ca30b96d9623a3e26b2be0d89fab4ea32bcfd1478d28febcfb4e23f0ab3973fd

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/06/2026, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-06_9442056dc9ef72d111da85e551f6f3ed_amadey_elex_rhadamanthys_stealc_stop.exe
Size 1.5MB
Sample260606-rd1ebagy7r
SHA256 ca30b96d9623a3e26b2be0d89fab4ea32bcfd1478d28febcfb4e23f0ab3973fd
MD5 9442056dc9ef72d111da85e551f6f3ed
SHA1 b51188aecc75a0bac021a15fca8ca32f55e767c8
SHA512 d51d3ff11ec3841f6f6d4e9f50a5eaf099d2126183de81eb757373e07d88e8f2907720736802d8d26d1c5c191d3c02fffe7db60c06c95fcecfb53891efb728d1
SSDEEP 12288:ZjndvQSrUXvbGIqBGr1m+91oCW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:ZLI5qMr1nDolpPdHr9JTixKFy06IfWB
TLSH
T12075E0107BD1C036E1B324724A7EC765556DB9712F2581CFA3C12B2E6E70AD1EA31B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1100	alg.exe
3332	DiagnosticsHub.StandardCollector.Service.exe
2460	fxssvc.exe
1444	elevation_service.exe
4812	maintenanceservice.exe
2820	OSE.EXE
4664	Reader_sl.exe
3200	msdtc.exe
232	PerceptionSimulationService.exe
3156	perfhost.exe
2732	locator.exe
4656	SensorDataService.exe
3836	snmptrap.exe
3020	spectrum.exe
2264	ssh-agent.exe
2556	TieringEngineService.exe
4600	AgentService.exe
4612	vds.exe
4160	vssvc.exe
4588	wbengine.exe
4192	WmiApSrv.exe
1668	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Drops file in System32 directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	spectrum.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-06_9442056dc9ef72d111da85e551f6f3ed_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-06_9442056dc9ef72d111da85e551f6f3ed_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-06_9442056dc9ef72d111da85e551f6f3ed_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-06_9442056dc9ef72d111da85e551f6f3ed_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-06_9442056dc9ef72d111da85e551f6f3ed_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c5c493ecc9945a43.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-06_9442056dc9ef72d111da85e551f6f3ed_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-06_9442056dc9ef72d111da85e551f6f3ed_amadey_elex_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000160f9fc2bdf5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ea4b0c1bdf5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b186efc0bdf5dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3288	2026-06-06_9442056dc9ef72d111da85e551f6f3ed_amadey_elex_rhadamanthys_stealc_stop.exe
3288	2026-06-06_9442056dc9ef72d111da85e551f6f3ed_amadey_elex_rhadamanthys_stealc_stop.exe
3288	2026-06-06_9442056dc9ef72d111da85e551f6f3ed_amadey_elex_rhadamanthys_stealc_stop.exe
3288	2026-06-06_9442056dc9ef72d111da85e551f6f3ed_amadey_elex_rhadamanthys_stealc_stop.exe
3288	2026-06-06_9442056dc9ef72d111da85e551f6f3ed_amadey_elex_rhadamanthys_stealc_stop.exe
3288	2026-06-06_9442056dc9ef72d111da85e551f6f3ed_amadey_elex_rhadamanthys_stealc_stop.exe
3288	2026-06-06_9442056dc9ef72d111da85e551f6f3ed_amadey_elex_rhadamanthys_stealc_stop.exe
3288	2026-06-06_9442056dc9ef72d111da85e551f6f3ed_amadey_elex_rhadamanthys_stealc_stop.exe
3288	2026-06-06_9442056dc9ef72d111da85e551f6f3ed_amadey_elex_rhadamanthys_stealc_stop.exe
3288	2026-06-06_9442056dc9ef72d111da85e551f6f3ed_amadey_elex_rhadamanthys_stealc_stop.exe
3332	DiagnosticsHub.StandardCollector.Service.exe
3332	DiagnosticsHub.StandardCollector.Service.exe
3332	DiagnosticsHub.StandardCollector.Service.exe
3332	DiagnosticsHub.StandardCollector.Service.exe
3332	DiagnosticsHub.StandardCollector.Service.exe
3332	DiagnosticsHub.StandardCollector.Service.exe
1444	elevation_service.exe
1444	elevation_service.exe
1444	elevation_service.exe
1444	elevation_service.exe
1444	elevation_service.exe
1444	elevation_service.exe
1444	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
696	Process not Found
696	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3288	2026-06-06_9442056dc9ef72d111da85e551f6f3ed_amadey_elex_rhadamanthys_stealc_stop.exe
Token: SeAuditPrivilege	2460	fxssvc.exe
Token: SeDebugPrivilege	3332	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1444	elevation_service.exe
Token: SeRestorePrivilege	2556	TieringEngineService.exe
Token: SeManageVolumePrivilege	2556	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4600	AgentService.exe
Token: SeBackupPrivilege	4160	vssvc.exe
Token: SeRestorePrivilege	4160	vssvc.exe
Token: SeAuditPrivilege	4160	vssvc.exe
Token: SeBackupPrivilege	4588	wbengine.exe
Token: SeRestorePrivilege	4588	wbengine.exe
Token: SeSecurityPrivilege	4588	wbengine.exe
Token: 33	1668	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1668	SearchIndexer.exe
Token: SeDebugPrivilege	1444	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4152	AdobeARM.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 4152	3288	2026-06-06_9442056dc9ef72d111da85e551f6f3ed_amadey_elex_rhadamanthys_stealc_stop.exe	87
PID 4152 wrote to memory of 4664	4152	AdobeARM.exe	93
PID 1668 wrote to memory of 4912	1668	SearchIndexer.exe	111
PID 1668 wrote to memory of 2848	1668	SearchIndexer.exe	112
PID 1668 wrote to memory of 928	1668	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-06_9442056dc9ef72d111da85e551f6f3ed_amadey_elex_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-06_9442056dc9ef72d111da85e551f6f3ed_amadey_elex_rhadamanthys_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4664

