a014f5a605f1e51e667a9bae9aaf2ae7c6327506c4ca483c70964f598ed7536b

Analysis

max time kernel
149s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-31_e0ee129620cef554117c996a96242722_amadey_elex_rhadamanthys_stealc_stop.exe
Size 931KB
Sample260531-2actysby3p
SHA256 a014f5a605f1e51e667a9bae9aaf2ae7c6327506c4ca483c70964f598ed7536b
MD5 e0ee129620cef554117c996a96242722
SHA1 b499ca44a3572c80d8ca7433eeac0be33c8bc1d3
SHA512 ddce514b33448641567264c681add07ee36948525f194bb78df8e5efbd2377c0bb2692e9191a4b5867a15c1bbb23577b5d70312dd954a6a37aacfd66821e6346
SSDEEP 24576:fLl5qMr1nDBNrKztqlxo8J8a3v1x37MFifLYCw:Z5qMOMlxRJ8yWFi0
TLSH
T18315E10077D0D036E1B324764A7E9665957DB9706F2582CFB3C02A2F9E70AD1EA31B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 23 IoCs

pid	Process
392	alg.exe
3116	DiagnosticsHub.StandardCollector.Service.exe
4168	fxssvc.exe
1696	elevation_service.exe
3224	elevation_service.exe
1688	maintenanceservice.exe
4068	msdtc.exe
2284	OSE.EXE
3612	Reader_sl.exe
3444	PerceptionSimulationService.exe
3348	perfhost.exe
3884	locator.exe
1852	SensorDataService.exe
2340	snmptrap.exe
2636	spectrum.exe
4468	ssh-agent.exe
1476	TieringEngineService.exe
4364	AgentService.exe
240	vds.exe
4032	vssvc.exe
2644	wbengine.exe
1528	WmiApSrv.exe
2492	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe

Drops file in System32 directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-31_e0ee129620cef554117c996a96242722_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-31_e0ee129620cef554117c996a96242722_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-31_e0ee129620cef554117c996a96242722_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-31_e0ee129620cef554117c996a96242722_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-31_e0ee129620cef554117c996a96242722_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\42802cf3e7fc2e30.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-31_e0ee129620cef554117c996a96242722_amadey_elex_rhadamanthys_stealc_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_161703\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_161703\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-31_e0ee129620cef554117c996a96242722_amadey_elex_rhadamanthys_stealc_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-31_e0ee129620cef554117c996a96242722_amadey_elex_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b0063a354cf1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000779fdd2e4cf1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a9603f2f4cf1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb38382f4cf1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1436	2026-05-31_e0ee129620cef554117c996a96242722_amadey_elex_rhadamanthys_stealc_stop.exe
1436	2026-05-31_e0ee129620cef554117c996a96242722_amadey_elex_rhadamanthys_stealc_stop.exe
1436	2026-05-31_e0ee129620cef554117c996a96242722_amadey_elex_rhadamanthys_stealc_stop.exe
1436	2026-05-31_e0ee129620cef554117c996a96242722_amadey_elex_rhadamanthys_stealc_stop.exe
1436	2026-05-31_e0ee129620cef554117c996a96242722_amadey_elex_rhadamanthys_stealc_stop.exe
1436	2026-05-31_e0ee129620cef554117c996a96242722_amadey_elex_rhadamanthys_stealc_stop.exe
1436	2026-05-31_e0ee129620cef554117c996a96242722_amadey_elex_rhadamanthys_stealc_stop.exe
1436	2026-05-31_e0ee129620cef554117c996a96242722_amadey_elex_rhadamanthys_stealc_stop.exe
1436	2026-05-31_e0ee129620cef554117c996a96242722_amadey_elex_rhadamanthys_stealc_stop.exe
1436	2026-05-31_e0ee129620cef554117c996a96242722_amadey_elex_rhadamanthys_stealc_stop.exe
3116	DiagnosticsHub.StandardCollector.Service.exe
3116	DiagnosticsHub.StandardCollector.Service.exe
3116	DiagnosticsHub.StandardCollector.Service.exe
3116	DiagnosticsHub.StandardCollector.Service.exe
3116	DiagnosticsHub.StandardCollector.Service.exe
3116	DiagnosticsHub.StandardCollector.Service.exe
1696	elevation_service.exe
1696	elevation_service.exe
1696	elevation_service.exe
1696	elevation_service.exe
1696	elevation_service.exe
1696	elevation_service.exe
1696	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1436	2026-05-31_e0ee129620cef554117c996a96242722_amadey_elex_rhadamanthys_stealc_stop.exe
Token: SeAuditPrivilege	4168	fxssvc.exe
Token: SeDebugPrivilege	3116	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1696	elevation_service.exe
Token: SeRestorePrivilege	1476	TieringEngineService.exe
Token: SeManageVolumePrivilege	1476	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4364	AgentService.exe
Token: SeBackupPrivilege	4032	vssvc.exe
Token: SeRestorePrivilege	4032	vssvc.exe
Token: SeAuditPrivilege	4032	vssvc.exe
Token: SeBackupPrivilege	2644	wbengine.exe
Token: SeRestorePrivilege	2644	wbengine.exe
Token: SeSecurityPrivilege	2644	wbengine.exe
Token: 33	2492	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2492	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2492	SearchIndexer.exe
Token: SeDebugPrivilege	1696	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1880	AdobeARM.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 1880	1436	2026-05-31_e0ee129620cef554117c996a96242722_amadey_elex_rhadamanthys_stealc_stop.exe	87
PID 1880 wrote to memory of 3612	1880	AdobeARM.exe	92
PID 2492 wrote to memory of 4888	2492	SearchIndexer.exe	109
PID 2492 wrote to memory of 840	2492	SearchIndexer.exe	110
PID 2492 wrote to memory of 2856	2492	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-31_e0ee129620cef554117c996a96242722_amadey_elex_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-31_e0ee129620cef554117c996a96242722_amadey_elex_rhadamanthys_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3612

