8eeb7a1f1d1612bbe704f9a2e502c99eeb02b9ee58c610a3f36e17df81bd60ac

Analysis

max time kernel
114s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 23:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_448e0af2fa2c53b749c78893d44a82d6_amadey_elex_rhadamanthys_stealc_stop.exe
Size 1.5MB
Sample260628-2y24rafz5x
SHA256 8eeb7a1f1d1612bbe704f9a2e502c99eeb02b9ee58c610a3f36e17df81bd60ac
MD5 448e0af2fa2c53b749c78893d44a82d6
SHA1 e9997a6791d7c84a52b9f58de70cab79710f7e34
SHA512 cef8cdee25e60137095fd42be6f5ddd02a0f3ee22f79196a185fa458c298aeefe6757b4a0a193701acb6a10f2288daeae7f09e79ec618678788b0c22efa5168a
SSDEEP 24576:lLm5qMr1nDO+L6VMRCPU6CENltmVVdpx7fLrQWd:w5qMJ6ZU6CENlc7dpJLrQWd
TLSH
T12E75E0107BD08036E1B324754A7EC665996DBD712F2192CFB3C12A2E5F70AD1E931B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 12 IoCs

pid	Process
1384	elevation_service.exe
3592	elevation_service.exe
5912	maintenanceservice.exe
1476	OSE.EXE
4168	PerceptionSimulationService.exe
296	perfhost.exe
5840	ReFsDedupSvc.exe
5600	SensorDataService.exe
2488	ssh-agent.exe
1696	AgentService.exe
2392	SearchIndexer.exe
5204	Reader_sl.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-28_448e0af2fa2c53b749c78893d44a82d6_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-28_448e0af2fa2c53b749c78893d44a82d6_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-28_448e0af2fa2c53b749c78893d44a82d6_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-28_448e0af2fa2c53b749c78893d44a82d6_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\abc4c73b585f03fd.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-28_448e0af2fa2c53b749c78893d44a82d6_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-28_448e0af2fa2c53b749c78893d44a82d6_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-06-28_448e0af2fa2c53b749c78893d44a82d6_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Temp	AdobeARM.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103843\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103843\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-28_448e0af2fa2c53b749c78893d44a82d6_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_448e0af2fa2c53b749c78893d44a82d6_amadey_elex_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008802b8f05107dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b7075f05107dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000076e031f15107dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d0b1c6f45107dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba0f6eef5107dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000015659f25107dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe

Modifies registry class 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-28459746-3881314244-166055492-1000\{B2E0E673-870C-481E-B7E3-D8BA57D72C42}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\NotificationData	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Reader_sl.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-28459746-3881314244-166055492-1000\{B2190CB4-9CD9-46CC-A486-9F29F2E10DA3}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
5216	2026-06-28_448e0af2fa2c53b749c78893d44a82d6_amadey_elex_rhadamanthys_stealc_stop.exe
5216	2026-06-28_448e0af2fa2c53b749c78893d44a82d6_amadey_elex_rhadamanthys_stealc_stop.exe
5216	2026-06-28_448e0af2fa2c53b749c78893d44a82d6_amadey_elex_rhadamanthys_stealc_stop.exe
5216	2026-06-28_448e0af2fa2c53b749c78893d44a82d6_amadey_elex_rhadamanthys_stealc_stop.exe
5216	2026-06-28_448e0af2fa2c53b749c78893d44a82d6_amadey_elex_rhadamanthys_stealc_stop.exe
5216	2026-06-28_448e0af2fa2c53b749c78893d44a82d6_amadey_elex_rhadamanthys_stealc_stop.exe
5216	2026-06-28_448e0af2fa2c53b749c78893d44a82d6_amadey_elex_rhadamanthys_stealc_stop.exe
5216	2026-06-28_448e0af2fa2c53b749c78893d44a82d6_amadey_elex_rhadamanthys_stealc_stop.exe
5216	2026-06-28_448e0af2fa2c53b749c78893d44a82d6_amadey_elex_rhadamanthys_stealc_stop.exe
5216	2026-06-28_448e0af2fa2c53b749c78893d44a82d6_amadey_elex_rhadamanthys_stealc_stop.exe
1384	elevation_service.exe
1384	elevation_service.exe
1384	elevation_service.exe
1384	elevation_service.exe
1384	elevation_service.exe
1384	elevation_service.exe
1384	elevation_service.exe
5416	explorer.exe
5416	explorer.exe
3592	elevation_service.exe
3592	elevation_service.exe
3592	elevation_service.exe
3592	elevation_service.exe
3592	elevation_service.exe
3592	elevation_service.exe
3592	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 58 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5216	2026-06-28_448e0af2fa2c53b749c78893d44a82d6_amadey_elex_rhadamanthys_stealc_stop.exe
Token: SeTakeOwnershipPrivilege	1384	elevation_service.exe
Token: SeBackupPrivilege	5840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5840	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1696	AgentService.exe
Token: 33	2392	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2392	SearchIndexer.exe
Token: SeDebugPrivilege	1384	elevation_service.exe
Token: SeShutdownPrivilege	5416	explorer.exe
Token: SeCreatePagefilePrivilege	5416	explorer.exe
Token: SeShutdownPrivilege	5416	explorer.exe
Token: SeCreatePagefilePrivilege	5416	explorer.exe
Token: SeShutdownPrivilege	5416	explorer.exe
Token: SeCreatePagefilePrivilege	5416	explorer.exe
Token: SeShutdownPrivilege	5416	explorer.exe
Token: SeCreatePagefilePrivilege	5416	explorer.exe
Token: SeShutdownPrivilege	5416	explorer.exe
Token: SeCreatePagefilePrivilege	5416	explorer.exe
Token: SeShutdownPrivilege	5416	explorer.exe
Token: SeCreatePagefilePrivilege	5416	explorer.exe
Token: SeShutdownPrivilege	5416	explorer.exe
Token: SeCreatePagefilePrivilege	5416	explorer.exe
Token: SeShutdownPrivilege	5416	explorer.exe
Token: SeCreatePagefilePrivilege	5416	explorer.exe
Token: SeShutdownPrivilege	5416	explorer.exe
Token: SeCreatePagefilePrivilege	5416	explorer.exe
Token: SeShutdownPrivilege	5416	explorer.exe
Token: SeCreatePagefilePrivilege	5416	explorer.exe
Token: SeShutdownPrivilege	5416	explorer.exe
Token: SeCreatePagefilePrivilege	5416	explorer.exe
Token: SeShutdownPrivilege	5416	explorer.exe
Token: SeCreatePagefilePrivilege	5416	explorer.exe
Token: SeShutdownPrivilege	5416	explorer.exe
Token: SeCreatePagefilePrivilege	5416	explorer.exe
Token: SeShutdownPrivilege	5416	explorer.exe
Token: SeCreatePagefilePrivilege	5416	explorer.exe
Token: SeShutdownPrivilege	5416	explorer.exe
Token: SeCreatePagefilePrivilege	5416	explorer.exe
Token: SeShutdownPrivilege	5416	explorer.exe
Token: SeCreatePagefilePrivilege	5416	explorer.exe
Token: SeShutdownPrivilege	5416	explorer.exe
Token: SeCreatePagefilePrivilege	5416	explorer.exe
Token: SeShutdownPrivilege	5416	explorer.exe
Token: SeCreatePagefilePrivilege	5416	explorer.exe
Token: SeShutdownPrivilege	5416	explorer.exe
Token: SeCreatePagefilePrivilege	5416	explorer.exe
Token: SeShutdownPrivilege	5416	explorer.exe
Token: SeCreatePagefilePrivilege	5416	explorer.exe
Token: SeDebugPrivilege	3592	elevation_service.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
3308	sihost.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe
5416	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5588	AdobeARM.exe
5800	StartMenuExperienceHost.exe
4728	SearchHost.exe
5416	explorer.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5216 wrote to memory of 5588	5216	2026-06-28_448e0af2fa2c53b749c78893d44a82d6_amadey_elex_rhadamanthys_stealc_stop.exe	92
PID 2392 wrote to memory of 3740	2392	SearchIndexer.exe	103
PID 2392 wrote to memory of 6056	2392	SearchIndexer.exe	104
PID 2392 wrote to memory of 3504	2392	SearchIndexer.exe	105
PID 2392 wrote to memory of 6036	2392	SearchIndexer.exe	106
PID 5588 wrote to memory of 5204	5588	AdobeARM.exe	107
PID 3308 wrote to memory of 5416	3308	sihost.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-28_448e0af2fa2c53b749c78893d44a82d6_amadey_elex_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_448e0af2fa2c53b749c78893d44a82d6_amadey_elex_rhadamanthys_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5216
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5588
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5204