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1100

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3332

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2320

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2460

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1444

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4812

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2820

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3200

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:232

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3156

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2732

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4656

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3836

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3020

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2264

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2016

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4600

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4612

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4160

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4588

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4192

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4912
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2772 2840 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2848
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2876 2872 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RdrCEF.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Size 9.9MB
SHA256 4895a060fd49909b5206afb373995cf9c3daa353b003c990913f582ba66f8fc3
MD5 a1327bb5b3bfc71bdd5f2f5e4852ec28
SHA1 65f8abb21eae901d21c4009eaada8d8d4118a95b
SHA512 dff4a10b6c43d836fceba96bae569dcdf94a47fcd0cd306431ee6143802d4cb5b595926409dc6a989bfa40a6705b41f9dabf959dec2900d7ed74863c00c96cd0
SSDEEP 98304:lrbT54hEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTPpPx7f:FonfW/JLGMcblLheTPpJ7f
TLSH
T1CCA6BF1D7BE21036CD732176AF4FA104E739D007A215C6977ADC83981FB1AA152B6FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 3.0MB
SHA256 a8ce8525a6f03a2d0251926ab839f1df03ad8df8f60516b2680490ffb959e95f
MD5 4117b30b47a85dc6a973bffc75675185
SHA1 9840e0b8a21d025aa0083074bdcae832d171fc1c
SHA512 5106b0c00bccd2408a27a288d79b7d20aab5ca2b184bc927928e4a10f1c40645f75909913a86806f2884826bf8698f24cebe84acbe128b987df5fa147850779b
SSDEEP 49152:OTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJopPDJTikFtNf+:OTfiG/nzU900pPx7f
TLSH
T141E5E526A2C8C0EBE5642170CC59BBF900546D78DBA28DD7BD447F16BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
Size 1.2MB
SHA256 62455bbf8f634af9e827df94c3513e8e5c8814b2b4aa1b6c22f79636dc359f5a
MD5 c24ecb2451e4bb88d51f2cc1819176e7
SHA1 856b2a3060202cb51189ddfc93b42e11e6ac7c74
SHA512 e4b56ab4ee8bcea445d8ff2e6efb83d3b578af11206298ba223a1b483b81aa4b6dcc144765855ff8598ada4fac081a7742cd6addb33f8c359df20e789102dbc8
SSDEEP 12288:hF+aCW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:X+alpPdHr9JTixKFy06IfWB
TLSH
T13B55225B7F87CFE3D6461671082E9BA440BAC5309F0816A35703A72B2DBC6C42D77A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
Size 1.3MB
SHA256 f8ba7d5e3756815dd54f56f3270d5ef7b8003c0775224f7b9e5b0ffb89dc0502
MD5 44a126ff20df0ed91f73f448feea0f96
SHA1 5240061fea689a3a91e82a820cf71423985c67d1
SHA512 7386f6db4c0e600e0ba349739e9b19a6ec4d42e2c4a11edf578b6ea556c94dc2395f81140c617d67e4a72760dc15f509e82cc0dfea9ed320cb972b7ffe2eb123
SSDEEP 12288:/5kqCW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:/BlpPdHr9JTixKFy06IfWB
TLSH
T1CC551266F6C2CDF2D76601718D2FAB4A4018E5340F1554E3B3858F3E69381D29FB7AA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.6MB
SHA256 3c946b583a4914796c75d2966dd0ae9cfbcb014c2af72728b37d08fbc31e9f65
MD5 62105b59413e1f183bf08a10cfac713c
SHA1 ab93e7b5d2ccd7a8233b451606b89946e81d3c28
SHA512 50a4a8b3c3e4882055f79ae4f08e585c7d59cc5af621244c0aae6e8c5cc5c4c594f8e32a26a592ee236878c4425d47112b8178ee30d5fb12b361c0080b3cabd3
SSDEEP 12288:/6dVWnxlMan7nFKbltn+Ch/m6XmCW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:S6TAbD+OmemlpPdHr9JTixKFy06IfWB
TLSH
T17B75E11137D0C136F1B329368A7FD724546DB9715F6881CFA3881B2E5EB06E0AA35B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a9d233d0d63f0e3acade1d062b413e0b4bc0c071aec34ae55d45a84328c91d27
MD5 45cbe3e279cea78677cdd3c741f4f877
SHA1 952dfdf372cf186ad1b5bffb77bb227d4c10b5ac
SHA512 fe5f917b136a1ca1de84a38a3c845a1658ce99db4aefdaf3dc8bacc70388af7bd9bc02163336009243f108b58e05ed1a1b546c8c969377b1838621e5b115da39
SSDEEP 49152:Qb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnKpPDJTikFtNf+:63q6sjBLpPx7f
TLSH
T1B3D58C03F2D900E9E06AD178D7469132E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 640f7beabaea457771983e405451c1be680b122ed32852fb48ea20d9d8d8b51d
MD5 c5aa00d9232009e2ab1d68d0cf158217
SHA1 4fb25f8d92981a3850586a29ec4517c4c2e27ff7
SHA512 099b4d238da0367c0da566e3347dcb1332754b4caf09e20c389260fa1d7c3ea37535acc301bded322dfd6e9c307ba3e265ed38fc2f7e984b912adfbb7a369df6
SSDEEP 12288:Z1XLsswWkxy2lRq2czAGCW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:3XYfDtczAGlpPdHr9JTixKFy06IfWB
TLSH
