fdfc575b6607
SSDEEP 98304:Qy5112gYy5azzVvt69nLKnhZFD527BWG:pLIHEWhvVQBWG
TLSH
T19C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 75d9b0186b0fa8833dfb71458a3fa7214c36d81db74bf30fb22b8155acd92607
MD5 f9fb46bec5dab946dc3589e944f27bdb
SHA1 9b16045a43609180e199408dbb611fcfae60aa71
SHA512 5ee1a1c2fd5744589e32c095dbac0514299817314d4d87b83fbdec5b9573f13d659b1ee285b947baf846b422d363ecd58150afade62ef8f0e397786b2112c8d9
SSDEEP 49152:bB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glODmg27RnWGj:Nu6Jmdxd2dOD527BWG
TLSH
T1E6D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f3deca0afdf8883cf670ab6ee97f214eb8858c32b13e33af7afde4349151f3de
MD5 ac3434a8262617d00f0c4505ce768164
SHA1 706092ad52ee30eafc4c18336987367e64bb1ae3
SHA512 cfea676d5ff36a989fe3cf24778e07bb0243adc1ae2e372a580a6cbde7ac5ae4e31344b2b3766048cd973e086e80d9456b0e4fb86bc21003b0d3f439beecf4eb
SSDEEP 49152:+1hpsNoJpF1A63U44CwH7R4xyDmg27RnWGj:+mifPWRnD527BWG
TLSH
T145B5BE13F2D800E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f8a4f461a63f7bead4c035a9ae2674026d5649c19edafd9403874409829ac7fe
MD5 975f30755a802b185b86ddd1b8b4c219
SHA1 7d5acb437c4515af940932280031aa38dd2b92b7
SHA512 f968d8f9f2ade274c4d3aa32429e7b45ba00ce1456a4cb4edc3d1021938e1df90ae7883ba87166cd2b3aedde20621308e6423d20b9dafbab8e0d2ba1d2f5ffee
SSDEEP 49152:BSuZQIY0Be2KcRVtOnks6NMHqBDmg27RnWGj:P5dKii61BD527BWG
TLSH
T12AC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 531f6cc6f09d1f4fab75768a23ed1f0e18231cc729635ed03bafb00c80c5b1d6
MD5 bab463127feb2b02b5bd938c988e03fa
SHA1 1cdeca0e11ad167369907a3062fa852d2f7a40ef
SHA512 40d5b983edb91b2ce65912dd59b1a2a2b37e8b3800b18a2dcec6394ca3a5872113d678c79723e12ffa0ae2bfb7ace6d5298cc70ac9923f80b79821ac6adaed24
SSDEEP 49152:8htSn8EApI0fig3giDn0AP5weDmg27RnWGj:9X2imphLD527BWG
TLSH
T1F895BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a5d65d963d8f906eb5d015e65fab21750c5882074afbdccbb7b6b883bdbc5809
MD5 7b059fbe6e5caed5d6193d601c5ed513
SHA1 27d6843e9062c428e64db346c360c66eb2a5d6b8
SHA512 2d59403eea044a05a4ca1c9772e9f9a82f7d6b4e5ee78c9ad1d7cc7e33ac4da72fc483d772e8d885ddcbd143d4ec0a14ab8cd12a0c9c141cf3e34d53bd9a5a9e
SSDEEP 12288:xZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1684523BF965C41CBE52648B5C3E5F10EAC073E5BE92004937A577CBAFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 ad475bad1d4691840b045bfc412d5342f7ccbb7cdc86aed7118f1e4acb7d8289
MD5 23e767dd6a579b8ec281fd0622577b9d
SHA1 b8af6a7aa09a4e60db2ecd09b228cbd0075f4333
SHA512 b5a29f7e1e0cf90001e7c256b81ad95ed6ccdcf0f6fa0d300a16227a9d8e6f04e3a1e872baf1e1c5bf5460851ff3db23abb2d18fc40d5346515961e776da2cd7
SSDEEP 12288:Q0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Q0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1044523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937AA77CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 9d98a7e9e8e6bd59043d958180b64523ff5650e83f095bf4a85418c5e4f059f1
MD5 a9833261c7d3773e1aaa0eead4477e03
SHA1 2b58c27bb8e9d2549ced7761fb84dbd43e7d137b
SHA512 8f22169632d956cea2c4ffbbddd89402d7c62d50260981141f5c089a047af235235de73ebe0a7fb6793de08fbd399a781ea1bc0c29da53bd0de0aad22485b502
SSDEEP 12288:FmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1564523BE965C41CBE52648B5C3E5F14DAC073E5BE9200483BA977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 b445a0644dffe9f2074148db8c12e9f25c1d68859a5d887638dea324ddbc5a8e