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:392

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3116

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2320

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4168

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3224

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1688

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4068

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2284

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3444

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3348

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3884

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1852

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2340

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2636

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4468

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2348

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4364

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:240

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4032

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1528

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4888
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 3012 3008 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:840
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 3048 3044 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RdrCEF.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Size 9.9MB
SHA256 43b29be67cd466d268cd503f943727fb7b12368aff5a91620170855ea5439c0d
MD5 e5e34f5b3e2abd1a96c4bebd70c3d7e8
SHA1 02c14c23f9f6c0c96b7348e6e5ffe38b1e64fa53
SHA512 ab2c3a981fd816c8942e7ff3085ff53307f2031bc906a51c54eb39aef882b39166b9190c5cc6cfc310d77f89019b322ec63950f03162d59746c200b242173ae1
SSDEEP 98304:7rbT5DhEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZT8lR8yWF/:fdnfW/JLGMcblLheT8z8
TLSH
T10FA6BF1D7BE21036CD732176AF4FA104E739D007A215C6977ADC83981FB1AA152B6FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 3.0MB
SHA256 e52e533c090f5e745c05194c5535379e85412bb196dd21f10d8dd3630fc0d2d4
MD5 e51d9c246ece8f4a112a93d4bb55826c
SHA1 c5c04d70cb0219985431847bc802cc4691ad16b4
SHA512 0df7b03f5838d1c2b7542acffd219291fc91971d9323aec55a7ecd7db9c61d1f7508f20b1c42bcb1cfb31bb5461c2480db1b53ec5f4fd50a38b9c90c350574dc
SSDEEP 49152:/TfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJ8MlxRJ8yWFi0:/TfiG/nzU909lR8yWF/
TLSH
T135E5E426A2C8C1EBE5642170CC69BBF900146D78DBA2CDD7BD447E16B9307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
Size 1.2MB
SHA256 c3411b099d600061582d5cd9b3ef74be5846be0205f08fcc1b6c30685aae6ce7
MD5 caf041ecaa5b305dca83e823d6034ad9
SHA1 05bc836d7cebe6f0cb1be953759a54c62dd17b73
SHA512 429b68e5db571ec5eee597ea50f19a6da4961d32b28e3ba1f96bbe35c26626c2ad8bd3fabaa2680c1822de07a74a2ed7f9f98b7c74479c6e2212adeadc148f8e
SSDEEP 12288:fFvOudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/E:NvZNrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T1385523077296EB92C585057628A927F8C13CD9B4FF1813A75A003E2BDCBCAD27D7611E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
Size 1.3MB
SHA256 a1734894eb20b0607c0f21e9c7c2ca45954b2542d48893c11f4c03ceae47063e
MD5 9006bbc7ebd8b418265c845a67b8157f
SHA1 bb5af879ab17a95ca77c04c2864ad2726e254c7d
SHA512 d7fb99ce34e87de000d0849ee03ee11868fbf9810402cc33e8111ea950266d4ed9fd843689cc77549a9feed7bc2e9825495807f79d15ddd65afe772ee98693d1
SSDEEP 12288:u5Q+udNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/E:uMNrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T192551220F0C1D9B1D6A600721DAA369E803CE9785B2541E3B3945F3FDC786D3AFB6562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.6MB
SHA256 bead4fab69a2d59fa8a927eef3a86104b017459ecfea24f9fe510f2419a0bff6
MD5 59515368c6a4b23e3952d463869dcc80
SHA1 210d13ae58c3a88acd5f3f0706978ae030e363e7
SHA512 61b09a1cff19a687eb6deb31126a5797c8f7f5ea739413d66c7e3cca8573329bc57c27c27370be38b42a60becb7c5a3e7a41aadd10c7d54190fcbff42fb6a66c
SSDEEP 24576:Y1TAbD+OmetNrKztqlxo8J8a3v1x37MFifLYCw:uTAGOmeOMlxRJ8yWFi0
TLSH
T11375E11073D0C135F1F319768ABFA724553DB9B15F6842CFA3881A2E5DB0AE0AA3571B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9ffa3e7d635dfca41492976fa5472f35d4b6ba132878a942b706ba5b4789d217
MD5 f4e394cc8c3548ace4c2392f036d7b75
SHA1 7ab661fac23efd02830fd9bc77d1279bc49ce1f3
SHA512 48ae7f723f071395c586e6a40982767fa9d4af5252f87e4bbdfcce86f9b934b92b5b6d8ba4cf456c28be23f3c3d4444313f58ec75f05f6c92de29f0af556b732
SSDEEP 49152:nb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn2MlxRJ8yWFi0:V3q6HjBUlR8yWF/
TLSH
T163D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 bfc4d5b65980bd2e52f1ecf0e691805c79e9747505e17c198679e98e74a8dd0a
MD5 88ab074bcd75911bffa4c7b4203f69d1
SHA1 51a817cc7ef8bd527239c58134dccf1d2404f92d
SHA512 dcf176095bb7a59e99aa636296da4ebce8cd90b88346e5c501128d64b3801139f9eabd8b1c01f28d49e866c3d108b39a1910dc5d52a3150de6f9711fa3626eba
SSDEEP 24576:YXYfDtczAoNrKztqlxo8J8a3v1x37MFifLYCw:PtcUMlxRJ8yWFi0
TLSH
T16B050128B3E449F9EDA7813DC8A28411E63378948764E39B03E499365F337D46E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 b895598e92c1b9c8dfebd715aaee80de6cf2e7bcb9b76cc71516249b4d2a3b3d
MD5 80710d3c99606a371e388b107e27badb
SHA1 55148f9821812be71e4d0e145b63a00b0cd83974