T1EA65012977D508F9ED6B823CC8A2C501EA33B8554764E79B03A4DA261F333D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 a4bed9406bec451eee84fdfe058b5269fe083df960d029592aac7b7e25837f7d
MD5 aa7e7c472c727b6392aa6cfb1f68dd77
SHA1 395b32ecc891a18e2a0f831216cdcacf12a0579e
SHA512 2c701db7d2bdf27f43379b69423189f6b1ed8bb3eaa20e7d0f0c5370f6dcb7c9053b63f40c66a2e4fcd834919806f0fd84f1c5482b7502c33440a65b9c40446f
SSDEEP 24576:00Le5ji0hmxvrM5lpPdHr9JTixKFy06IfWB:0Pji0At4pPDJTikFtNf+
TLSH
T15885AE16F6748771D073C0B9C5D2A68AE97130865B308ACB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 976e5ee80247c0dd709790063b11e47198911ad0c790b800ea0f0132a7c5b9ac
MD5 de9d53254736882d5a3617916a6e3bec
SHA1 af1600d215843827af1cbd80c3245bcdfaab2f77
SHA512 f0c7ba3dbe13e84075eaae8053f0a6fe35baf9507a415364dca0765e4f636ebfb22f6b15c38b5eff2df2146fbf178818c7ede0842cffdd83584d8b6de50c1368
SSDEEP 24576:Ha7/ezSC6vUyD/aqgrvWn6q8wyuzlpPdHr9JTixKFy06IfWB:K/ezSC6vUzPveHjyEpPDJTikFtNf+
TLSH
T125756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 dd6e123b4a0b9782936c738f3c48b2733bd55ff121d85d9f3695789a843f25e8
MD5 9f6931bc68d04ab01a09e24d08e785b8
SHA1 7620cf16c514e6612760f39c91aee269acebec42
SHA512 71ba01507911444bfa16a7a03509b7972a95476a0f47d4f5991fc1d57391d238ff215544d4eef57153370924ab8070a643e22ddcc94d1ca9401b5616d9cdbcc5
SSDEEP 24576:pVbqPb88hv/l+YylpPdHr9JTixKFy06IfWB:pVO88hXl+hpPDJTikFtNf+
TLSH
T146559E66F5748331D073C0BAC5D2AA9AEE3230425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 5260691f565229e76341fa41b32e90b28dfbfff202e03f4b7ea995023a4eff78
MD5 e40c26dd899205d6f3c2a9a7af56f4df
SHA1 84c4ecfe6a3c625828a4d55d4b05e7ed4e5803ca
SHA512 e713a428a2dc83ce3d8af04629b6a61dab1f43da7541a1c5a549c891749da3b3289101132fbb7ae542825f8e8deb4946bc12b420313a53a5b54eca4e68fd329f
SSDEEP 12288:VhlCW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:VhllpPdHr9JTixKFy06IfWB
TLSH
T1FE45239FAB86CDD6E78F3634C57FEF4104528A254C0C59325603FB17297C628EA7BA42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 bbb7eeac95891db2cac46d610564dbaec897b91b6da1bcc0597c447ddabe3437
MD5 4763aeb42bb8c4be5ce08c5ae4be1c9b
SHA1 e2b6b415390187bd5a21e75ca6b86e4f72a8649e
SHA512 9d0414dde6353ccdc9c59dd1a6b2813779ad947824b56fc5c9743844f789ea935b8c76ce75110eb94e27a7f8273e845c10eb6f9624d29f2eca8a520717ba4838
SSDEEP 12288:4eBNUbTVO86UaCW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:4JIUalpPdHr9JTixKFy06IfWB
TLSH
T1F965CF7BEE28ECE2C27A5DB85A91C700977274304F52A3CBD165C30E9E235E45E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b74c3f5fda5fe36d94d0a17c55a6b42f3beefaf20cfeceec00834e489fe046ce
MD5 b9f4fb9bf87d0607621d245cc1bd8a86
SHA1 75d87965bf50a7baebcfe9bff1a8275d918c5331
SHA512 1e0188a7f180b09ce4985f35171708411d5b8220e245871f1d246ee47c0f0ac81bbce26f35866b9a1fbd2a7af3e052cfc0b23735f8708c314ed57555830c703c
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THp:gQvGAdlCEL8c/DRNw5CJpPx7f
TLSH
T123267D656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 0427c54f4ee121c75e1b126f3aaf9770871e2ba55b9e7a01dd8569ed1e6ef2b3
MD5 1a3ebaa55690b1051abfc82c043aadaa
SHA1 78e06d20be835c52c12a16b31ef4adb8ecda1ae1
SHA512 3c631fa30cc69c4d92773648522fdba0ba54fb13da8f54717a913ab414048260b8a8da728bb42846e59d2fe61ddc8143e9f27c1a4c107ea34ec5075d5988daa5
SSDEEP 12288:fAwSfxL/2Dc33DLLmt0LDQewsAjcCW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:ouewsAjclpPdHr9JTixKFy06IfWB
TLSH
T10475EF31FE75D436C3BF0DB21B36C706186DAA204B511AC3E3A89E9E59342D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c47c4bd33f718263c8724e472ec97b63705df159848963b41e5b8b0f0f7bdab0
MD5 e3adee447e5ba6e0a2c1bbfb1569fd67
SHA1 9da1dfc751eed852f620030c26828dda811e4822
SHA512 47eada6038697ae6f30658385d613415abb9b1a76866d38aa2295b5298a10ff31c96853de06be2b074ea4254905a130e49d252824c2f8d57f47c21550c36e629
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHwpJ7f:3UEtQevvqc2W1cpV2tI32wpJ7f
TLSH
T186474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5e01fca3dd62c361a95938f26794d14c73d0c2c4dd4bff30acb9f20fac165a9e
MD5 94384ec01338fd58e1377425f2079971
SHA1 d65bd0add0a4852b7f9a2fe85732089e202bbd37
SHA512 5e377a58f181ddb590cb36853c443dd31de9ac2bafc833028d4f9f9ab198b473f57462af0b0c31b817de6d3f22dccc41a73079048aec9997be640c0d6afe3072
SSDEEP 49152:YCbRquA/m2yL5zLfFiV+XenmE3/zopPDJTikFtNf+:Roq2VjnmVpPx7f
TLSH
T173D58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f85b5a28a11cca30273ed976ee558c6c385a1521675bf42fcbeddad49d71bde7
MD5 71a5f3aeee464cbe72ca51a0a2df65e0
SHA1 8441c35b064e471bd294b2eea68bc0321e1325fd
SHA512 2d6fe92471f3a535b28f3d626eff2be7ce463134445fabf430c57d3970d0ca17c171bc2342fe8a7265e56991d9bb3dca61df189d2ef72de8b35ee2cc1dcef415
SSDEEP 24576:kAhGL3IFoiwtA5l7S533lpPdHr9JTixKFy06IfWB:kAMUFoiq5lpPDJTikFtNf+
TLSH
T1E7359D81EBF945D4F5B3AA7899B69570EA76BCA65E30C20F2150D21F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 2ae96124cc167b18aed5780eae3b3a7db0649350dfc91c987a8d4728b3b8608e
MD5 f0b424c3473c46e7d1ecde2e3fc12886
SHA1 b8227f53b99762d358b5f91573143c6d78a54608
SHA512 ef0170188cb48bf22bad35612a4285a4071ce97b1d7b34b624e2d2feafb63c81acd3f18509e249ea3db8abe4a43b9439d2554f38eb0bea18d4d92f7a99d38174
SSDEEP 12288:fmw5HEjsChNDBFgl0WDm+CTCW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:ewuKOWglpPdHr9JTixKFy06IfWB
TLSH