MD5 607c8b8ba3261bf7cd99b009094f5523
SHA1 8b0e50ad2a3debfe22c47723a181bedeaa071925
SHA512 72fcc895b3ca06ee3ac9e1362717c04ab9e1e4b7cf240c5e0c0c59bd86ca0640e6a876769f1b485895ec4e9038372a67c919c75da635b236bf34976e337ca4d2
SSDEEP 12288:+VjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12B45236B675C00C6D83285B4C2F5E11DE8237D96EB3005DB6B532CBE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 6a48e78c31e02166daf57501e415cc83edd44e662495cb9655ebb24a7b04808d
MD5 1efd42f8d1e6262aaa3069ff0d92c0a1
SHA1 db83690b5c8f8fe30eb2b52d5460b571918b36cc
SHA512 8d2f7f375e0913c40ae1be9b6650e58023ea4063267ea9920f71068292bdc11ec2d21e0344968c63909fe92f60389ee0011a80202590bb0fc610674fe2b8f62d
SSDEEP 12288:5bXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5bsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1544523BE965C41CBE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6c6df7426c9bc2128fd55b1aea01e512f062db69700692ec4e626f1324bdcd2c
MD5 ab471504afbfd1a1f4ce9f4fc3c9cea5
SHA1 2065e01d059d5c2e4aaaef22db1f07b6f3856aef
SHA512 69a8beeb5f50ce70d25dfa4f94e3247772c35ad6a08e1ec9f671e467f24f10d7ea9ccab4aab3166da585334c5e5a51922348a4714bd8c07a84cedeb7221dbb7d
SSDEEP 12288:hAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A94523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 a24982021b40c2c92930bc8ed66055fa415f084ee3108057fe546a55a234f41b
MD5 0574ffc6cee47c9e7e10ca11717c77ca
SHA1 c36683f7c94ceb696da871a4eeff9657fd1da466
SHA512 c751fb596f1cb8bf34b246ce2a82ef4b2d38f68456066ea5632165d3a745d779859ee49960cd8bea398ea937285869e7e4ef55ffffbb546be66f06e31ce50629
SSDEEP 12288:WsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D94523BE965C41CBE62604B5C3E5F11DAC073E5BE9200483BA6B7CB9F7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 021711605d50e8dd4dbe7208d89b50eadde380746270e684ed88af83a2958ba4
MD5 7be77ffdb7206ef5e9adef962f9c71f6
SHA1 d29f4363eef9be6c695c75250243422df69f28f2
SHA512 5fe3000dff52171547a6b955b53acc53a4c9ae3ee2cc9de816016a529f122ccde5f2e565356060d7a1094b978be7b18f58dbd4bbe96cf0e04e4e7a06bedb4418
SSDEEP 24576:fZMRzFVSOUsqjnhMgeiCl7G0nehbGZpbD:fZMRzfMDmg27RnWGj
TLSH
T1176501A9B39018F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 a2ef1dc21b132ba9ef72228f64fd4c94cadea4c571cbd3aa5ce371df7b1c02bd
MD5 728eb0783768efd8cc437889791b7211
SHA1 d6b7a00d862ccf362a2600b1b52f5026c211d8c7
SHA512 4fcbab096b9dadc7f0be3067dff686a69c7ea9d417fcbaeba8d69ab3d456965b67df7027c5f496e822543213f2c9f2cb87a56a7bb372b6f424c020892b9248d4
SSDEEP 12288:ItXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ItsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C24523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 7141190b91193ac003e09c72dd16b77acf066cd15738027a4c61536a4d957e9b
MD5 2c11fc7761db0ec619306f1aeb2ebd0b
SHA1 25f14ae7ceb5ed58f9c9c56f2f563113b0c16d24
SHA512 6ba2bb13f38931ba9921d9ebbade10c090cc47749988a8f74a44d92a3ee38c74aee6cb25468d2824c85bb9b0e8fb81637b68b19f9cac063432f508888f1c243c
SSDEEP 12288:EBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DF4523BF965C41CAE62604B5C3E5F14DAC173E5BE9200483BA6B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 99fb1b7fef7a673e7db7dd13f6cc0ee04f0d40c7f0c2c80683ecaa006c6fb658
MD5 c608a2deba8c89ee6399ab766709a601