SHA512 90083593eff40fdf8cf2fd9f08a1751eba9ff1fbde960e1f0f583d2722062181790da3ee87ba9d1601616653e3ea108549a5207098ce9a292f7d8c8dc6a1d011
SSDEEP 24576:W0Le5ji0hmxirMcNrKztqlxo8J8a3v1x37MFifLYCw:WPji0AcgMlxRJ8yWFi0
TLSH
T12C35AE16F6748335D073C0B9C5D2A69EE93130855B308ACB4286D77C7E67BE68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c839e38c5b6ead2ea35e38f49e4564242aa60c4682d8687667417011e5412805
MD5 9cdc76dd98b5a83a564cbe8a22f13b65
SHA1 d04160cf6acc64b6dcaa59df9c7c8f23f7b3268c
SHA512 a2838fa1a55cd889a521125fae0674fcb4e65fdf7a95624584077c4a025f1e6c9488319558ce098e5924d21ab577febfed416bdbc87bb3f0a9e8a76cb38e0777
SSDEEP 24576:Ra7/ezSC6vUyD/aqgrvWE6q8wyuSNrKztqlxo8J8a3v1x37MFifLYCw:Q/ezSC6vUzPvxHjyEMlxRJ8yWFi0
TLSH
T191755C15F5788323D0B2D0BAC5D6BA99FE3230865B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1af83c6c5024e564b1c2542994b7b55bdc244cb4420715be81614c1b3dfecb57
MD5 6c703422ff2e262d69ad95b4b606cdd0
SHA1 12594ecfbb05f656bf24a1dc713e6ad742817021
SHA512 6a3c7e3ec86a1bd4b925a9ee149adbd7c6a0b5d0693721ae301d47fba4e53c789071ad6b2b7b6301aafcfeafcbea3dea515f127ce371069dbef3186bad4747e7
SSDEEP 24576:SVbqPb88hv/l+6hNrKztqlxo8J8a3v1x37MFifLYCw:SVO88hXl+jMlxRJ8yWFi0
TLSH
T196559E66F574C331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 21e11068ec1a1041ee51b0fe35d41b5d954076c94a7b4b90328ac9bdf5f93e7a
MD5 e84bf9d4340b9704207b472f68e0d453
SHA1 ca7f4ee304145738171c0eeef98fb1952a40ad7b
SHA512 354e1cda9a9564957649357a384f92f691792bfaf119301bd1bfcaf57287ac9747518972c5831148aef900297f2e24f727ef62ffbb33c31139fabd1f068b8a72
SSDEEP 12288:URjudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/Y3:URwNrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T13FC42309A0A4F9D5D7DA097675FA3498C2345DE8F46C032B58107E37DCBCFA1FA9A10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 5e4125563874be465528da85705fdce475d67c8073a5022693cef3c8aa914b18
MD5 0aec7a2dc3629b38cc2de1967787d1c7
SHA1 135b58ae06079f20b3864c31bb09ba1a256c3c32
SHA512 23955bce805c722829868e71a347fb6f236274041fefa00cbe49fe82a2114b3c1b3d3000c9c536b3d000656f227e719a8069e578b01e366689fde9ffcb07ffc5
SSDEEP 24576:VJIUJNrKztqlxo8J8a3v1x37MFifLYCw:VJIUiMlxRJ8yWFi0
TLSH
T1ED05CF3BEE28FCD2C27E4DB95A918240D77278704B61A3CBD165830EDE236E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5802ae068ad8dd42e31c10083f22b0331f399271ad4dabaac213d8e3ba2f4263
MD5 239d80dbd9a7b59f4208b5c1deaa92e2
SHA1 63a28f87c00f70b1bc5f8c1629f7a0f036546443
SHA512 ec4abf2372e41457d7e7a322a4c8d1e16e4faa8cf59fa8728150ac49ee0dca6907fae075544f306f0fd46060f9544fb2aadfbe1bb32c72a3140ea3640776609a
SSDEEP 49152:yQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THk:yQvGAdlCEL8c/yRNw5CulR8yWF/
TLSH
T1C0267D656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 cf604ae3f2dee23fad91de5507fdd344bb12d5b65dd3c3f0a262e028fa099c64
MD5 d417ca64ac98a99b80d19ee666654f07
SHA1 560719b5368a699925424ba9267e8f6a90d17d1d
SHA512 a31627c3456b5730142c8deaab85085bb3b6f1d2badc6bf025f96f0776f6f9b246b4cfa53f3bcbf06e30df999d5f53919fffc5e32e7d25cebf25c459c1e213d4
SSDEEP 24576:ndewsAjvNrKztqlxo8J8a3v1x37MFifLYCw:dljwMlxRJ8yWFi0
TLSH
T1F215F031FA74E036C3BF0DB21B36D716543C79604B611AC3E3A89E9E98742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6465cdd8cb9a1b36b49dde2d0b5de69428d5998273297bbb0b4b05e151e08e2e
MD5 afccfdc5d916828bcc8be9032f8e252e
SHA1 616603d7464fac0de5338a85c398f3a98114003b
SHA512 53a87c35e594b7decb140f5f559a2e65ba0a9eb8fcadc993af81c51ccaa7e64a876ba43d7df90e6312cc4819559588ddb393d1624f87fe8e940e3c054a665d2c
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHVz8:OUEtQevvqc2W1cpV2EI32Vz
TLSH
T1A6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ebcd4ed6a9160d43fb75c6f0f300a1821224d3d39cc45e11325517ebac826067
MD5 94626d9239ab529ab67401e990071f83
SHA1 469d6ce898e46afff12b79b5f20453c10ae63e38
SHA512 0f1735972755d28a20f5e88287f812d953cd03724c76e01cc1275ea72f2e6fdb00622298b04de4f0603c0e8f15ab43bfe867cd915aa6e7530026b5579982cac8
SSDEEP 49152:tCbRquA/m2yL5zQfFiV+XenmE3/zQMlxRJ8yWFi0:KoqtVjnmSlR8yWF/
TLSH
T15ED58D0976B8C2E4D1F6C77886A2C647F37178154B34A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 130337e7d3ec74c6471986a398b3678388f046a37ffb2bbd5e22349b86c7f525
MD5 33364a5e41a669b27b02e6909235a00f
SHA1 1675634d8260c4e0e6c5e960313cefdc4a6dd24c
SHA512 9dbdd1c99e161c48b9494110278aaf097e40f9488738cb46acab2cc450c6b46f07325c2f7835896e482bc00b288bc01de71ef89009f196f6701e27a434d1c6e4
SSDEEP 24576:2AhGLJIFoiwtA5l7S53uNrKztqlxo8J8a3v1x37MFifLYCw:2AMyFoiq55MlxRJ8yWFi0
TLSH
T1FF359D81E7F955D4F5B3AAB8A9B69170EA76BCA95E30C20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 4eb525f9b4efe685284c8d5676257ad7dc6bcc5f03e4e74b068cc4e7218b03e4
MD5 3186a29e33da955da74aa5ffe3f7af95
SHA1 171f477f3cbcdc466f8fb3b1f1ef6d61a814f399
SHA512 9a176f7dc08b707ee873e9a426f4e8bc649a60a6c59cde42674701ca94304835b4d2b7d2d9df460f00fa67a858f5ddf3896de1cb6d300b1b7281ee6016e6d594
SSDEEP 24576:FwuoOW7NrKztqlxo8J8a3v1x37MFifLYCw:FwDOtMlxRJ8yWFi0
TLSH
T1B905F14A72E45CF9E9A7413985979035E3B2BC513A24C71F1760CA2BAF37361BD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 f865f80d6fe00c1a4eabd1ce3c006a0a71725156aa20a2707fff0b4bb9a956d1
MD5 7da51a0ba4601c14368202dbb1f49443
SHA1 d28279349b6a46a9b4f25445543b12ae71ecb8cf
SHA512 aae089284559516d5ca4588d47ff40b7ff4e4a1179a3500fc8881ac9ee4497989a735ae51ccf734d4994a77db05b5a3aa17e22a798a12d649ea5bf0680580b9b