T10265F14A77A50CF9EAA75238C557C535E7B2B8122A25D71F0760C71B6F37320AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 73ae4b6179e201fdb601742f845af185d2c79a631364165fb28d5497d154aa48
MD5 2aa08fdad0e80d13f1dbba5dfdcc50f0
SHA1 cf349da86dc855ba2dcda768718d23251565b44b
SHA512 48c7cdd654162fb0bc05e5b58815d9dc54634c28fc2f3ea89c1e044218841ab2bed894e709ceacbc43cd58522e033b93ac91844cacbcb681a97f177029b76363
SSDEEP 12288:rwZ1IysCW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:0ZuhlpPdHr9JTixKFy06IfWB
TLSH
T16B55129F37D454FAE297223CC8F69B0587727426173543CF1212876A2F36AD45E3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6be1307bbcd4a20a55771314576621f6dc52babae3a0fb4f5a3aa57ad1d6cef0
MD5 d7358bb2715c391088afb41dc25e9048
SHA1 c97d5eceabcf608057a1672c2ffd96fc65b993d5
SHA512 12ab12c21fbb1f5e346ca8a66057b4b30a7f5384ae3fd5a5436361cf13e8dadd17223f5f2a17a1fce55a3d6d9c0b24b1253f85cfb71731a5f7da764fb6604140
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U1:cQRQyi36YOcPbLvw2gAf+PN36pPx7f
TLSH
T12E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e915b2bcd04dd114a7633bd0173fcb10b1f11367cdc601cb474ce67592f478d1
MD5 2e1d777ff79294857241c143530d7144
SHA1 2d46c41b48691f7b6e51e37af13ab7175659caf9
SHA512 f477e23fc7cbad0fafd2c88bcff2a35d7fc59ddbce29cb304b37e32e762b31ae3fd93ac01e1472f9b240266a4f1bb22293e2a9b511527b883e58e24a086377db
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U1:SQRQyi36YOcPbLvw2gAf+PN36pPx7f
TLSH
T115667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 019ef1591dd6c8a187f56a5b7dd93c5de95efbef4905cee2868ee22dc1ff3eba
MD5 96207d9e918dfbfa89a8218ef02c5927
SHA1 8da04c12174df3de2a4c25f784cbb8e663bc5ed6
SHA512 10b8f0ab0905e4ae1af311c731ff9ecbc4194d771d3b51a860766d06135af42ca49d3fe9887068c6fafaa599361d91f949580fa7fe54757dba45c4d6e660203c
SSDEEP 49152:o68Qg55nhceWu7PNU3/4pPDJTikFtNf+:ythLRc/4pPx7f
TLSH
T143B54933B2F600A9C44DE1769F4A872196D27C758FE0E3DB851173161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9fa8ff604b637b71b308b3632dda1034926b71ddf75ac6f581f9f84deb480234
MD5 b27e1e0584f5611cdc209a02fb167baa
SHA1 be59295fe016e91a99506f4ffcafaa3dfc1b201b
SHA512 693558d1a330a54171cc1a88aa654d0fe0f9a0c643ec2572003444221b8eaff6184850b98841f6bae3db3eb7ebe48a8adfe51a1ebebbe39c31be5304bb4e2c82
SSDEEP 49152:t3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99X:8y5112gYy5azzVvt69nLKnhZzpPx7f
TLSH
T130167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 725f44cb5b4dd72b395cc0aa1be76d0b160efbe4906b19e2637026bd457072b8
MD5 0331abab8b0f54a9f5dd405db2f85090
SHA1 6caec401ac5e94e00b6550b8a11109635cddda3c
SHA512 3b54cfc1cbd2c888663ade613ed09a5567723c984c2b47529c3545decc18d29415105a184830e879e1e9406bfba404fe5b3db2c20ce5dd35d814ab9bf8b5c974
SSDEEP 49152:EB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glHpPDJTikFtNf+:eu6Jmdxd2dHpPx7f
TLSH
T10AD59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 72fccb91f2a345582aefe1d87d0d1d83770a97c9ae70ae3a71950963634528e6
MD5 6fd9d79859e65f8fb91a38ea986b6da1
SHA1 50b8a6e410485b54ebff196f1263025d5128b2d8
SHA512 f09aaf0a49a433b4d277531ea9e7f57338686bba0ed01debfa7272e7f70397e7ec5ccb869a1326aaf21996e83a80917a9ebc73fba1b4f2f4abad68f4816205c6
SSDEEP 49152:J1hpsNoJpF1A63U44CwH7R4x+pPDJTikFtNf+:JmifPWRVpPx7f
TLSH
T102B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8f78b735b2f53ddebb8195a5fb302a8323fa324016b88920a6c944c18d00492e
MD5 0e1665a85230370b60e88eb2846decc2
SHA1 d93f6f61ba2942f86c0027bfbec0a8d4d02b33d8
SHA512 e826a531a0a39fbc40a5c5f28cdfa2c63914f91eef326b30cfe3d5d143b8978a8f1b66ea5603dc296ee773526da6dc5ba1e1bf9a3ffd0792a05cebcf776c3a4c
SSDEEP 49152:JSuZQIY0Be2KcRVtOnks6NMHqXpPDJTikFtNf+:H5dKii61XpPx7f
TLSH
T1A5C5BE03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 03eb7252cab535a4ee7a3c67492c3f6716cff025f4d0b81129c6ee5993600514
MD5 f4f7cc3080b5ea65d86bb8e192c75105
SHA1 01c56040dfead719add2bca6337f195807b5869c
SHA512 15e33f572ff290b34ae98094d507c5f08545a37e73b96cffc5b4426d5f5e82519a00b6a616ee1806c72c1dadc1730f4d888765b2967b5ce0df2eea2aa3956b8d
SSDEEP 49152:PhtSn8EApI0fig3giDn0AP5wCpPDJTikFtNf+:eX2imphxpPx7f
TLSH
T1E495BE13F2D900E8D05ED178C7568632E962BC160B38AAEF0A50B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 772b5fbf3d9bd3ac80d26230780012bf239f8eb40188942e908b56b1b78c5daa
MD5 8f1d9498aa87f39e85ad540b646fddd5
SHA1 82a9ae2466b1f4348571421d031ec7f29fd45cda
SHA512 c9406191678628918cf3db1911ee752a7085ebaf72b4394649ab678e61b6908534c88e14ab00f6aa34673c395e7cbf3b77f4a664141671b7234b5dcae7c38f00
SSDEEP 12288:RNCW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:RNlpPdHr9JTixKFy06IfWB
TLSH
T1A245239FBE87CDDBD38B3674C52BDB400455562BAD0C11722607E7133A78A182E7BE91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 baaa3c8663be6a6facba845aee968c37a6117c8b95549b42578a2663e70cd8cc
MD5 e445c9b0641964ae01cea4c48a183f9c
SHA1 23365c1af7fe5a0c3d9fbb807be63488707d65c9
SHA512 ae69c3148530b7833962f5c22f6ca6786f29870d63edaf877dbc07a8222778d4ac46062530825a23219a301c75b9fc25adc438264d4c4f9c63e95e1e0e03b5d6
SSDEEP 12288:X4CW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:X4lpPdHr9JTixKFy06IfWB
TLSH
T1FF45239FBE9BCDDBD34B3670C52BDB400455523BAD0811722607E7133A78A282E7BE91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 13be1909579f8a7d8359b2ba43d0aa95019c1bd06fe28dbe56245828d0fdb3d4
MD5 9eec0fc9feb918b9b82e8c999a2c6025