SHA1 7137407f964e5ed89ae509e6b7ab47ee62ee9dce
SHA512 21d2640a567f96229e637ffbd3142f5ba3f4a8edbbee19ee319f5b66ffe7611edb1d74ee7ab753254441358c0285b5724279bf8b8b4c4a22dddb7481185a96a2
SSDEEP 12288:xyPz5L8IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gzyIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E155125B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 1158c05bdb0feb5c52c3613f00003729e8ecf60f7a77db6479788fc2bbe67bf4
MD5 e9eec6b6d600056c81a4657bb3a83f7b
SHA1 40857a3be24d9d8e9646746e09c446ea5beff895
SHA512 22fc4ef854017bdc467415ee882d331ca47540c5d04c234bd9cd48893071fd6ded8e4d42a9aec54c847edaf4dfbf0834df4e78ac11b13e35b785c677aad7fa35
SSDEEP 12288:vtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E94523BF965C41CAE62608B5C3E5F15DAC073E5BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 2dac703f3dd1cc83319747c26985162b0cb417e8a5ed5ba31e949361224ba4a2
MD5 55d172302d728ed3e092b55dae45fe67
SHA1 06a6a762f374c0f7360a1f673ece51b452b2f7fb
SHA512 4f481f3622b5f750dad3af8545b9f9e86a15ca41348a49f2d8fc79e37a24443ad1e6245379c19e510f1fc0ea2d58bf47234bb9e99d245108eb0a6ea3f0a473fb
SSDEEP 12288:6tXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6tsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1864523BF965C41CAE62608B5C3E5F15DAC073E5BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 908ed14eca80ae5d3b6898024827caae0cfb600cf9354603014ce62210e0d2f9
MD5 0683d6bd927088867092c53da30f9e94
SHA1 26465b4947e48a60e59af8dabc3d126b7f244152
SHA512 c03b2f35944e6e8af2d546521664470b0607bf8a935439c2109414c4798cacdc2f075240599c71a1d14bcebb0f74f0329b303ca887bf05cbb706afad48b80d33
SSDEEP 12288:PyPz5L8IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:izyIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15655125B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 98b88d7b10d460d3bc770496447b90471722363dbdad47dd367dda720f2f8a2d
MD5 d4c714720e29aa86171b7c8118e890e7
SHA1 d3c36ad43007117b379fffb2e14340e662df6518
SHA512 d7a7d1ef4094df02ab4e0c6268b20643e878def08b331a6895b63ae20c1f8cac573c518e12d314cc7772f4f009dbcca882ed454c4fc10309c23a4e44a9146d56
SSDEEP 24576:pTDaLl3z0zDWsqjnhMgeiCl7G0nehbGZpbD:pTuLljTDmg27RnWGj
TLSH
T1886501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 ae8ffe1ac6c292369d99b0713fd6e6a1e81358accb02033a544a26cc9053eebe
MD5 9a5b4c38854330e1f1e44f13c8f39a04
SHA1 5f1bc3395d9b4358ec3bc81f34393d8b7b7cf22b
SHA512 73f429937d82e3a7c8430a6f697f4ae3aa0b41ef54d7e346406168cecbff21995abf1ff8f9021fe239181e85cfcaab1d85f078347466a5944a9bd067d20cb582
SSDEEP 24576:+3vd9CHKy7GZysqjnhMgeiCl7G0nehbGZpbD:Avd9CHKyaMDmg27RnWGj
TLSH
T1D675CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 38080af278ba88f9b3e63d1305d4ba5be6d3c212a598f74b8c1039b44b2c0ca5
MD5 3441d47ce96dc0dbbd64af6caad7fdbe
SHA1 455f710c1311af29058320f757012e5311c2bd74
SHA512 8ab54b033d8a75ae60327f7c87f0f40dc9e11292278962d1e7a99c15414bf130fabaff8b978a834a3d67534524478b920718ccb8d175774d82f47a0e136edb43
SSDEEP 12288:OGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14A4523BE965C41CBE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d11cf251e4112fa66dab8003a8d57efe716aa9ed0aa42a526d72942006e0b026
MD5 74e4b4b9743c59139c1fb6593d14e270
SHA1 c5324f5d577c902653ceadb05975a7b1942f8926