SSDEEP 12288:NBZ1IyIudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5Nitlgym3:rZuENrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T1BBE4124A32E4B1F9D2D7023DD8E52544D33178A5B37943CF15205A2BAE76FD2AE39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9135329726ce6154ad5380317a418e2772339cac702e2a1a8e5a34fd9da13494
MD5 e97d1c53299a186b2e5d38c4c50f4bcc
SHA1 a712ede5d75d1b32bc6aa27992f2eed7a6a0e1c3
SHA512 33a0ef360ccc6c39e5649f97e6b434691d9f38281c8ea30be0c0156981b6d8b8028256a43ca56d01340ba6c990c2891f234b0238ff1e92641013482c285faf26
SSDEEP 98304:qQRQyi36YOcPQLvw2gAf+PN3HlR8yWF/:BQyiKayX+PNXz8
TLSH
T147666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9b1365f02d3d6b94507668334ee216b1139c051f1e138a0493e9d36de49b166a
MD5 b05d1ecd13c01e2cb259071303596e7b
SHA1 6342696e26bced9d4d7576dcefe0b8d271cca18b
SHA512 6d120ce6dd202677356bd6ec291e9d149deec0fa1deb233bdc7c03ec8cee1a11022cf956183a2375f825982c4fb32323eb02bf51f8e25f9802fdd6753966c22a
SSDEEP 98304:0QRQyi36YOcPQLvw2gAf+PN3HlR8yWF/:bQyiKayX+PNXz8
TLSH
T166666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8b5b333a56bae1e0126557c197dc3b52e4b00e93238084b4103db302d3fc94da
MD5 7865f04a4f29a5cfc92106fc0f3c2766
SHA1 f5ebedb37980ca68463f7ffc59b4f38dfe1d0828
SHA512 48e911e63fe61d130d58385cb7312c30bd7546410830b98c66d3a18acc6ce6eb42d647182b56a3c71ed11d0ecbda0fe1c20510371bba6d9807eb10504705b480
SSDEEP 24576:ZwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0UNrKztqlxo8J8ae:F68Qg55nhheWu7PNU3/gMlxRJ8yWFi0
TLSH
T199B54933B2F200A9C44DE1769F4A972196E17C758FE0E3DB851172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 cbeb97f947ce4233661866908c8b7f7bd58b79847056977366933a762c21792b
MD5 243aa2a3b0e0ede07dcb6aa56cdb65ab
SHA1 2c7fb26145752c607e3938f671da5147c94a754b
SHA512 366703d80e8ecabcd1d7778234a36949d914caf73d48435394478741ff8f846898ee739df921c6291c5b82a08c317ef1af2a6500a23eddb6d50a8230943de72c
SSDEEP 98304:8y5112gYy5azzVvL69nLKnhZwlR8yWF/:9LIHmWhKz8
TLSH
T133167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1f279d375bba71dae232f397150ce0fa83a18519287647dea160d61fe0985a30
MD5 5ea74fe274aff42d081dbc54153fd10c
SHA1 aa0f9f017772990490c4b52d0ea1dc3c11ab2390
SHA512 0ac54edacf79f087e32c79f693e1f9c799ade01336a4ce1de5ee667ede075ab9cc870f48fea4bd0717efb8442d9cfcb01fdc07dbfa7cb7cf4e18c105a2886a73
SSDEEP 49152:AB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glDMlxRJ8yWFi0:au6JmVxd2d4lR8yWF/
TLSH
T1DAD59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0e9f87dd507f89e206fce85f8c8b43a8c6f684ee98a5ab0d951b211079b2570d
MD5 32a2591f0a190aa0696496d4d730ec1b
SHA1 4001f6a3eca7b4486ca9d61a5848caf33959a21c
SHA512 1f1af578c5ed65216be4e8540cc223bcd343b7fb4a9258b438b469a768ed9bf453fb09d8d24c34e18876d9cf0593b00406f4e7cdc696e27918d900f6d75783c6
SSDEEP 49152:X1hpsNoJpF1A6UU44CwH7R4xCMlxRJ8yWFi0:XmifPbRSlR8yWF/
TLSH
T14CB5AD13F29901E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BFE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 42cf1eca1a3d3bbbf27caf78f59a3968c272d70b30471c35916c8c65f8e01b30
MD5 7498229198656714ddf7ff627fd7aee0
SHA1 036f6cba9ca10c7cf3ba949dbb65e722bf791239
SHA512 d5b4f76cc0e524fee87c2a8ea2e5edf804867e0431bb4ef94dd07130b5ce7d2852dea1e2319179892181eed0346ab171d62dc91fc999e2506f0804b1a23ce163
SSDEEP 49152:MSuZQIY0Be2KRRVtOnks6NMHqnMlxRJ8yWFi0:u5dKTi61MlR8yWF/
TLSH
T197C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 944774cd0ec4d8607e2d723229f90c3fdef052c3066679298d3a529f82fc7e4e
MD5 4757bcb6ba7c2489dfb5ce06ea28e26a
SHA1 1bb9ff49ef51b074aca1469c5814d392a01b31bd
SHA512 f4aed2f1db7ff6fbb4625cb6c2f7e7815f826e8930ea130976f2b68356f833be0273e2a5bf04fd75d425e8d93b25bd12a92f8bd2369b9665ca81b51826742ec7
SSDEEP 49152:7htSn8EApI0figngiDn0AP5w+MlxRJ8yWFi0:aX2iyphGlR8yWF/
TLSH
T12495BE13F2D940E8D05ED178C7568632EA72BC150B38A6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 335cf247eaa9c234e6e7a88c681d2979a2590e34369ef555b694345e03ce2895
MD5 2560b7a7a7149e41c9581db22f328917
SHA1 f28805b7528bd4e5b6ad0f9aab96cb3065219411
SHA512 10db2d81020b9782e45fafabfbc97ff2c83082562c3de17db498cdd9c78271d2cdbd4d6a6e490d9c91325d38d77b51a19869ff701362f3c20cf39db8282e3ee0
SSDEEP 12288:orudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/YCw:o4NrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T1B9C42309B0A5EAD9D6890976B5E630D8C1385DECF56C032B68147D37ECBCFA27A9D00D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 dbed5f4c663c44d1823825878a25122a395c4996d2c2659ebdc6cd5432b5fc0b
MD5 a3389dcd30912047fe5290fcfcb4ba91
SHA1 6a15567d4537f4c156a3fdf6d3e1d7b595b2eadd
SHA512 e9245bcf26e6c2ce00d316681c5be1a18943a42ef97cbac70a605079196cf8d802d72f71f6bf3751676fd3f129e675b9a59ba1d19845cb2f781ad61f2ea4bc9d
SSDEEP 12288:UUudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/YCw:UTNrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T1D3C42309B0A5EAD9D689097675E630D8C1385DECF56C032B68147D33ECBCFA2BA9D40D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 3779025efd57da96794b91b6b2ad21c7f6e50fbc27e8acfde4cbc170ad1b02f3
MD5 220af67e0409a981a25f5d14cc50e14f
SHA1 0317b2ede81550f3699335a4f42cb6f868b9688a
SHA512 bfeab36460513512b2141434be12397cabf5d0da1bdd06d43907d7e41b1df28b62291fcff600314ec5831813206b98142f45db17efce52aff457c661d3aea37e