SHA1 a8190c62d872d0c2dc52b4900624b044a707cc39
SHA512 ce9e7f4166e2c00f49f11a71e412eee9a52749688ed971000e62d261ae6fbf5457207d8f1ecb2a2560f7b0daec9a1bdf79e5254296d5161881087597ce7d8beb
SSDEEP 12288:ziCW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:zilpPdHr9JTixKFy06IfWB
TLSH
T1B445239FBE9BCDDBD38B3674C52BDB400455522BAD0811722607E7133A7CA182E7BE91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 abc81daaf92782475afde4d931af6cfdb8c7d27bc99bc60dd61f5f3f69390a16
MD5 4cb7d1dfa2df13e0e7a6d7fd05a9f64b
SHA1 9ee6852524a9788cbe08d03df50cb64e41e6d096
SHA512 6e1fa89e7e66321bf172da74f70dcbde6a9847cad29db3eacc6da9eb23362d0f46e266f07f0e007490c1d0dd3cbe056403ce04a9db24ab7cf7b44a88957a3920
SSDEEP 12288:RVXCW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:TlpPdHr9JTixKFy06IfWB
TLSH
T1C745239F7B9A88D6D78B7234C93BC70040B2B97A9A1453BB17039B172E747186D3AF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c3685e0543a7b1ebf436af448393d38ca7dcd69a151647ee9a0cdd1a2e1ff534
MD5 d7262b3b9642c7639343298c4cb28c03
SHA1 54de1b9b5c075171982ed19b6004a5313d7446c0
SHA512 fb2bf39d2bb4fb2eaa1de54227b25aaa425bba2fa9dfd0723e9b3d6099c625e5d6bc0a40ba8cffff5608a70f9966fde485ac9980bfd6c5f80b1efaf1dc58194b
SSDEEP 12288:UvCW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:UvlpPdHr9JTixKFy06IfWB
TLSH
T10945239FBE9BCDDBD34B3674C52BDB400455522BAD0811722607E7133A7CA282E7BE91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 2cd5ec951d66c1acf7536163b30e79a18d7a8d26d575f7866f98d8a4f382201e
MD5 c03503d9225927c08a85de44b0c0d978
SHA1 42fd1d14995c2961b941a17a7ad33bcddf74e7e5
SHA512 39190844125e0cf2bd5e9806246bf9a736c89e339a97406f1b23ef5d5845d6e12e51807f94a71dc8446d6e07607b4da367caca404d81c4c968fe8c47fee31bdd
SSDEEP 12288:+kCW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:+klpPdHr9JTixKFy06IfWB
TLSH
T15B45239FBE9BCDDBD34B3674C52BDB400455563BAC0811722607E7133A78A282E7BE91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 e9dead3a5f3f46c070d43d96745fd602207e656b7df4a0b4ae3f0c92d9dd33b5
MD5 90bc3ef42aa00f0873830eca96555b1f
SHA1 6786eb1a6a2cebd6397d09a9f93f2811a3a45cca
SHA512 ff3cad88990708b3a8fa57630c857388f47edc23bd875e1c4afab6d9b02edcad9f2275d5980a3832bbc07d7150cba29e45d3c3890bc7c1bfd4606bdba0827b48
SSDEEP 12288:ZQCW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:ZQlpPdHr9JTixKFy06IfWB
TLSH
T12445239FBE87CDDBD34B3674C52BDB440455562BAC0C11722607E7133ABCA282E7AE91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 d32fcab7a5e2f44996b8b886119b359657032c327bf0ed0c186fc5f991c70da8
MD5 cd940456f7e6e9643a0d890f79d70b8e
SHA1 8326b91edbe2dd9df9fcaa68a075a76f04fd632b
SHA512 335b31d2a271edeb39bb90727ddb23836e4d818e08eb749c189afcc2c6e149ad8bd52fa49cb7b104a831821b2be671ec87cae14bb413353f16590d74de053836
SSDEEP 12288:fiZwbTzzFEoS2cPvyYCW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:6ZMHzFVSOYlpPdHr9JTixKFy06IfWB
TLSH
T1F665F199B3904CF9ED67423EC9268A05D6B27C2A0A60C61F13A537271F773601D3EF95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5eb35fb9dd5c367a7ef9dd3e94f6778dd5adfddcd7ef91e5db5b17b940d02865
MD5 a15b13c596d60a49e595fcc940b80e1e
SHA1 81e48154fc4e54d2e8e673bcff505e3c56ed9116
SHA512 047722842fcddbb0f712505e561de79d2361074d0e8c3f44d50e77493a476398ccee6595ffc55c3481fa061cb27dfbc6f1f6d737950076b3607c112729c8d1f9
SSDEEP 12288:0xCW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:0xlpPdHr9JTixKFy06IfWB
TLSH
T1794523DFBA97CDDBE38B3674C52BDB400455522BAC0811722607E7173A7CA182E7BE91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 7114cafeb864c8c6aaed34d3b0a691422b534942a803b38ac1b21081b74dd244
MD5 611a544c4adeeab2cb85e78ecbf86cd6
SHA1 34cb8c86ffd1feaa2095bdc847f8f98c9bbb3c43
SHA512 f526677fdb3d502ffbdcf8a003a90fe88a280b1c261c745ce80ae1656ea42470b1d66e84044dd36320fb5b383d274b49d040526690f1e200d4a95a4fbbbdd4d2
SSDEEP 12288:D1CW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:D1lpPdHr9JTixKFy06IfWB
TLSH
T18C45239FBA87CDDBE34B3674C52BDB440455562BAC0811732607E7133A7CA282E7BE91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 43a1dd997468164028914a7c5ea011f56b04cffa7c6329ea9063ca45c7455510
MD5 e59eb76960218bd7f89227de73260232
SHA1 aea45bde4bf429a3ca08abb330c566a9a542018f
SHA512 a8a2bf4de7f2877bb42abb3b18c4028c6d110d1af65fe2370bea40f89b220f7ff8fc8fe634cb60601fab8e0b6745a95cd06e43b35c549ba739d7724b81cc9acd
SSDEEP 12288:6JsfhCW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:jhlpPdHr9JTixKFy06IfWB
TLSH
T1BF55F15AE29842E9C16E6235C7568A40B3337C2587E1D3CB12C1F63E1F796946DFAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
MD5 29f1b2d1b6f9290138596cf180847e53
SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
TLSH
T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 168B
SHA256 21988ad6601caf68a64de28dc6d367c8f339e64a6317c89e298989d53e8f598b
MD5 ac9bacc82a15255f3cce331609a6642e
SHA1 cf8bd603c7da80b964ddc2023e85c9f4385cffef
SHA512 82680f0812106924e85eba06cd87c161eaf82aeca47a805fcee21ce95ac5bed24db066ed7ef41bdfec31a36e5d8f75d8041b7bfcc90ab00e7ccfbda62f410972
TLSH
T1A1C08C2A0B3EF08A27371082EB0E2FB71A883111C3438A6032103BCAF8284225F1B819
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp8C3D.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp8C3D.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