SHA512 930a3d7e6b52fc5bd6e93fa71f24f0727f675c195e8caeeab7ceb8dfb7edc12ee509443245302b6273cba8628f31dda4433d11bd1d5896a3d9f42177491e2709
SSDEEP 12288:/oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/osqjnhMgeiCl7G0nehbGZpbD
TLSH
T1954523BE965C41CBE52644F5C3E9E10DAC073E5BE92004937BA77CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 188a2b397ffd51ce7d36376374804fd580d9638a588118cd7a0a385fbb038fc7
MD5 abb73b15f598f9ccc05094275e714f78
SHA1 3fd5e0f816a596e66a14685f404da5366580eedf
SHA512 e75973397a4fabcdd593b9dc652d90f602abceaf380e445f6faeb5172bdfd1f52c902b49afc702baeae1d0e032d58ab9133a63d4ac83db3fb731e94a45ca7418
SSDEEP 12288:eHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15B4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 da6d8bc3123f48488292620410c17e6ea91464ce21be8b1b66ad99296ff2d840
MD5 8a7091f1ca1ddaf4f458db2278d8ee99
SHA1 b58eace1e05538c62fb42dfb38667e770f807f1a
SHA512 22f9af8ba375563bb53558350e1267e46ef0e4ba3ae0c9e54d2f77e24702f2c2992a55622443d7f3511a21a2b9bf142463e434f6ce66df080bcddc5c10a96de0
SSDEEP 12288:gtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1084523BF965C41CAE62608B5C3E5F15DAC073E5BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 fc35d7f46f4c8d91ac690ba2305c56c80aa4a5a2a5037cdadd82494dcc7c8cf1
MD5 e02c3bed50fddad4e4178b3ea05cd72a
SHA1 843374970c48c138c39bb882f4a89d5c9f4a27cd
SHA512 94298fc9018e473587f53736bdb281fe4bd22fc0aad34aba3a4d08fd63bd2668604a4f7c3a85808a292137ac5b2b629e29a6636fcb171b0974162a5ca119c73a
SSDEEP 12288:TGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1174523BE965C41CBE52508B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 4a4710978cabf382e138cddcb0a82480a77d032c38e90c13707bc8ea14d1fdf9
MD5 06de8cd96cf9fa4dae160f719aac9226
SHA1 3eeb90c50a321f5e8f432b92d694181cc2c6f084
SHA512 55da603ede36d4efb593832ed5cb6fba0aba0f90673f7c448a388f57576515b5c4b2472a7750631de29d5d8c42de7b15c575a3e21e5bcd20540fe29193099f6d
SSDEEP 12288:xFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12F4523BE965C41CAE52648F5C3E5F11EAC073E5BE9200483BA577CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 5d2231284b392938b14aa3011dd28d4257565ac772d953ddc921d70016611742
MD5 979611f987ab5465c648a93399536ccc
SHA1 2d607098274f8c5d878459156a32b27a6b636ab6
SHA512 83b00321e51e7c5ed548830a0f86457dfddc567038ac7fab010f97c5a647dc5b5f02c09ecc1a357f6cd8e1420e3a1e895391cdee7ff5fde407093bc875fb33ab
SSDEEP 12288:qbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1204523BE955C41CBE52508B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 f40b956ecfa7d88643ac340e4cce57cee92701343c0bc16a9c28f1cd9a42abdf
MD5 89df61343b9cb889130f251ff5bf72f4
SHA1 1f4bcbcad1a253f3e3fc12c26897e9460450612f
SHA512 de1867f0374bc475e1c74e68a0f85b8d9d469b7b87ce924ae58df815ceb74144ad8dc9dcd319361ae55acc8df25daa33893d85f6681925dff6cb75292d2045a3
SSDEEP 24576:lfwvUk9RX6wkyAIRsqjnhMgeiCl7G0nehbGZpbD:XMnYIlDmg27RnWGj
TLSH
T15885D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1a7870bc93d2aee61f2bf44608fab2e95be7568abfeb7b39ca10b98989c3cc12
MD5 533f959349f2beca4f176ee0a430775b
SHA1 e1f31743823e68dfcbef55f36163074725350675
SHA512 af371e62e21ac9de8a651ddc9dadf525ab73405690ca73bb7814c3ea9c3d943ad956a974645eac095097b25252fd05e731154c605b9eb0ebdc2208db0729021d
SSDEEP 49152:bYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0+Dmg27RnWGj:+ySzP2D527BWG
TLSH