SSDEEP 12288:cGudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/YCw:cxNrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T1F8C42309B0A5EAC9D689097675E630D8C1385DECF56C032B68057D37ECBCFA2BA9D00C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 2eedbda755543514356950045ba9e169a0e30dcc1972d7b6d0b7608c92a2495d
MD5 254e1265de5cfb8b5752d74f0fa6455e
SHA1 d04fd0f870a8ffba792a14a8814bbebb8b16233e
SHA512 b5edcdbd3705b73ca98e391fb480f134a4a4a418c596089c4041da3ec4414a0f85dbeefaa4af6baec8ae9a5f746b0351b6d5a91cbf45addbcdb5e80779d2f21a
SSDEEP 12288:TVFudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/Y3:sNrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T11CD4230971A9E5C9C5DA4579E5F62094D234BCF8F73803AF59002D279CB8FE1BE78A18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 81818b240d9ee55c107bbaa1af2e62570709dba2a8b2f627b09f8c1e7d530313
MD5 d5db9629b5a8533a53c19211bfb23ed3
SHA1 c4ccca45a6de5a7c5f9524b921670c3cedfaf291
SHA512 836117a11c8d4feef8079f150f295f35799c9384dfe8dd4a65801945d2bfe99eee650e1a051a2634e4033913127f6485ebb16f7092a2416d264f5023b9d33161
SSDEEP 12288:H9udNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/YCw:HmNrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T128C42309B0A5EAD9D6890976B5E630D8C1385DECF56C032B68057D37ECBCFA27A9D04C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 a66bfde2f62cacf22c5087c559aa8f1151f3cfe4dd1adf6f3bfcdd7353adfd98
MD5 926f3850a2e9b8b7c4bd37bdb326aedc
SHA1 8f3dcdfb6c8d012989510e042a18080f8ac82cbe
SHA512 4b134fd7723bc3b176e35e691634334408b8e014cd20ef7f946439f1207e5f6810f03ca308b9c679fa3efa6a9b093684169030f53f917630f884361c045a7a2b
SSDEEP 12288:hgudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/YCw:hXNrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T134C42309B0A5EAD9D689097675E630D8C1385DECF56C032B68147D33ECBCFA2BA9D01D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 19bc48d71ee79835b5ed9f11ef3ba48f82ca788c6c9b27a2388ded27a02ea6f6
MD5 9d035890449bb548e8d7025c7dde1838
SHA1 d203129496730ae9090092d58705d30de778c1e6
SHA512 0597e7898f41a4a7206107f3c758231939cb5dcb7ba5c858083ab7795a59e86ef42b0e04fe5e19e6f13c23b78e4571623be15d69003aa0d6c1144d7bf4fa45a8
SSDEEP 12288:LMudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/YCw:LLNrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T174C42309B0A5EAD9C689097675E630D8C1385DFCF56C032B68147D33ECBCFA2BA9941D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 4385490bee9890821edc31055280fe33f9495017abfbf8f23f53cbf8ec5fb461
MD5 c24ad5ad48aa97616b7f12ea147f8e2c
SHA1 f02ec22bbd3ac2e91cc776d50b0ccc7b8597a5ba
SHA512 a8cbcae797a74daa02c5209ba793b1d8ac2758f265e8f3da33fb6597dec2fce54f65411ff216f782b8943ac2073ccd208f523f726ed682cbb2cb2b6170117bd3
SSDEEP 24576:JZMSzFVSOzNrKztqlxo8J8a3v1x37MFifLYCw:JZMSzfoMlxRJ8yWFi0
TLSH
T172050195B3A05CF8ECA7813EC8655805D2B27C695B70C21F03A43A275F737A11D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 3da95790edf07d08ae312f970907272d23cf44bdfd563f6d5d46aff650f472f8
MD5 1d8b3c1914f7a09f3f7bf6adefd72950
SHA1 904a4dce0ad0f79f32e6bfa584db17411d03f04b
SHA512 8486b9e6ba379f9730b85073c6bb2781f0365256c67e357f2b8d1677daeb63693c24ff075fa9a58244a9fe01dac6e8f71ff31cbafa879c05f9babc7d852d93cc
SSDEEP 12288:zfudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/YCw:z0NrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T130C42309B0A5EAD9D689097A75E630D8C1385DECF56C032B68057D37ECBCFA27A9D00C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 6eadc52dbaed88206f7c4287e4015199f5a7c1415578f2b1ada70b7312a565e3
MD5 2d92b7b677b8515f17c2950d5f7efb8a
SHA1 9f3645559c6c60373971cb1ec4c3bc7ec60eae25
SHA512 0fae9d61930bd3d19e4a67c0fa895a0bd3175d998fc22d557a153682358d02ca152fafb3006dbfe189e328866c99035674e6782fdc81333cbc9b47676736125f
SSDEEP 12288:CzudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/YCw:CgNrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T153C42309B0A5EAD9C689097675E630D8C1385DECF56C032B68147D33ECBCFA27A9D01D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 5fe0f26abd827a016ae9fb4f13061a0c7c7701c8a2d976d6413a4eab9d91f3d6
MD5 bd28b13e1977fdba3accfef6cba27020
SHA1 f7a152d22574e375fe4aeff22ff7ada0f79d017f
SHA512 3d4c00f19b68a035fe194b1902562f767b1c585c4d25b3fe79416efb7eee7bae8549e9da09ca30346c0570b0cdce75f69154f733142dade82c22e5ac3588a5eb
SSDEEP 12288:ENsfPudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaLc:VENrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T192E40109E29852E8C0AE5179C7961540F3337C64A3E5D3CB56D0F93E1F79A90AEEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 168B
SHA256 f4c4131dfaf3cf2ff2ccf2d70b79ddc753287122e95270c85b00995a81799ee0
MD5 6017e964a65a997ee9f3d80cdaa08b24
SHA1 b852e30b9eab48d1fa67c49ffc6f503a366b2541
SHA512 d18241a4db4e85db080719f3afe860b12ccf271b4f9c438a3178eada86e14b7b2d22b5e2296b850108cd49a2d595f2c4407590e6e63b52df19d4c0bdf2eede8b
TLSH
T1A9C0120B833E908A17B90082A7263FE89C90B1918E458AB876303A06A22082A1C2FC18
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp5280.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp5280.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp68F8.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp68F8.tmp
Size 3KB
SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
MD5 ec946860cff4f4a6d325a8de7d6254d2
SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
TLSH
T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
MD5 SHA1 SHA512 TLSH