TmpA5D2.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpA5D2.tmp
Size 3KB
SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
MD5 ec946860cff4f4a6d325a8de7d6254d2
SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
TLSH
T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 5e77931934e838bca3ded49ae0728dbfcc9149240063119303490b43542d7770
MD5 f2b50fadaf43ba2ac7b2606fd68c7df9
SHA1 122b43e913c882be69e80979c804437896c57f84
SHA512 5f1b9dea388b64868b930f4016a9c7eba912b7c2665242aaa77bd99d19f8e3cae5077b060ef7ff1d45eb869809299f869d7107472826d13f2647c8decf46babd
SSDEEP 12288:xJCW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:xJlpPdHr9JTixKFy06IfWB
TLSH
T17345239FAB8ACDD6E7AF3770843FD710001AA2395F0845E36503A7173578A986D7AF42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 70786dab4415d55076735ce973cdac9b9913fa5117bea9ab7c985c660981c611
MD5 f8663d365527db56423d4484eef43e36
SHA1 8c7305a4d8295335fb1696db8e025f6cbcfeb241
SHA512 d58b96017c63f8d0d9cf9450f8f50f1052ac82d159ba5c7058efb33f9761924efd4dc52c342cc065d305a3e17a65ff17591a1702c6048ac85548f53294e94505
SSDEEP 24576:78RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCvlpPdHr9JTixKFy06IfWB:YRZwQCyiHiQEaaPnMGpPDJTikFtNf+
TLSH
T13B85AF1E63DC46A5E0BAD278CDA74407E6B27816473197CF0291C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 7edaa13317eea918dc7007af54bf445175d4e9b37890fda9564d821641e8b2ff
MD5 391f2efe9bab85a3fd7fec952827ed44
SHA1 57c46a1b2cca79bd3efd82e1dcebe1e94cd8b532
SHA512 49a7ba9be79b71b932921be04960832bb966463c5dbe8c950f3b622125ada7dad1772eec5d34b526fddaed78791cc19aebd75b9b86f57323a7fa6eb949f876da
SSDEEP 12288:/bxA1U7K9CW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:/bxA1UG9lpPdHr9JTixKFy06IfWB
TLSH
T1F055026F669D08E5E276A53DC996C205C332782A171593EF1182C33A1F3AFE85D3AF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 810e57696594b5c66c6f97b5f49c4ea6c88d4bda28a8742bae7f6f575593b582
MD5 e3030f3eedbbd94e4540ac4584ca7102
SHA1 13d4ab0065895e7a539ed83acb37ae6008a338a4
SHA512 1a883e81f105b4036d4873388cd1f3c935197e78664e169c4272a70c95369bb04d3b3ecf21525e29329e8120db7392c61c39c0f8826eb42044ecdb0b088ede7c
SSDEEP 24576:TjsmP0yHaqrVqHra44KDzMsrnUlpPdHr9JTixKFy06IfWB:TjRP0yHfVqzlAsrnwpPDJTikFtNf+
TLSH
T14645BF2EF2B910F9D4AAD136450507B5BB71B42D1F209AC70170C635AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 6479bf3d1491258af9da21a8cd4200f365daf10232a53b79778015c0c1627ffe
MD5 5a951fdc5c9feb92b15a77044aba8f39
SHA1 865c34739b8eb58e272907ac126c8f2271631fb4
SHA512 c112e2800fc9db48cee1040cae60807058e3724390c141d6c7d46d884a02c88f9aeca6f043645d73b6a87dd12fe4a02c162befc87f25b234a9c4b066c0da0485
SSDEEP 12288:cHCW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:cHlpPdHr9JTixKFy06IfWB
TLSH
T18B45239FAB86CDDAD78B3674C52BDB000415523A5B0912F32503E7232A7CA6C6E7BE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 036198072248cf00f023f76c36c9cf78a6f0cafee3c59a02712489fb4b3ef1d7
MD5 c721c1f8aa8b2f7ee8255459f5c048d7
SHA1 96b9432b09210f5196fffcdb50b35905475779a6
SHA512 fa4a6d387d7d8387aca4d55960f483ab40fd3ffadff83f50208c755c5d169aa96ff882362ed77b015512264ae1a99790f9508ec2d1809e57e22ca879a9219da9
SSDEEP 12288:1ObVA4LWO+vAYFTVCW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:yBLBUTVlpPdHr9JTixKFy06IfWB
TLSH
T19E750159F79404F9E96B913CC8678A12D272B45D0724E7EF03A98B661F237E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 cd6a4ed494f8c755d2f711513840ac42107d099b62277a91dab4dd5a41d5ef4a
MD5 eafeb62823fa9b080494e6745edea2e2
SHA1 c2567007f093e490f440b3bb00e484f612c5de28
SHA512 af5623847b7ef87464ba419dd1a150f78294b56eb81db635b978c8283fbcbe76a08b93e201110ef32fb2dfa4789ef5006ab36ab34d466c844dd42461cb944015
SSDEEP 12288:u70VmLIYNvUyBpuCW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:/DYNHwlpPdHr9JTixKFy06IfWB
TLSH
T13465F12F62AD0CE5D67BA179CA838609F2727466171192DF01A0C37A1F17EE87D3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 87bb17d7bb4a5e9bbfb6f9901c11ce5623236e7dff47788fffb9b235f4257136
MD5 22eaedb16edb5a4d674ac7bb1ac2b07d
SHA1 b42f0cfec3488e6a1957c51cf4716d56e5da75b7
SHA512 e129f45277d2c40a01204391f33087205e784d4b2389dd063482bfe54293b64d6fcd23efa6210c9ce11d8fb94dca6cd37a09b3a7749d7160e8fad8c958f1542b
SSDEEP 24576:inXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKE:inXoJJYH84VVS6AmEOJas+cHBjSSKHP0
TLSH
T10865BFAEA2BC04E8D5BBD17DC5834506F5B178661331C6CF022182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 06dcd5ae1e468d7fc82d9414946861e450eac8676d97d9210eb0cf664dfc4721
MD5 05332a95ceaee074587f3b23e28699d8
SHA1 31bf219340789cafcedbc57ad8998f173a61ad0b
SHA512 6796f0557548b42ebc55f51bc816567cd9c4561a5ab3d06175982c7b9e1ecb2a7a7477a626d7215be6b221b8c7692979d6c321dd2d4ca25b87d38d2c8e5f88d5
SSDEEP 24576:3v7Xbxd9Tuycf8M/TYlSuxwr2PCmlpPdHr9JTixKFy06IfWB:3DLL9TuJ0M/TYW2PlpPDJTikFtNf+
TLSH
T1C3858C5EA2EC42D8E0BBD6BD85B79146FAB2B855173081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 366fd61046de7dca55af014f80d03e130d2e647afd46a29ac072af795f01d8d3
MD5 ece27a033018f29eb3a7e0f7cad92f1b