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1384

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3592

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5912

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1476

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4168

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:296

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5840

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5600

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2488

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1696

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3740
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-28459746-3881314244-166055492-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-28459746-3881314244-166055492-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6056
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3504
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6036
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:200
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5748
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2848

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5416

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4728

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RdrCEF.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Size 9.9MB
SHA256 917039ffec692ae87b7c6153a809c1717f78d15f426c219a4a9ad1b9da6536cf
MD5 e87641ba0689a7e930372927ddc1905f
SHA1 db36af16dc8ad37633c5d5f3dfdd8c8a11bc20f4
SHA512 071d107bc39e4efbc032d38644fbfff2321401201840ef768ee605f3a135e1a8571d22aed756b94b15ca0c3a1e1af809ecc0c6cbc5382659cdf812b9383d6351
SSDEEP 98304:CrbT54hEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTg69CEN6rV:AonfW/JLGMcblLheTgIm
TLSH
T153A6BF1D7BE21036CD732176AF4FA104E739D007A215C6977ADC83981FB1AA152B6FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 3.0MB
SHA256 957fcb54c87408ad942ccfaae394893b10d2ad69ee760bcb0f129d3c3468213e
MD5 969488a7cb0db4d0d5aff390f71da5a0
SHA1 eb3063b7f3f6192d48d10fb7620c50b6e8b300ab
SHA512 f123044670fde557fbec24b588fe59af54ba81274073b9251d1c8b74fe64837b884eb146ef52861848f821ee21536c9023975608f9a8e16134fce14e27936d56
SSDEEP 49152:rTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJF6ZU6CENlc7dpJLrQWd:rTfiG/nzU90p69CEN6rV
TLSH
T12FE5E526A2C8C1EBE5642170CC59BBF900546D78DBA2CDD7BD447E06BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
Size 1.2MB
SHA256 5aa9d6916d7e6a7f9d12a6b1e85a624dbe0ee48f02e2ecdf05575dd41d756575
MD5 438f90f329fd3918d214feca69a3be78
SHA1 d459e472bd996f4ce212611a71aed12957726561
SHA512 f68679bface0309192ea52b9d023c6fc5d4229eb43d88eb170dd5b338b2761e5d45cb74e3ed49e59aea818d0ef3abbee51eef7a515608d8bda4086945c4e96a0
SSDEEP 12288:eFY78+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:UYo+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1F95523275B561F63DAA0017454A697F5E4BEECA4AF002FA7A326751F0DBC4E01C3722E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
Size 1.3MB
SHA256 f2d4ced9be516fd0e592adf19c95923502e7d7aff55b2b0bbfe278a98faae6b6
MD5 37336889404e28c25398302726e31186
SHA1 b112145ae4358dc4b9ac143cf21fd3a00ee090ec
SHA512 497f9a11d46608a23ea173b0e45a3ebb1ef48e114ed6d3e41576f6ea6edc7302f33d1e2428089aafbfe8ca7de9cb87d8275efced90363a5521bef8fb349b0aa9
SSDEEP 12288:S5CL8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:SB+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1C3551230F2C219B2D7B10171896BA7AA941CFD740F2158D7F3E85E2E4D384E29E77625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.6MB
SHA256 3a9bdc8b38e12bc4a66655325ac5cee51887ee6380d2b3f617322923bc4429e7
MD5 238c8196888874e02e1409e8316f5fbc
SHA1 81725a96b2f196fda094482f2f9d59f14eb65f58
SHA512 de6bbc98210301a1525f38af168fe9aa8332ecaa8bb5ae403072e4db073df200b05a3749e6c0a89aaf76aa2b10a872c617842dfa14e404490675de2d0b4ace2e
SSDEEP 24576:XATAbD+Omec+L6VMRCPU6CENltmVVdpx7fLrQWd:wTAGOmej6ZU6CENlc7dpJLrQWd
TLSH
T18475E01037D08136F1B329768ABFD724556DBCB15F6885CFE3881A2E4E70AE0A93571B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f3ee2f73b1962650e993bf8b54c956c19d9fdd52a17bdc1b7356ae2edbe690f4
MD5 5cf3d453bd22a02a1ca06b06c8f78a02
SHA1 03610897f4e7bcf516c4c3146986a66435a0cf80
SHA512 1d3effd169ea4a075cc71386698ad630320e0de7eab931d88ddbeac712ebfa7b8cfe5fe1f981a76134fb07675be7d374ca0c9dec26d75ac7890b05d799140e09
SSDEEP 49152:sb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn36ZU6CENlc7dpJLrQWd:W3q6sjBI69CEN6rV