Submit Download

42802cf3e7fc2e30.bin

Path C:\Users\Admin\AppData\Roaming\42802cf3e7fc2e30.bin
Size 12KB
SHA256 48e5e5a907b2b15709cebbb07b41fa8ade0ec016c4ff2a68fd7212fa8ac029ee
MD5 15b7bfa38f1b9f03cd5cb53df5c0113e
SHA1 26741a7f698b0514620843f3da85b55d0102716d
SHA512 f695960eae37769d2ac99dbd0cb06652daa5e450cb85f0f7664f03cc5bf565e53793156343361e10bc8ae68b94fa7b665ef9a914f70a3aed5e1ed6e154cebc27
SSDEEP 192:d9KTGORiEMxWsbkrel1PqgIJtZbSGf5uqOwj2T8J7cCpVUpivZqsxFUDqlM:UPWpbHlRnIsGy8SAV0ivJgDqa
TLSH
T1AF42D081FD3830730CE9F48407B986290672DB20D90F885D66F762E74294E5E7E7836B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 62f3e363705c5d442e91a4af3356aaa42bc2e13ba28fcc363b74cf6b9b536ef0
MD5 e390839f077d07ace66ba7f628766a33
SHA1 80ad67957b7f4f713ff7cdbbfcea2d459efc51c9
SHA512 ba7249084847c28fe000aacf371465527050b6b27a04ff5ecde3b4c8053128ac37272742322feedb0f1a5bb2db968713e6572f411666119a6387843b65341109
SSDEEP 12288:9eudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/YCw:9JNrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T197D42305A198E989D5EA097564AA3064823C79F8FB5842DB78003E37EC7CFD1BE7950E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ff698b8fb892e6590b5e82c0528ccd4c0eace09d69c5278af0a71a5872ffc9e0
MD5 a2932f2d4af65da59679799eb2452487
SHA1 1ea63f5f7a309083a39a3e0b48dc0cdbf408397d
SHA512 ce66bae7767d8accec645bbcd1b572a99cf61a65c8efb2b57332bac37571c9e5d584a0a7cee3db3380cb25328a20d8f777752ebc2cbcdf2094b21ab1ccea6c7e
SSDEEP 24576:t8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCjNrKztqlxo8J8a3v1x37MFifLYCw:SRZwQCyiHiQEaaPnMfMlxRJ8yWFi0
TLSH
T19E85B01E62DC46A5E0BAD278CDA74407E6B27816573193CF1190C27E1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 b7821d3fed70fc643520e5bc86b9dccac96fb00a6bda2fa01921d36aa935278f
MD5 0aa35bbd4d3afb3fac88c249770f760d
SHA1 96427fd43bafc81bec1655d5058ea1684cb94b38
SHA512 a0c069d6d211599a8e0f6a9acbd4953f799e7590eef8ca362699fe1f7bf08d62914a6af5877e0a07f7477b9061d715d0a17c3f952484406140c3c1a6a28381b7
SSDEEP 12288:9bxA1U7KHudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5Nitlg5:9bxA1UGcNrKztqlxo8J8a3v1x37MFifI
TLSH
T10FE4122E61AC28E4E1B6953D99D64005C331BC69772493EF2490963F4F3AFE0AD39F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 8fcabcec68be52177d5ab22c62d2fb94aa001638bf8dea4078cf70beaf2b7856
MD5 7ee777485f3037da681442ad83fc2727
SHA1 7176ae19e3f2952c806bd1e0eecda8b2080cdc27
SHA512 4c29a168755a8ebc1b3f3346f4867cbca272e57d7b58ad5cdcf84acd2d692733dfb610f2c345d0090308a7cf402b4aef78d0e2b95af9c9db198be87286a1d5d2
SSDEEP 24576:jjsmP0yHaqrVqHra44KDzMsrnHNrKztqlxo8J8a3v1x37MFifLYCw:jjRP0yHfVqzlAsrnoMlxRJ8yWFi0
TLSH
T10245AF2EF2B910F9D4AAD136454107B5EB71782D1F209ACB0170C635AF0AEE49E39F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 bb18b92ac2b0f41dc8af47796123c1495edd77c3ec98009d7c2448602a1dcb07
MD5 97d8a96576318d50e7c57448cacc8cc4
SHA1 1b4398113df30c8dfed3289f36b3e8e391089f13
SHA512 9881a744c839c29d5a6e90ec23a1128788b24cb8104cd47a064c978e9566b25a4294455ef860cb430d82e0468e3ed371f1b8f075b5abff0a633d7c2e3d7b80c0
SSDEEP 12288:osudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/YCw:orNrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T106D42349B095EAC9D689097965E6309481346DF8F76C03EB28107D37DCBCFE2BE79109
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 65b14463db1db0123ec4e4bb7bcd3156851741b597fa22a912647359b52a34d3
MD5 659f84949a2a7ed0b18718f90193212e
SHA1 f07e2c2c82ea0ac093d80b95ad62b35caba449ed
SHA512 fd84f6c3c590bab776f7520934840544544f308daa2aac9a3877b62ebcd5b658ae6a3b214ad062525665c7123e28e6072965b3493fef86786b426927f3199f1d
SSDEEP 24576:opLBUTdNrKztqlxo8J8a3v1x37MFifLYCw:opLBUaMlxRJ8yWFi0
TLSH
T1AD250115F3A440F9E96B813CC9B69516D272B8AC1764E3DF03A84F661E637E24E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 587c2762a45696a290f66397554d9bf208d1af925f6e795cafbb1d7297d4b703
MD5 f4fd0ea8f1441e5477908200b76d1d4f
SHA1 b68b02c9188ca79017f3b4b345d1ba1bdfd5d6c6
SHA512 6e0f952a7c8fade7cb98d70eeaba00055501374bc7f1a04df3585342434f92287b35fbfb52e232d8559883ae0ad5d542bec5081f18243c29323f6e6adaa9ea3a
SSDEEP 24576:brYNHONrKztqlxo8J8a3v1x37MFifLYCw:brYtpMlxRJ8yWFi0
TLSH
T18A05F11EA2AD1CE4D57B917D8AC38109F23278A6131593DF04B0827B5E27EE9BD3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3086270374c9fa1eaf33a0c17a83b69e031aec164e19c5ba06b5c5763521421c
MD5 36ac155e52fae5f2630918175f64e901
SHA1 e7fcd2b4510a59e2202cecba2c02ea41df359957
SHA512 f747b5b6e37d92c94c29f067bb8c4f229273f5563543f448fe0c61146c6a8d7adc0c1dadcae2309c00d06fb1814a9b3e5c2de740bcde75fe42adb000cc7444f5
SSDEEP 24576:bnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK+:bnXoJJYH84VVS6AmEcJas+cHBjSSKHPG
TLSH
T1C965BF6EA2BC04E8D5BBD17DC5C25506F5B178651331C6CF022182BA7F27AF1AE39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c7a52175c5cdbb623f0d9442c3f2a523d1867c78c4b818a52bdeaae5a875d348
MD5 e543b67f8be98143b9ceda4815e3b0c9
SHA1 a288118ee8fdf8c32b0cbf3dee778e6603346294
SHA512 dffb2116bb27aad1c8862b87888f781431bbac3174155b05cbd542fa900d26794be1171c1399b004c92bfbb3d6b46f49ddfd734539a8dfbff37e51382c0c708a
SSDEEP 24576:Vv7Xbxd9Tuycf8M/TYlSuxwr2PCINrKztqlxo8J8a3v1x37MFifLYCw:VDLL9TuJ0M/TYW2PUMlxRJ8yWFi0
TLSH
T1ED858D5EA2EC42D8E0BBD6BD85B79046FAB2B855273081CF1251856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 56298d2ee20fc41567f766bedb4cdf6093bb8c4b3aa36e1890a53d6a63e2329a
MD5 b19395e31344ac0d97faeea813c90e29
SHA1 66add5fc3a90e2204735971b6a78ec4544346d64
SHA512 55a96f1e1867b5ada45c30e67d15f337591b0947cb39360ed5fa836bc1b482a8b9a45382c3554bd13f50073cc395a3045bd2f43cdafeab405be4975d22feb0f9
SSDEEP 24576:9egJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wdNrKztqlxo8J8a3v1x37MFifLYCw:9ngOJOmPOHheMlxRJ8yWFi0
TLSH
T1F155CF3FB7BC15D5E07EC17D8A968816F6B0782613255ACF0560827E5F1BEE46E3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 f9e3aba3b7a875aac251c71d3efd22d4fab6d2ae068d227df7534b5fbf378278