SHA1 bf2630cec44e584223ce6d5a0b30b39bd5039929
SHA512 cb227619a3e0b1b51a7e09834d98b0e01999cacb3d337558e1a9d75768684dd504f07e66d3d2a4670039cca32e50e5ff591501082a082955506e72f36b1d9c51
SSDEEP 24576:degJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wVlpPdHr9JTixKFy06IfWB:dngOJOmPOHzjpPDJTikFtNf+
TLSH
T10555BF3FA7BC05D5E07ED17D8A978916F6B1782603255ACF0160827E5F1BEE42E3AB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 3c732e9264cdfe4837d5932a832152ce5d48ceeaca27ea2e32a343805c78e5c7
MD5 2f5ddd50bcebe8813b04519b21aaea70
SHA1 3f871de872f7ecb240d771a40a82d296c8351a7b
SHA512 a30901d3f303a17d9266a43a77df0515625e85d703f5ac693c943246abaaf595bb0fbda74f8ce655e8f15eed1ada369e2a2ba4fdbc68cd6a0abcbdcdfee7f931
SSDEEP 24576:PLJnJiTk3R3waE4JrOnlpPdHr9JTixKFy06IfWB:PLJnJK8R304lQpPDJTikFtNf+
TLSH
T1D575D02DD2A800E8D4B7D2B4815A5B56FF32347D2B2569CB19B4D5313F12FE0AA79F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 607541673218591e4d70ead72290ecfed6f1af2a173acd72b4dcffa56ef99ac2
MD5 90bd7dd4a6004cbb95f31b82bb57fff8
SHA1 1c18b6c05e1359477f0475496b98e68e5c3ffa70
SHA512 a97773bfb1861496754dd52a2cf81e9ff694f768fb6c455c034231ffaf4ddb26606eb4243acb40e6ead5b6aa965e8812a4c9bfa7be31f1dac7e4eccc404b73e7
SSDEEP 49152:w9GqCzDScAZmlvTcFg8Ph6BpPDJTikFtNf+:yUpPx7f
TLSH
T1E9955D05F7EB5298E8B3CAF1C96694159B327C409B34F7EF0A80CA6A1E32BD1D535B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 443be7d04401c8902a230787283094a6e6b4dab4be9c31f9208a3c293451fd52
MD5 fa16afdaf72895a19bc5e21c226b55a9
SHA1 55d22bacd42495811c65e17f2671492e4c67de3b
SHA512 a8f04007ce40158b686f38fbf3a9a6bab94bab676f5fe396387bdb3f94d177932747119d47194a01e22211eac171616784c272b16eea00b4435369c9a28c3255
SSDEEP 24576:xlYJeXm5jUuExlpPdHr9JTixKFy06IfWB:xlYJeXmRUuEnpPDJTikFtNf+
TLSH
T16355129E7A9D64E5E26F6139C5668A00D372F076170113FF11E1C33A5F6AAE82E39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 3c81bf7685ffe793a880184d1d7e02476dc35a1d5d2cb39a2e6743f9284ce23e
MD5 07186cfe03558480fc0e6d60d945da19
SHA1 48988fa805d6a9abf6780500d1ea6273db4b17f0
SHA512 5159b66fea006105764a1ac5fefefa11ea2b4a11d3be7250577fc2c1524426970e42ff2da277acad0f2a774ddafaca0fa2ce49b89491faec174285001ba5c326
SSDEEP 12288:duu6kyECW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:djtyElpPdHr9JTixKFy06IfWB
TLSH
T1A855124A67D588E9E6AA1638CA7782408A35BC315F0443EF1192F73F2E35BD4AD35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 16798e4d8a077d56d9e949e25439055534cfb2b7000c7cc62bfd468aa4185b0f
MD5 39e03b8b81da38abd541172c3d988c0e
SHA1 7e22c1ef7e90c49b879b03ef22d0f32a5e33015c
SHA512 82e26a22d1c91e3d12fa1410fe3dbe859940404d3ca5a0172e5f551e5a3f17b1fea5f6acbc473f67367613a9a981bfa8ad0355a8c09bb35be3d0a9e7dc40ac11
SSDEEP 12288:1PVCW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:JVlpPdHr9JTixKFy06IfWB
TLSH
T1E845239F6B96CDDAD74B3674C43B9B40006672395B0825F72183E7336BBCA586D3AE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 6d061780e26076b4b63acfec31e1296eb60e08eeed7bd67a676ae9c3f3206527
MD5 9a9d0d5baaaf32cc1aae0058b7f98831
SHA1 4937205b9d4baa6c85deee5cbead145b8fe7be19
SHA512 82b5bf11fef46391e6894ac7f3ee304c72b5019e3e248aff716ac3d41ed20de4220df6a368281ae1e05b4c0d81f21b1927f2773552dd7cebf4ed40c7dababc4f
SSDEEP 24576:uC+TyQIu93VAumZr7jmqlpPdHr9JTixKFy06IfWB:u/TfIq+YupPDJTikFtNf+
TLSH
T136558D1DA7E91DCAE276C675C8A34493E633B472137186CF2044C17D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 0c90ccf133fac76c1ff32aa1a06532255dba4a564d304c2b815fc1df5939507e
MD5 049e358a8a01fb89d0653d071ddd2424
SHA1 d85304fe1f045087330834e783fc005297b0fe7d
SHA512 6db4bb005bb6745aa66bdfd988872deaf0da7827031a9f5a4c4774eb79aecda1d171f0cd7ce8dc5e4819cffb263d6eeac0cc869f8e7ab4541cff6fc323697d1d
SSDEEP 12288:NcyrWOstaa3kcshCW1MqPdHr96NpYTixKFbyVONup5xIf6nv1L:oLQikZhlpPdHr9JTixKFy06IfWB
TLSH
T16E65F10FB7AA00E5E1AB923CC8568201F6B37435571267DF0291C77A1FAB6E97D38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 0831be161ab3f0e356a4053004eb7952c053c5b119b9046f0cc0a2c4dd588a3f
MD5 dd91a7c5dbd822cdf958868de9274527
SHA1 d77a716376716bccdaea9a2e677ff81c5eae9291
SHA512 f372a4baa46d5a32ddbdf3c057102b52b927ec35dcc8d8b782ec8ce7039eaa9e7cce7fd72ce0da0bcbb038be4278534c97753a45e4ecdd06f1fcf45cd9e74844
SSDEEP 49152:7pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPgpPDJTikFy:QpC7b4+80GTkZpPx7f
TLSH
T119A57C3DE2B800ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0f676835d6ad65766015bcd4e758f2f6bc4d3a1a176bd0b9fae42be4cc03c296
MD5 7fdcf52dbb92ed1d55ac22263af1dd97
SHA1 2de56dcb6a27732cea59d51e686fee346f8abe9f
SHA512 2cff570cbe26b8a65227612c3501aa967e9efcaeb3ab37c56d0157378d45cbb8dfb4b3db62e4f0992c3270250dd704221509acd2fd28d6b29b79a09afd9f941e
SSDEEP 24576:ySAwJPE1IDAo+4Kt+l4413JUQ8lpPdHr9JTixKFy06IfWB:yqPCIo4Kol4vQopPDJTikFtNf+
TLSH
T12A55B02AA7F946E5E17AC774D663C601FB727823133163CF5290823E0E16AE85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/232-512-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/232-505-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/232-575-0x0000000140000000-0x000000014016A000-memory.dmp