TLSH
T1DBD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 05bde6731ce39b65cfcd17f136f59fb53e4e5b408aba70a3749dcca128006895
MD5 ee0a5123fe81b847dc9334546a1db7e8
SHA1 aa3385a8283ee3686864aa47e0e27683caa26b97
SHA512 a2a56d1917d1e15e7aa94656ca8a4703218549ca9db8b65812e67a95c86695382299edec619bd03bae0e2ea8281dce6504fd14d6bf78e4b7b90357757795ce4c
SSDEEP 24576:WXYfDtczAn+L6VMRCPU6CENltmVVdpx7fLrQWd:Vtcl6ZU6CENlc7dpJLrQWd
TLSH
T17865F12867E409F5EDA7427CC8A2C511EA33BC954760EB9F03B4992A0F336D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 e292186d55ed27cbb3f4fb88557b233f1db83e3dd5c6351e01fef86edfa7fdbf
MD5 94bc7ad430ef50202c91651347b291cd
SHA1 5edc6001ffc685dc445e6f6cc0a10e1c096b79c2
SHA512 02b942576f10cce670127f2b5ea7b534fc54273f10d32e059164f03d3a84caebd2a5358e51674c9d3b50e0092db27d74b203ab17943b61c6c0181f00a229de15
SSDEEP 24576:V0Le5ji0hmxxrMA+L6VMRCPU6CENltmVVdpx7fLrQWdr:VPji0Ajm6ZU6CENlc7dpJLrQWdr
TLSH
T1BF85AE26F6744731D073C0B9C5D2A69EED7230865B308ACB4286D77C2F67AE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1dd130db2d82caca3baaf91ef12846836226c64769aaa81fcccc562fb605f182
MD5 a607fd4172d15a3e687baaf73a73b9af
SHA1 044f578ae813d0301f1cc074042d2845c6a3fc0b
SHA512 2cf8ada43dd59334fc22da52ec14b3ab1e1a6f00956928e8db9cefb66da3aad4ff394260a84b3ad45c351974caa772cd28c451366e759536054454954fac990c
SSDEEP 24576:Ma7/ezSC6vUyD/aqgrvWn6q8wyuu+L6VMRCPU6CENltmVVdpx7fLrQWd:r/ezSC6vUzPveHjyK6ZU6CENlc7dpJLL
TLSH
T137755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8f7905c722f3c1f7c00ccc99e5c58ba4fe75e3e3f088221f3d202cc9b41716fa
MD5 fc684b44d758b65839cb95dc5c723160
SHA1 887023f3b1a04ef68ab0a3511a67973e0ad01b4d
SHA512 f99cbf7cfd4294ea7bf9fe89a3ecc742643eda8285f2e617aa4dfe4386288945ebf0f6d6f5c6a0fc292c8aa8d1c42830cd6ee84ea99faffea2375da5d0c830da
SSDEEP 24576:8VbqPb88hv/l+Yb+L6VMRCPU6CENltmVVdpx7fLrQWd:8VO88hXl+V6ZU6CENlc7dpJLrQWd
TLSH
T19D55AF65F6748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ed4422a1435cd84325fb1879ab1315af514700725d1732ec40b9f4df883f529d
MD5 49802f8ba5d2d48e19048e9e282c25d2
SHA1 0724bff04c2f473f083453e9b0267cd617193660
SHA512 e1c7ac67e5f9ed9cd54c3cf27dc81b80ce92733db03e5e17f9441e82f16b81fd74b1b8cfaeed104ebd904fcbe3c343de76e6934868f4a2e99d4401451532dd27
SSDEEP 12288:9L/8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:9LU+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1D345233487682D62D7F40238E1E7A5B1AD2ABCD55B006E1EA277790F0D398B4DC5F22D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 693ba65388dc47db139af6a9ad5897f66561762ba2b1143843ed8b972fcca2d9
MD5 eeb2b49e234e6baf2f9eda10ad772607
SHA1 545e40694541b3207ddcabc7efccd25c97269909
SHA512 1f8d1ac38db2ea2d8dce9e4d32b4f53410def18d9d904de0209539b239b19e582e1a8d7bc5c77cd08e68cd7f6c0a6463cdb24c2986728d1c6dda51baa1a6f2ff
SSDEEP 24576:BJIUj+L6VMRCPU6CENltmVVdpx7fLrQWd:BJIUA6ZU6CENlc7dpJLrQWd
TLSH
T1D165CF3BEE28FCE2C27A4DB85A91C640E77278704F51A3CBD175820E8E235E45D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ad9c2d2d7c510bc33c2231a0911f96f3e10291faa089bca3ef48b7683bf8af1c
MD5 d989bfc554369d186140830ab39a4f2a
SHA1 c73cae19edcb46fc0b9b6154eea204d2bfe2d2fe
SHA512 b3cacfad4495288ddf2ade1b430cd2ab5a8d2713649b9db5a2b714d9bc03fb4eae42262a91b8f6a7e63b74e154afc092086f6fed9c0829d9e456cd7dd48caa60
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THS:IQvGAdlCEL8c/DRNw5C969CEN6rV
TLSH
T1D6266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 50ec1d0486783abafe43cd448e8a48e8489eb0afbde0548b9efcccbb2a9c64a0
MD5 0cf1354c7c8940c9c69e6203f9f7ff13
SHA1 cf45c00b465c932f6f44cff49cd0f3a5e1e40f90
SHA512 0bcdde443e730a02d2b23c69381461d627098ac465e0e97d06df0bf98c9b5177178c2bc146830ab8c195640790f32d0b7d5c9f0080e3d84a1a8636510e60b0f4
SSDEEP 24576:M0ewsAjh+L6VMRCPU6CENltmVVdpx7fLrQWd:Rlj26ZU6CENlc7dpJLrQWd
TLSH
T1B375E031EF74E432C3BB0DB61B36C716583DB9604B511AC3E3A89D9E49342D1277AA1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c3e41a66bdf72b0bd5c8a9103b822e13be30a264af8812ebdcfe30e2fbd91353
MD5 51be306c41248173f33dd9b42c351f9f
SHA1 52dec8163cdb470744edfc94e631344dd38d5836
SHA512 fdfc5b149663aec0470e721111c312f96a1ea71c6554cc8e84a86fd80a3c1781b4a45748d7da5fa9086bf54fb83b0c8f8a90859f86d1339c4808549341eb5272
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH+Im:uUEtQevvqc2W1cpV2tI32t
TLSH
T146474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2149db5a4742c2a397fb0224682902ef33a288008c91fa03b025d831ba38feae