MD5 265ed4c0cf020360a447f98a920b32da
SHA1 605a6a215222d72b6f81241af4b9e208ad35fa75
SHA512 381721d3c98e863033dee6f614ee4573ef3a80d3f84dc959a5b6e1e37253057b03c5fcffb0061fe77377049ccd22ff9403c7b7cc1deab710643868f26d39c8da
SSDEEP 24576:KLJnJiTk3R3waE4JrOLNrKztqlxo8J8a3v1x37MFifLYCw:KLJnJK8R304l9MlxRJ8yWFi0
TLSH
T10415D12CD1A810E8D4B7C2B4815A2656FF31347C3B256ACB19B4D5317F12FE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e4f44cab99541e8b567ce41e347af7f83cf818fcce45b2b502bd15193f1f9b32
MD5 9732a7b44107106b8db8357a3103010c
SHA1 3b73d4d62aa55ed02df6fcfd32528a7180344578
SHA512 bbed2f8bc317246f1debb66fdaadf8de5d7e037d572f28ab3ca2fcb8ac2d18ba03097fffb7d0f3123f076403e6cc59d76a5b57fad70708c71d8c8038a9a5afb5
SSDEEP 49152:q9GqCzDScAZmlvTcFg8Ph6oMlxRJ8yWFi0:EylR8yWF/
TLSH
T1C5955D05F7EB5298E8B3C9F1C96294159B327C509B34F7EF0A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 21c682ad3777b5b74237f943f4ed072b905ba95402b8009417d401eb651c1b8a
MD5 849e4c1231dc90aaaf90654bef6f4597
SHA1 46b4c1d1dd586ccea8f62d4842fcd1a5d28e07d7
SHA512 ed932bd70ba193b585918fef1669e3bce178766129b1b0f3993c63378a3d447f945b3d80898fcf15863b189abac20240ea5578e9996d86d9ad6caa3f91244735
SSDEEP 12288:8lYJeXm5nkEUuErudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGFf:8lYJeXm5jUuE4NrKztqlxo8J8a3v1x3S
TLSH
T17CE4125D71ACB1E8D26E807A95E20454D331B4B4A31513FF54E0D63BCEAAFE26E3DA40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 b6181c19378aecd273536bb38dd81b5b89ceb63e26880f1bd1f9606622efc895
MD5 266e4926acd5948b93f5c812dd86c3ba
SHA1 b8a87cc2184ca36bea948f546ab37d3a64a5f2c7
SHA512 51ce8c9bbadbb728a0c956dae48d6bd40fbfa8437af081694491783e21cc518067400a43eb2a025cc27688e70ab2deea8c406ec0001060e28ae17700a226b25c
SSDEEP 12288:2wu6kyQudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5Nitlgym3:2VtynNrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T1C9F4120872E4E5D8D6BA0A3899A35094C734BC74AB2443EF5490FA3FAD79BD0BD34B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 bde45c9b280788f383909b81b2fbb5400817461825bbaf10b41c7a850cbfaf98
MD5 f1738252efb9f8f508af5c91db2e57c0
SHA1 27715d039272a9bc236ce2f736519f33791d37e4
SHA512 3574252f23062a3f5089b428dbfb88db5b8b9daf897cdd2cc187ffca8ddb8fef9558e8778eb84a9d427e6e2f53dbac409c9d84b739ecd150e098825ae145123c
SSDEEP 12288:OPKudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGF5NitlgymaL/Y3:adNrKztqlxo8J8a3v1x37MFifLYCw
TLSH
T180D4230D70A5F5D9C589097964A63094C23879F8F72812BF2890BD37DCBCFD2BA79909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 24f2b31e415db0009c3bc52dbfd88bd203b9d764edaf9752c9b2bc2c7dd1294c
MD5 6513a284527d5479f85bae15d7378d8c
SHA1 2968079bc13dc91e43d120c3f10aa5e0ca43a6dc
SHA512 658a54756b48d45dad0f9b1de24d3240c4d596618ee0769e51f01a67e68fd7d777fbab4beda986433c5d853a4e6265eaf257529da3c1965449d9d687f27ebbe3
SSDEEP 24576:rC+TyQIu93VAumZr7jmENrKztqlxo8J8a3v1x37MFifLYCw:r/TfIq+YnMlxRJ8yWFi0
TLSH
T1B2558C1DA7E91DCAE2B6C575C8A34493E633B871237186CF2044C07D499EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 50c5d25e20775bbed1389c852c2236c3e455dd9909960801d07a44feb0ffe5fe
MD5 ac907f26d50124a7054dd13e69160047
SHA1 a76697608dfc46923f809cb1ada9395041f7683c
SHA512 26c6aa75a69dd8c4b5e478837ceb01689513c21805613745605ffe5b36f6817c585158d5cbcf2ce7e300741eff838fd1433bef0f1b0705b9fe4fc866ec9a881f
SSDEEP 12288:JcyrWOstaa3kcsGudNyqR7Knztqlxo8OrCFjJYLdkl2WszePpjR+5+X3EoDFxGFf:MLQikZxNrKztqlxo8J8a3v1x37MFifLE
TLSH
T184F4F10FB2BE10E5D1AB813C88954155F6737474A71263DF05A0CB3A4FABAE6BD38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 6aaffbd434afee155b605de903ffeec1a09b8ff4c0abe955a005a3c67498cc3b
MD5 0ed60588ee7552c6be73e3602359cbf1
SHA1 e674d2bf408305783f620d293b6fc71d3ae30a91
SHA512 b93c06d2cd34d5dd9c9001b43f0d533ddc6fc02e0bb94699805084e2711b5a98f593dfb9dd6cc08a471665484a055d6a4b994ff31e43d4a45ffe0d93fe2e14bf
SSDEEP 49152:npJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPtMlxRJ8yWZ:spC7b4+80GTkNlR8yWF/
TLSH
T1ECA57C3DE2B810ADD9AAC775C5461665EE71382E3F2015DB00B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 768749d71434fae8ff162f7e81dec1eadaba5846236b5aef69494b2997028e37
MD5 4120a2d211605f1e7adef93cdb22d38b
SHA1 fb78b84d611de7c827f63e748f574e2c7fcf58e6
SHA512 575f8ed6b58c47636e4f26bb9aa3b5cd979d4228985617a7c4b6ac4ec42875317a1a481b2770ef320c5fc9067b4dc3de8878c4357721a89db71931f1610a7795
SSDEEP 24576:CSAwJPE1IDAo+4Kt+l44135UQPNrKztqlxo8J8a3v1x37MFifLYCw:CqPCIo4Kol4/QQMlxRJ8yWFi0
TLSH
T19655B01AB7F956E4E1BACBB4D663C501FB727822133163CF5290853E0E16AE85E79F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-590-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/240-687-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/392-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/392-297-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/840-715-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-711-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-691-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-690-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-693-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-704-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-703-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-701-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-729-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-728-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-700-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-699-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-698-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-697-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-696-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-695-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-692-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-689-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-709-0x00000189855E0000-0x00000189874FA000-memory.dmp