T130066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 76c04d6f7d55b108b1cf0a5bb23fe6ef6147688197e81d512111567e2e2d339b
MD5 805fc0c3d6d913e94a0a19654e4f1b3c
SHA1 d6bd2716c7268dca1596ce43c8c14e6f4ef617c6
SHA512 109e812c3491d1eba701ff0739bec3e185d6eae8742e9b8d9d83438985e1601867d0cd02298c7f0d6cdf27993b45cbf49aba50b6bdfb248cc3d3571320f764c4
SSDEEP 24576:947Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYksqjnhMgeiCl7G0nehbGZpbD:947JUQjTirIhCnDHUPfF/ODmg27RnWGj
TLSH
T17C65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 c8c2dea43156697936f92ad0d8ed352b7d4768ca0fa0ed85d9fae7afc606dcfd
MD5 784f685277381a64be71dbdeb57da8ac
SHA1 c5b4a6789c2aa48a6a89229f0018f78c5b91d6ed
SHA512 5934768f79d2b564133fe240cf5a1c83994444827d60bf9c75db3a2b274aa51eea6a1262df84522987b4f8a87cbdf4606cc032609f6a43801a95609e98381a72
SSDEEP 12288:nbsfdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6dsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E255015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 bc5fc70abcb0ac4cbc126fcf8290c3b43fbd43151073d45f4e6a645542b9ccc7
MD5 5fbb8fb8de5b361bf01e441db92485cb
SHA1 fde4219499f412db29fa2c1e2d0cee02fe23a7ec
SHA512 9cf2ab4c0483ae0fb5350c893294755b72323a2cfa049a1ed7d9312fc71c15a94f1ebba93284585478647fa76ef48efd5153f05885fd681472bda76e5ddee005
SSDEEP 12288:3c0UIBq5+14BXpN8HbvABfqFk4GMA0fdXjM+/+oG:3KIm+KBXpN8HbvABf2/VjZ/
TLSH
T1AE4517107626CB4FC6A944325E32D6CCAB707D11EE056F0773C98B3FD576658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 16KB
SHA256 9ff99845ae2952d600f8ee60e4f88809928cb6bebf6d84854f3d8fb3acd55959
MD5 e60c1319c014415c3e82c0c80dd359f7
SHA1 0ea2af9ccf71a137a91e162b4630b9f253ab5e7e
SHA512 feca7927eb09e218ff7c9a4c9fc231fea73ad54c6c1545998d32113f079e4b950cf53ab8f14d8490fca5ec09016ee292a0493887a69541817dc8c3840d743e3d
SSDEEP 192:DCLllZllnlTMhRVLllZlleHjJhRVLllZll9:2LllZllnlT8VLllZllcjJVLllZll9
TLSH
T1867200A9F664F753E8B22531C9D9D7DC9B24F92D2F440B27B14E138DEC005495FAE580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 04309b2abbe35c0a8d784fa2e35c061cdf84230641c10c5c1fae11be3d9171d0
MD5 93d2d54ee291d37a0c04ba0f6dbba20a
SHA1 f07eab46abf38939bf3c3721fa93362569ec6d2d
SHA512 bb3c9718f7c97faf72b852b6e3787d908c11abd4bf9be91f4b429cf43e1d3b2bca918bb8dcfd20a3dc1cf13f4bf2745b0ba37383e4ee70fcaaeee138b72a392b
SSDEEP 6144:d7I6zZLvzcIS9mEfY2RGgKDeoHsgKDeoHoi3bmbQ3PsNVsGVSN51mNPSuNU:djLvz4xCOeidPsPS3Ucui
TLSH
T1A465FA40A137A78FD0BB6031072A5E8CB764EC12B7095F27B7C9053AD82AB45B1F97D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 5c3ed9b822a52a2b7b7254d5db964a3cd500b877d9a305ca114e8a932a3a58ec
MD5 e42284791991da7346a71b509b61f4ec
SHA1 5f0f416a1a2717484b6576ee1456c3add5d52925
SHA512 569e8bbd5f22fd2e8eb019261aafd3b4e3842694c86143dbb038866da6283315111fcca04a1c7918662dd6ad5b73e275dc4074ebe001a7d2e7827cba3c9fd615
SSDEEP 12288:k071Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Z1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11F45237BD35C518AE93605B482EAE12D681B7E669F1004C3BA1778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4cd94ef9928f8b4d762c217da4dbea692e57ee35bbfd2721ad9d7706cb51ce8b
MD5 d59cc5ae3b5d07d5b65d8ca5b547906a
SHA1 53ba6602aa64a1f944ce1bfad1a8687ef3029a3f
SHA512 814c0fb45b63a72cce74ebfff4e98708ed92fd9bc28b275542a8035022de184213be5b5456cc3704ca130a48e2994e74dc8d946fbabbb77388f6a8af10521463