MD5 f095e020c38b5afa64163de036dc5064
SHA1 1f145468aaa810cd008f4d43dfa9e1d5c38eba74
SHA512 bd1023bb27c8ffa69299bf788af6f0b1ff2c3389fa3a299e415c653df5bf1bb36f85ba566adaf02587cfb70b899375b9507382732131c9ef983781f698e50b3c
SSDEEP 49152:bCbRquA/m2yL5zTfFiV+XenmE3/zW6ZU6CENlc7dpJLrQWd:EoquVjnmx69CEN6rV
TLSH
T1A7D58D1976B8C1E4D1F6C77886A2C647F37178154B30ABEF4266461E1E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 337407aaa0f6d64b3ede342d770b8e7ad3aa0f4661cf8b865c30545b88101c1e
MD5 31875d22cab021f1902b289a161ebcc2
SHA1 56048f969d6ad74ad9f6fbe8b69264a86cffa9e1
SHA512 f7df6e0a2eb8e500d5815192859ac7cfe3d64d9af5f27fed8ea5effad42738bb8d54c229ec8b1a70e12148b2e7bf473be5831c1e22a0f323e7315a43061f5636
SSDEEP 24576:+AhGL3IFoiwtA5l7S53K+L6VMRCPU6CENltmVVdpx7fLrQWd:+AMUFoiq5B6ZU6CENlc7dpJLrQWd
TLSH
T11C359D81E7F915D4F5B3AAB899B69171EA76BCA65E30C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 ea906ecf4baf2f1a355117e0d77ea7002a3d9fdafa56ad3ccdd001b7de0cbaae
MD5 4dd4724d85bb49e43e5739b75371c4e1
SHA1 d497bc09d5bc39c0fa544d49a4f38196b3590815
SHA512 a4f9d7e91683ae04485db46e18352ca6d8b033ec42bfa41a121165de8b0284a61f45d3fd5920980eeb69ec0ae55e6e8eccfc040bdfc70e09e92b3050a47ea861
SSDEEP 24576:Ewu4OW9+L6VMRCPU6CENltmVVdpx7fLrQWd:EwvOd6ZU6CENlc7dpJLrQWd
TLSH
T1EF65F15567A41CF9EAA64238C597C136F7F2BC422A21DB1F5370C61B5F37260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e9821bcea3e18b73ac70d332d415d3f69cef53f913cb788f5fe138e263a5f63f
MD5 08bb2c130b18d462f9958edeec3759f5
SHA1 172275f0f837a8d019102a8b4912111f818d3181
SHA512 cfcaf2d0890d1e41d693437292d1f6bb7bcea754e82e6d684de5e7f6ea0737169dc2795654e17beb4c6ce8cdefe0a76ec69fead7f0ae6f4d1d1544e9e0a0f090
SSDEEP 24576:DZuI+L6VMRCPU6CENltmVVdpx7fLrQWd:y6ZU6CENlc7dpJLrQWd
TLSH
T1FA55126913E424F2E2E2023CD9E29655EB72BC96273147CF1225566E0F37AE45C3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 cfbb9d07db6a2723740c2b2490f186214d054daedc9f06d55cb90781da53e3a4
MD5 b755195770430b7ea9a65f7604084c9f
SHA1 ae0742d078b0e037c2557fc997f62fa214dc35c7
SHA512 cec0e48d03cfb0a0cf03b9062581cce68b1e8058fea4447816cf52869a71a1f65206ce22bc458a8df5a009bb917999acd120d56a28bb5151d1fc5f142d74f06c
SSDEEP 98304:JQRQyi36YOcPbLvw2gAf+PN3U69CEN6rV:gQyiKa/X+PNEIm
TLSH
T1AA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 de3baba31856bdcfdf31526ec960269bcea03f5a54e67825ae937b029bbb0583
MD5 6328b3a2dd543f4adcd3be6324efc9da
SHA1 01fb609cc1b928d18f6f07cafca840b5b7a72130
SHA512 63d095dcb40055b914d37bc210ec9f18d3203fcaaa2484300eb131cc04fc3ed686609c1d4c5fd3208dfca6ee72eed8106dbf5ea3635f3f6801705dba85dbb851
SSDEEP 98304:OQRQyi36YOcPbLvw2gAf+PN3U69CEN6rV:VQyiKa/X+PNEIm
TLSH
T11C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 eb8405146e8bdbd8dd5fcf78f8c7d3f4abb216e935e0a5daf5e58691607bcb90
MD5 b0a079eee15c874ef879c830b5f66dd1
SHA1 e0ad995e9c741ed03514440b73219bdf8350abcc
SHA512 5b5b8a1c741a91f6b8671b490898c5cb2b2d886d092601f77064970c79570f19b8dc867bf1ecbb9ab7851081eeba3fc84a5a92bb5781037739c74ef7a11299ea
SSDEEP 49152:/68Qg55nhceWu7PNU3/m6ZU6CENlc7dpJLrQWd:5thLRc/m69CEN6rV
TLSH
T177B54933B2F600A9C44DE1769F4A872196D17C758FE0E7DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5937db3b8032e5fb1eda9b7680660ef5c76298f8a640dc7a4c1e50cdb8a2d558
MD5 43f69b4e2a445d20b246a1c628f5ac8e
SHA1 658def1205ce8a9dc7c837f3da2456c576bc81ba
SHA512 ee14474b0ddf7e030b36bf14bd7cf656b5139defc49588457c9d53fcbd4e947645f13122d05f0c76b5111a99b2cc1f7c80b1f0e86b2b994e678be903d49536e0
SSDEEP 98304:Wy5112gYy5azzVvt69nLKnhZL69CEN6rV:HLIHEWhZIm
TLSH
T18E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2a204da3566bfa6b0b833799798abf0f49c940cead2fe87bccf17d957fe251a0
MD5 21a920690dc749b6706d2695624686f5
SHA1 00f37668ec959931a26f2b8126f0d44a683106e7
SHA512 c3c1171cc8d79ed6c2515a3347798ae8b7171ebf394821bc661215bdda34ac308998e1b86e21134dc5f6238fa3163c3b6732f8bdc35f576e6cadba6e9617dfe3
SSDEEP 49152:RB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glM6ZU6CENlc7dpJLrQWd:Hu6Jmdxd2dM69CEN6rV
TLSH
T121D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 325f6d6ac3ab41869911d31e24b6153e413f72e5d6d7eb43fffe23f6bbe829da
MD5 5a63aa513ba63da065f6cfaf4a91b493
SHA1 0d3dd657d1b20389eb8d83c2107f9ce023fd5a71
SHA512 fee592b212d70be32c9d808d49f829a99fd001b74870e82f52dfbe67418a55d1b8e43fc301fb7b1afe31c6d47739a743435d872be90a9fdea8c93f457cfd2831
SSDEEP 49152:k1hpsNoJpF1A63U44CwH7R4xg6ZU6CENlc7dpJLrQWd:kmifPWRx69CEN6rV
TLSH
T13AB5AE13F2D901E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2a1d3810a4cc52ba31b4b512614c55b983b3f83e0a94d25efd82f0273bb7d10f