Download

memory/840-727-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-710-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-694-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-712-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-713-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-714-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-716-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-718-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-717-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-702-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-720-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-721-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-722-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-726-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-724-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-725-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-723-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/840-719-0x0000018984CF0000-0x0000018984D00000-memory.dmp

Download

memory/1436-77-0x0000000000400000-0x00000000004F0000-memory.dmp

Download

memory/1436-0-0x0000000000400000-0x00000000004F0000-memory.dmp

Download

memory/1436-8-0x0000000000BE0000-0x0000000000C47000-memory.dmp

Download

memory/1436-1-0x0000000000BE0000-0x0000000000C47000-memory.dmp

Download

memory/1476-686-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/1476-583-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/1528-609-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/1688-61-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1688-65-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1688-75-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1688-60-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1688-54-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1696-326-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1696-31-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1696-37-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1696-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1852-705-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1852-552-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1852-682-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2284-328-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2284-79-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2284-85-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/2284-133-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2340-683-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/2340-558-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/2492-602-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2492-646-0x0000000001F60000-0x0000000001F70000-memory.dmp

Download

memory/2492-706-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2492-610-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2492-612-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2492-630-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

Download

memory/2492-677-0x000000000A5A0000-0x000000000A5A8000-memory.dmp

Download

memory/2636-684-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2636-560-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2636-566-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2636-559-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2644-614-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3116-17-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3116-16-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3116-325-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3116-23-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3224-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3224-327-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3224-42-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3224-48-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3348-539-0x00000000007A0000-0x0000000000807000-memory.dmp

Download

memory/3348-611-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3348-544-0x00000000007A0000-0x0000000000807000-memory.dmp

Download

memory/3348-546-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3444-528-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3444-594-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3444-535-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3444-529-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3612-524-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/3612-462-0x0000000000810000-0x0000000000877000-memory.dmp

Download

memory/3612-467-0x0000000000810000-0x0000000000877000-memory.dmp

Download

memory/3612-517-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/3612-469-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/3884-679-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3884-549-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4032-605-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4032-688-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4068-76-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/4168-28-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4168-50-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4364-588-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4364-587-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4468-578-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4468-580-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4468-572-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4468-685-0x0000000140000000-0x0000000140102000-memory.dmp

Download