Download

memory/232-511-0x0000000140000000-0x000000014016A000-memory.dmp

Download

memory/928-694-0x000001A04E580000-0x000001A04E59B000-memory.dmp

Download

memory/1100-309-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/1100-12-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/1444-311-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1444-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1444-38-0x00000000004A0000-0x0000000000500000-memory.dmp

Download

memory/1444-32-0x00000000004A0000-0x0000000000500000-memory.dmp

Download

memory/1668-597-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1668-589-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1668-596-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1668-661-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/1668-628-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/1668-691-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1668-644-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/2264-557-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/2264-551-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/2264-559-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/2264-668-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/2460-29-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2460-41-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2556-669-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/2556-562-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/2732-529-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2732-585-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2820-123-0x0000000140000000-0x000000014016F000-memory.dmp

Download

memory/2820-120-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2820-114-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2820-312-0x0000000140000000-0x000000014016F000-memory.dmp

Download

memory/2848-696-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-678-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-698-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-699-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-700-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-701-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-702-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-703-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-704-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-705-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-706-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-707-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-708-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-709-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-710-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-711-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-712-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-713-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-677-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-714-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-715-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-716-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-697-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-717-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-718-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-719-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-676-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-695-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-679-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-681-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-682-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-684-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-686-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-687-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-685-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-683-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-672-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-673-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-674-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-675-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/2848-680-0x00000293AD250000-0x00000293AD260000-memory.dmp

Download

memory/3020-545-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3020-547-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3020-539-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3020-667-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3156-521-0x00000000008F0000-0x0000000000957000-memory.dmp

Download

memory/3156-580-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3156-523-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3156-516-0x00000000008F0000-0x0000000000957000-memory.dmp

Download

memory/3200-501-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/3200-570-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/3288-49-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/3288-8-0x0000000002510000-0x0000000002577000-memory.dmp

Download

memory/3288-0-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/3288-1-0x0000000002510000-0x0000000002577000-memory.dmp

Download

memory/3332-25-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3332-16-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3332-24-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/3332-310-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/3836-536-0x0000000140000000-0x0000000140138000-memory.dmp

Download

memory/3836-663-0x0000000140000000-0x0000000140138000-memory.dmp

Download

memory/4160-576-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4160-688-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4192-690-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/4192-586-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/4588-689-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4588-581-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4600-567-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4600-565-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4612-571-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4612-671-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4656-595-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4656-532-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4656-670-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4664-493-0x0000000000400000-0x000000000053C000-memory.dmp

Download

memory/4664-497-0x0000000000400000-0x000000000053C000-memory.dmp

Download

memory/4664-446-0x0000000000400000-0x000000000053C000-memory.dmp

Download

memory/4812-112-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/4812-80-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4812-88-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4812-110-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4812-103-0x0000000140000000-0x0000000140175000-memory.dmp

Download