MD5 c0cc587ef1cf4a77401447dfac78e472
SHA1 fb819d7b8f398608e604f2a9e1be76ec5b001dc2
SHA512 9eb758456bb0df6ea2219593bc4620b353f62b3427b6a44e6cfae25ddb30697c157e2541e85a1a2e28413f8bc3c431367fd656a25c10ebccef2f6be3956878aa
SSDEEP 49152:+SuZQIY0Be2KcRVtOnks6NMHq36ZU6CENlc7dpJLrQWd:Q5dKii61369CEN6rV
TLSH
T101C5BE13F2E901E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b16e8b56a174d1c6750375cd4310e666da87ac3d5dc8d887f9af813c7abb57ab
MD5 de072dcef6999eb888f99a9237ad9140
SHA1 3f286d87488aeac67477c29c93cd47c1f55bdbbb
SHA512 f83496c409b17ddb8beb79cc7f3edaf21cbcfe7f3fb790b826de7771f4e8903df07ca496f9242e90b86b911a2d6d1cca712da12619d1472c73246e5beb6d8cbd
SSDEEP 49152:ehtSn8EApI0fig3giDn0AP5w86ZU6CENlc7dpJLrQWd:/X2imphl69CEN6rV
TLSH
T1C195BE13F2D900E8D05ED178C7568632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 86ad5e9484fccbcc042e4145f5914835f8e9eb479b6bed749e71b6f2ef070bb3
MD5 c5af7529c97904cdfa58c12f391881ef
SHA1 08244202432221e6ede05e12101b48e724f74494
SHA512 f38584505efdbfd0410fbecaaf293fbab4fa70ebf85f23baa60ffe656318f2559c060f021104d517150e76e6f9d001d5fa9dc15e18ad9b546b1d14c2ce80df75
SSDEEP 12288:tH8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:tc+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T12745233487AA1E52D7E00278D1A291F5A859BCDB6B006D1FB37B741F0E3A9B41C5F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f7e3eee9f1b299044de3a4d60a0a8786898d13a880e6d4c337081b161caad244
MD5 337475a374fa90f3e5334b89800acda6
SHA1 891e437a0927e4e5f286afca794b2a88ffaebbe2
SHA512 cb0d6bb642d872cf6c47236830ce7c097398b16e112b9c2893a118a4c4a39cc040f02ed05fb70e496b9fa6a64debee48ed17d2676c5cfe272bfb1bdda0c0466f
SSDEEP 12288:SG8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:S1+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1E745233487AA1D52D7E00278D1A291F5A869BDDB6B006D1FA37B741F0E399B81C1F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 69949ba671aea0b36b65d367482eb4c244ca58095108effc7526b14de3004416
MD5 26c30b950488c09bc2a04b5596ab6a3e
SHA1 9d6b7e61ceaa727b16f5828bf979ff284332aac6
SHA512 d35ff0f792730e402a79ca8fed2b09f7ffee803418f596c30f7ff12779262d8ec544a3a0cafe8a132e1839a732665aabf2c5196291aefe638b1f5b2d13c65106
SSDEEP 12288:yI8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:yL+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1C9452334876A1D52D7E00278D1A391F5A869BCDB6B006D1FE37B741E0E3A8B81C5F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 6a74e682b7ee20e00d9cfc7af1f76aec2ac8faf81620eecc57ca13e2413728b0
MD5 6b2faa6cc85ef62d10db2faee0f3b72d
SHA1 96bfedfb5b3b9a2d1a837e1b4124097cf5cd4e17
SHA512 bf167151edfed2a1e30a3e95f979f61fa90a26c30a78028e90c7d9a91e9ed3caf1bf9b868c3038ef767b27bb3a9032738cbf567d3f71d141e32524f8a5cadd89
SSDEEP 12288:HV58+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:s+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T13045232547B919D2D6F04278C5A391B1F9B5BCD6AB106F5FA322280F0E356B45C3FB28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a60670dacf60f57bf262cacafb7f1bfd17e1fcd8bab809d169e40f8dba86a9c4
MD5 8c7b73dc0d2204d2c03034443822b1a9
SHA1 24b9a99f6dc0f4f9c29c0c72c5fb7fab380b3241
SHA512 1795f7ccbb094efc9d23b3df213af009a1414ab5fea7203d29eb2887250bab409075ac7b3a0da573a2a759a9801f521f9d22f035d8450d386a52a3cf906da195
SSDEEP 12288:zR8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:zC+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1EB452334876A1D52D7E40278D1A391F5AC69BCDB6B006D1FA37B741E0E3A9B81C1F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 381b76c626b65e5fa1dcc4a33aa173b8ccdaf338e4361f9f0cfc88cffde63e93
MD5 822c7e720bb64bea4485a082c154e1fc
SHA1 8030477e5a4e18f302a73ef7a0e2f683fa3cba0f
SHA512 608d51de2f7a28436e4c0c4eaa1e0221a3875666b82a3e527b0927f156c579261a86353aa1dae7f94f481308cdd2b05091753a23c1b2a2e0c531ba4762627c95
SSDEEP 12288:oi8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:op+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T11245233487AA1D52D7E40278D1A291F5A859BDDB6B006D1FB37B780F0E399B41C1F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2b9809e80d90ac118fe3e525a633fecfb5dea428eee6722d1bbeac5ee750598b
MD5 7e8ac35e04b76545a25cab0cbf854cc0
SHA1 9a54ba1f7eac68151e7b65d5a528d5b9e31a5174
SHA512 0a4228dd31ae3bfb92ebbcee07e992d30e467d3cc1eafedefe365be677fecc835f8720a7cd1dfed13110baa4a26857ffaf844b6255b3c4b91e45cb8b4d8adc35