SSDEEP 24576:Dgb6bmBIi49WNNFpg1rSvFv7bYvsqjnhMgeiCl7G0nehbGZpbD:Dgb4mBIBhGFADmg27RnWGj
TLSH
T190659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 5a1b5852f21d7eb961ffda7932cafdc5b7c577af3b6c67001c60be0bd7d9ca78
MD5 bedd00acfe82fddd98603e016867bb6d
SHA1 48a93bd43cc7ae5be38e037c081903b080c42d90
SHA512 a8f920370b7f5563f6d608cb59af75684e4d6de6a160c8e55a0003e855d65633442e884980780c88c22a949fb458c9985bae90ad87d53bdfaa172b9a2f2cb4c2
SSDEEP 24576:VG88u8FpJqH1bzria7/mUsqjnhMgeiCl7G0nehbGZpbD:Y7ZFPqVea7/7Dmg27RnWGj
TLSH
T13C85016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 b6e8cb408ce09d39a0bf7a8eeebdd817c033479e21270e65cd12279c0313832a
MD5 f3ee29abe60abd5f426f88e55e147e66
SHA1 81d4a1a8d421247dbcfb623ae15c708cb0866e6a
SHA512 3489c00f306aceb5c43ff6dd0e009d335a2be708782cee9a0a2c26ad66aba07580d1484b7cbb15c27f26a453756d308009dd48abeee290cb436cb6bfa69f124f
SSDEEP 12288:/HvUrBFrEjwaQQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:/PUr+NQQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A465F12F62AC18E5E676A17DC682C70DF6727862071192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1e919db40c2a4aed149ca9180d9503f133542241fde46106e722b490c8c24f93
MD5 3c4babf07394b52f7cac3ed9ea08b87b
SHA1 51b39ea384a0a008ee436b96e2d3a055b6447fde
SHA512 b54ce8cb4dd6fbb2d6661723659a22e1209e846a223b03089894f8bc40350ec2966dc9e335ce3e03ac10f024c14a27f0a1ee8c1175d9b2a0e406ebb4e680eec1
SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj8Dmg27RnWGj:yG05lO43btD527BWG
TLSH
T138D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f79dc663976d1411e491cd9ecd24bae460b02c4eca4de0d659c07b844304ac5c
MD5 c5dd5da35c984c30caf0a4fc35add8b0
SHA1 8255625e80ff7b16c7d09cab24efc7869d94df3d
SHA512 26402afffcc8c66d0becb96ef0603dc0a0f33c8feb05ce9856ba7576fe29d04eab293029a10e1daa56b163d8f0a71edd2af029595091e81e45003aca1170a870
SSDEEP 24576:+fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnqsqjnhMgeiCl7G0nehbGZpbD:ma5POZ3BJt2pasx2+mUDmg27RnWGj
TLSH
T1CA65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 608f51d02fa1eea30bd0bd3b37a36e75f428dfe54ea4a13a21e07cd7ca321c3b
MD5 5167b00a2a4b1f286112155f3da1545d
SHA1 a799e96c11b74054218390b64e424dcdbf43efce
SHA512 5970e612ef1f75296d36ed887fadbf30f12ff8a8b081afe73303a90494aa84fb0348d86a9c262efc3459e49217a5f03b656eb457c38da038a7748bc4edc38928
SSDEEP 24576:MNcwHdjbyQ4nLC18lb/EOjowL7FkcsqjnhMgeiCl7G0nehbGZpbD:MNc/zEOVHFbDmg27RnWGj
TLSH
T1C4857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e995e9c4c66011b20a9c7c119db366259e1cae7da0513d50dcbdfea1a28984c4
MD5 45c5ba2c2545a89906f4b54cc906dbd7
SHA1 de42f0d4520e0fd41e1dd3b1575cba04ef16b26e
SHA512 6830ede2016794d0d52b33162be3dfc7bd5d84beee9451619d7f2595341983db10e7a2d16aef8b2ec7abe783be76154ef671bb271a009daf720b0b43aa4da067
SSDEEP 24576:hTkNvNnaFeYhJNtmZBmOsqjnhMgeiCl7G0nehbGZpbD:hTMwBtOmiDmg27RnWGj
TLSH
T16D55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 5e42d9d2e8b12a75af3cedf2914e6ea85c0df56b276dd7d9d76deef0ac9acd38
MD5 9b673ab0bd7788eb1625a9ecb41a8888
SHA1 664731440331268d3a7b533ff777ff9da7b5f213
SHA512 4eb19a876c14466adb372084da67b9fd1af04a4e1e9b7be145ccfbf8c330572e69d163f5786a10a8041a0ce3e4c113424856f8e587fbf2e1a445f02d5675d83a
SSDEEP 24576:ZD3FHshBIYQgA5sqjnhMgeiCl7G0nehbGZpbD:ZDVHeBIAA9Dmg27RnWGj
TLSH
T13375E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/948-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/948-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/948-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/948-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2344-76-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2344-294-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3284-305-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3284-106-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3284-107-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3284-113-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3740-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3740-94-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3740-100-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3740-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3740-306-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3740-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4416-79-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/4416-0-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/4416-8-0x0000000002470000-0x00000000024D7000-memory.dmp

Download

memory/4416-1-0x0000000002470000-0x00000000024D7000-memory.dmp

Download

memory/4524-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4524-59-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4524-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4524-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4524-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4548-53-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4548-60-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4548-52-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4548-262-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5196-92-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5196-20-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5196-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5196-21-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5196-13-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5284-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5284-277-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5284-72-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5284-66-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5452-125-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5452-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5452-127-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5452-119-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5452-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5476-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5476-322-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5476-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5476-81-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5476-87-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5476-320-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6104-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/6104-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/6104-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6104-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download