SSDEEP 12288:ue8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:uN+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T17745233487AA1E52D7E40278D19291F5A869BDDB6B006D1FB37BB41F0E398B41C1F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 01fb88862db91d2a3b0d4f781631a8d2939ae96e94873df870ceb3ad4621dfc0
MD5 cf95cf6cca3d0acd35ecb656e3c66830
SHA1 aa403edcccd052157a960ec867083d95074b9b62
SHA512 8c1c7cc737c2dc2b53ff145a056593b0869b5099149351f59127c6a331b28a8ff0bb3b6ef5ecdb2503783f4e534ca2f2277b53c65df21f0d668c8be4dcee89e9
SSDEEP 24576:xZMRzFVSOV+L6VMRCPU6CENltmVVdpx7fLrQWd:xZMRzfe6ZU6CENlc7dpJLrQWd
TLSH
T1F3650265B3A01CF5EDA7423DC9658956D6B27C5A0B60CA1F13B5362B0F333A01C3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 6c2f3291e0b52395c1c4b51efd134837f0d6ce4377eca163cc6b7200cf1a76e6
MD5 60eb059a736460bb6963cf80755b7d18
SHA1 be854badbde0f81e031a0fe7cb7d98dac2de33a8
SHA512 9dc3cd8959a04c57a4d784203be9c5154da307df3dfd00513bd69f2e524a5583cfb8317e0e411539207ac29e937e629036cd7301b6cdff0c5249e9a59236feb6
SSDEEP 12288:SL8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:SY+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T18F452338876A1D52D7E40278D19291F5AC69BDDB7B006D1FE36B781E0E398B81C1F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 74bb2fe95649aa96cbf7e6a2910b0fa04024f7f7a389beec3fcfe8dd57b71722
MD5 cea6fe1fc6f52b8a743b3337a9e0a5d1
SHA1 bbf388e497d7bb0e4ec5b1baddaeb46c4738f0a1
SHA512 9c35367fb239bddda4c18c2024bbfdafdcc9f7404c7758ffa68a1d3a454c87ef849bb39e12e928479688d1fc77f2145dda3689950be0e3c36390ccee8aff7556
SSDEEP 12288:fv8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:fk+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1FF45233987AA1D52D7E00278D19291F5A869BDDB6B006D1FA37B780F0E398B41C5F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 ab5fcb02895e685738aadd820ea47c49df4e96fb93409f7d8c07492f9add50bb
MD5 548076d92ae574e7ad026978eafcac2a
SHA1 d9d4e6c5f35fe69d80d0a277d28f189506df87bd
SHA512 b9c532eb8af19c4746563b5f7819be954bf1b69f60245e323c5c070362fbdcc58ca3ceaf418858353ee095dfb96bc2376d5e798540fb18a4bcf1526227a3f858
SSDEEP 24576:8zyx+L6VMRCPU6CENltmVVdpx7fLrQWd:8l6ZU6CENlc7dpJLrQWd
TLSH
T1AB55021763A530F5D2B64238C8A21A52F776BC761B209EAF5364563A0F376E05D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2bd7a968179a8f475b9fb216b250a533c146826ba071081af1894df533463e9f
MD5 4f0b9cd84027d62e4f688f8c3a9e89d2
SHA1 123e6281d82a271b08d039f21600cac0636591fd
SHA512 a2f0f34b66afdebe7b90f89bd6156facf70f989e419e17a0aa77af804c38335698c093810c2063c8e7c965eb58ba1919708461eb9485041321f455cf4fee0c55
SSDEEP 12288:zL8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:zY+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1B5452338876A1D52D7E40278D19291F5AC69BDDB6B006D1FE37B781E0E398B81C1F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ccaf7d457e50cec1e603b03944b3460171a9b4202334526917bdad707f421e56
MD5 40aa4dfd5ba61e170005b44ec026fdd5
SHA1 b1396fddef09632a071a491a1de893c0ea3ad3d7
SHA512 c711ffe9c11c44d1d2057ea71b282cc421a3f5b01851ba2980108b069d6b234120b889e5fcec3b50b151362aca2e8bfb48709ac48676c1ff5ca5aaa355cb71f1
SSDEEP 12288:BL8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:BY+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T161452338876A1D52D7E40278D19291F5AC59BDDB6B006D1FE37B781E0E3A8B81C1F62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 13a6d6b33809e2587fe93d1fc26a1a801dc15b6807e68a23615554a5f1a0a121
MD5 09e0a2e6a303845488ab312e16609caf
SHA1 cf61901e81a21ff94290003d693ef1058edace08
SHA512 5d506d9848ad5dfcbfd6a5c8535d35548a47f748c55bf26735d6136a6966429ca982e5c1d30c49dff67d8a2e40cbaa59a7ad28e613693e839caf2496bd4b150d
SSDEEP 24576:9zyx+L6VMRCPU6CENltmVVdpx7fLrQWd:9l6ZU6CENlc7dpJLrQWd
TLSH
T17055021763A530F5D2B64238C8A21A52F776BC761B209EAF5364163A1F376E05D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 90a7815cd1964cedbabcd0d8b8e8a251a84d192dd077b0042f5dbe671e6aa813
MD5 b4176fdecc1b62b467bd22576cf7d4b2
SHA1 193ff0263e3825ff0702697eb4a0ddc09961ac4e
SHA512 2d025252365913658a01f244b7c4f46773207d7fc0368e6f92851a877c89204fd0a1f24189f732429709744014ffa2a85e4c654abfd3511456b9382193414125
SSDEEP 24576:8TDaLl3z0zD7+L6VMRCPU6CENltmVVdpx7fLrQWd:8TuLljt6ZU6CENlc7dpJLrQWd
TLSH
T169650264B3A01CF5DDA7423EC9668956D6B27C5A0B60CA1F13B5362B4F333A01C3EB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 ecb50bc2d0ebf76c44158a907525c0d914e4a2f033c9c1ec2b913e435c87a2d5
MD5 edead64bdd153110debcebb295c0d2f1
SHA1 b234eed6c13c62fb5be7c29a5dbab9443ea5ab2f
SHA512 dbdc6686e3b1b2144e90a0cfa77f1514ceba47e5df4154fa9de6c2df9e34395ca17d10b112dd829130104b56c843daecfcd52a65395cfcdd0436f0cfb84e62e1
SSDEEP 24576:X3vd9CHKy7GZv+L6VMRCPU6CENltmVVdpx7fLrQWd:nvd9CHKyae6ZU6CENlc7dpJLrQWd
TLSH
T13A75CF90F3E414E4F1B79A35C9768511DAB67C9A1B31DE8F03A4251A1F33AE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 4306beb1a36c7ce7b21dd6b0f4a657b484444439335604ee5ceb33d6f655e65e
MD5 a64c033f2edd9971e58c5f269d677a4f
SHA1 8cfbb15381c39c870c2b4d8715fbbf932ce54464
SHA512 7c1b5dbbe1b11f4b8d26463d04cfd7e3dc9183b3695b1a6228f24fdce3d4b7c42a97bb9a3de9725281f0da6a0578e6ad9070445bfffc97f8175eba6f585a7b0a
SSDEEP 24576:jfwvUk9RX6wkyAI0+L6VMRCPU6CENltmVVdpx7fLrQWd:5MnYIr6ZU6CENlc7dpJLrQWd
TLSH
T17485D029EBDC08E1E1B7923C99B3460AF6B178591B31C6CF125A536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 fbadcacd9e50b96c039f7fe67c3bcffcf5566bdad87275523f060756c8a0ae4f
MD5 d399b8ad4d888022e8aed90b46864fd4
SHA1 6b4204573d1c1e571f3066807a27c8838194e764
SHA512 f067d78b315e8c99d6e52c012270a1f99fb327e520a5618a53c8f0c34e1926a4dd9355488eb513f7ffda80a41620fef7e9dbb97418da92e70611b851ba35fd13
SSDEEP 49152:PYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0c6ZU6CENlc7dT:aySzP069CEN6rV
TLSH
T1F8066C56A1A801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 69ea15272dacd1a7f4e7a7cabab5d7a2482ff43248d8c610a92a7a95bf61c52e
MD5 f2fdc5e4f6f433f8c7c954f3bde011ef
SHA1 3afb189949cfcf8398956a4adf0d630cdb989ac7
SHA512 43aefe7d03165b3cdf89d02386110b0e252c57cb4034d8e43ca448e43dda4c656392dd0a12d6065062cfd92df27dc085b7d27090445bef708b23fca6566779fc
SSDEEP 24576:N47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYl+L6VMRCPU6CENltmVVdpx7fLrQWd:N47JUQjTirIhCnDHUPfF/s6ZU6CENlc5
TLSH
T11A65AE1DA3EC01E5E1BA927885154A5AEA71782E1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 f5ac490e9854f4844aa612efd3efcb52b65d28f3fc144da374608580b2f89439
MD5 362174cb7288e44e881aac9fd3ab3a2d
SHA1 93adbdb71e6086bea0ecdde8df9dc12ab65a9881
SHA512 6a9a1507a6a72436b8b3fdcf2964637f1ab906440394150a25f2bccf2db3e2f3a07b379de1ff8fb107c63680b918e90d8f2b1ab43494d20a3688fba8046c6df8
SSDEEP 12288:Ybsfb8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:/I+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T13455F019C2A802E5C1AE2278C7928651B7337CA597E1D7CB63D1F53E0F366A05CEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 634B
SHA256 4f9b2f699943dc7a42321fde879d884202e9b3bd8391519cc69bd83d8d485aae
MD5 4600ea83e72c40d5b6d25248895c4d66
SHA1 666d119fa0398adce7093f434fc15437ca6913c5
SHA512 08c1e1315bd3be50f47cce09a7b9c36aa38572495cdcbaa1053f6cc14af921437f3972c25d2d5c8df70a5b2e239a62d4cec6b3039de5b99e43b173eab4cb0bc9
TLSH
T108F0F41726E40254F1B72F22EBF990B357377C96AD2994BCA0D8031E48E1A45D5B27B3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
MD5 29f1b2d1b6f9290138596cf180847e53
SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
TLSH
T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 e7c9f6979780f4885f0d44b49d66d4e5c1efa2a3aed62621a183884a163aa4d9
MD5 489cba0c266e72f4f949a76ac39a99e4
SHA1 6a7f1c656a6491c9a39eeb558cb1a9c414d8814b
SHA512 a8a8b62f2128ab064abdffd8610e3895738fc69c4d6e3348110c5ad3d04234231e5651b7902d00547762d2171269e99f5ad99b6ef76af10bae4a6a6662e8da8b
SSDEEP 12288:udpA979U3fUCIAX1Sl6YqoiqX3fH1sIQQSmje9v84QGsyRcK1TgM:udc5UPDmriqXfmIQU0vjsEch
TLSH
T1CB452751B66AC78FC6A940721E33D1CCA7707D41EE446F0373C89B3FD572658BAA6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 ffb65f3da248928b374c06ddb43f5b2d7e1f01a5d3c63dcfbd811c2a2fa6b91a
MD5 a198c37a9a254285162d57707e71d2b2
SHA1 e3a5b89afede2558dd6498ab4f62367f1f21ae64
SHA512 af6285f81ec17c1b81e21cc69e86fe9105bceb80782e55b0ccbf40feb42b3e138e90cd554dbdefb705ef0cb78cac42376f7f6afdec04f9e94f93480af2f38ab2
SSDEEP 6144:zy+1+crKi38JCVXViQ2sb6siDtMxbLiDtMxmaHBcebJVYCrq5BFk4sBCFHPQm:zRscrR7VXVC8Z4PsQ5om
TLSH
T18E65E880A537E28FD1B660B2072A5B0CB764DC47B7495F26B3C8053AD86AB55A0FC3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 168B
SHA256 2cd16cb758b6b2ad1d6dc17cc198526f04be2dfe5a85d0b1b09721cb00f5ec0b
MD5 1915ae905a0d11ff145f55898a16f73a
SHA1 dce6ba23915c06d7aff944be6f33612dc45cedbe
SHA512 45b4d8739d6f2a526eef8435bb57e98c01c8120f96091d611cc9f9a15400c7c779141b2df513251c958dfc9521841e92c4dedd98da47fdfef90efcf2c459ed75
TLSH
T11CC0800233FEB609873E0043971E3FD730407217C3C3491132103787F250445495F519
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp29D5.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp29D5.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp436A.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp436A.tmp
Size 3KB
SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
MD5 ec946860cff4f4a6d325a8de7d6254d2
SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
TLSH
T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 ec2d796e2754f55ece4a40cd3a6519cec10e8b2528fe6524999fd312e646a5ef
MD5 1c901b8e60af92dcc0ea06ccf4e8f066
SHA1 2295865f29217d5c5e8d3d53173778e163372de5
SHA512 3690bcfadd5f924e059ea8643d5aba87f24c5cb58560dcaac5ccf45bc1285052649b1c54bfe21c782cd48a96478fd7050ab888059746a4b489df064eab091fb1
SSDEEP 12288:G07T8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:/g+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T14245223087A92D12E7F4027890AAD170792EBDE95F0099DBF226750E0E399E49C7F71D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 660156a225f697863e877d3afdab10cd2171c26800e02292341ac163e54289a3
MD5 7a50f0dffe3d13e06e935c4760f6f785
SHA1 c724cb6b022cfe891f83b3c0b2c457275d275076
SHA512 bcb44004566176b6ad3444d4fefcc313a1b186de2ed88f80afc033891d347c23c6d1f19527550f33002e0f2c227ac1c54a1723db2f0d20055bdf06564fa39888
SSDEEP 24576:Pgb6bmBIi49WNNFpg1rSvFv7bYu+L6VMRCPU6CENltmVVdpx7fLrQWd:Pgb4mBIBhGFC6ZU6CENlc7dpJLrQWd
TLSH
T10465AE1E22EC02F5E1F9D2B8DDAA4417D6B278160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 be7f9a93e09083c57b3a7ad15d48df1dcc51cf4a4613ed4b2dcce929307e6b9b
MD5 5b591fac9fe6b31e3dc42fccb4977f36
SHA1 4701ee36f43c8f6d116e5e861f047c5072fb2052
SHA512 cbecf26f51e9b0e24c2225f43434765a6b95eadf5163b4350167d8990522b9d006bab07017dc1f2cb682e28fa5ab5302e5ae39c5c55070e4042462c48c263d93
SSDEEP 24576:WG88u8FpJqH1bzria7/mV+L6VMRCPU6CENltmVVdpx7fLrQWd:97ZFPqVea7/V6ZU6CENlc7dpJLrQWd
TLSH
T15285F16567E101F1D4B7D138C9864663F6B2B8251360EFDF07A88A560F23AE44B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 99004c398d75ea36696ad8c190fb9e3c6b12b020f53c0dcc95a5fd5f732290c1
MD5 5439cf22ec2cf1479511e19c70b5bb83
SHA1 7c09076f9252a2868dea8ced0d0c02a9dac9d40d
SHA512 488f6e65faa1d94c767f9dcfc862d31ad44e84d8d3d5c36dfe93ad243849302862d860332ff13ffa586bbd54f84a67397757187d02ef566279191087f49759b1
SSDEEP 24576:lPUr+NQ5+L6VMRCPU6CENltmVVdpx7fLrQWd:lJQe6ZU6CENlc7dpJLrQWd
TLSH
T1DE65E12E62AD1CE5E676A17CC5828619F771B862171196CF02E1817E0F37DE8BC3EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 fb1b15514ccb3b0805d59f065a5b18b55dcf5a049a68d9d2cb9e49d1ed541fc1
MD5 37f42ebf4f932818a29d763656be8337
SHA1 5d3363f5e6dcf17d524e639f00475cf2a43d0a5b
SHA512 b4c7742b4d411f7073a3262ee95b09dbf5c4a05c54d012394ff46d2cbf0cc55044b019ffc3ee0f6177e5e2127b27f60e403928e97f6fd651db4dc1ea52e14494
SSDEEP 49152:5BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjO6ZU6CENlc7dpJLrf:aG05lO43bz69CEN6rV
TLSH
T103D5CF6E62EC11F9D1BBC17CDAC6860BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0130c35d37b2a6ff01b13e86038e7e3ead541e434726aa9c3bf8ae0588d9204c
MD5 d6cf073ea49cb07d7dc8248cae504f0c
SHA1 aa9e354293fb59de970a8b4599a2c25d6f497fd7
SHA512 714d06ff14d1a37941c6db9f3cc0b690820b9812bd91d79e4a82e0eb72dcfb5ce1136003824be265aa07b9c5f4b8f35b7ed9042d4265e190cb2038d8094e2176
SSDEEP 24576:Yfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnn+L6VMRCPU6CENltmVVdpx7fLrQw:ga5POZ3BJt2pasx2+mm6ZU6CENlc7dp5
TLSH
T10065AE5EA7FC01D5D5B9D17CC583861AF5B1346253319ACB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 53d5cda5f1cc0504aca054d30fb2a626e3789a44a28471c01c80d1054377575b
MD5 c0b23c67e7b99223ec2482b6aacef286
SHA1 22488bb379560208621d94b680a57947f151c3b1
SHA512 7e39d2dbc410376949eaefbed9b544708dc63ace909e059151630234f9a8165109be5a76633cdbb3ce69d423753dbcd4a4909d7c5c672c3f6ce444925e967adf
SSDEEP 24576:6NcwHdjbyQ4nLC18lb/EOjowL7Fk9+L6VMRCPU6CENltmVVdpx7fLrQWd:6Nc/zEOVHF16ZU6CENlc7dpJLrQWd
TLSH
T1F6857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ca379d24e3a91ea46ca7a15805d3cbffb07c2a3152bc55a836a180f60f9a9d92
MD5 c228acca90f140483e84f89f36a70ddb
SHA1 a9666701bb6fbd503c9fcbd342a2a5c7c03582f3
SHA512 a693fff2189e7b1d6a89c0ae92636733a9630d01f9f491eba61b5d9b655a75c48b6c4ef3bdc9e779755faa958188b6610bfcf7a6cdeeaf30cfe3b109491a7c4c
SSDEEP 24576:WTkNvNnaFeYhJNtmZBmz+L6VMRCPU6CENltmVVdpx7fLrQWd:WTMwBtOmQ6ZU6CENlc7dpJLrQWd
TLSH
T1AE55AF6EA7B806E4D1FAC6B4CD238512E6727861173293CB5390C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 09f9824a673c7283e7ee4dc77b170a3b7db7e3d54e591e98a4630aebb5b4448f
MD5 8631afedbf92e528c95a3266780978c4
SHA1 1adc378f1d20a792bc9e4b5f132f553d399932b3
SHA512 c1d412c03911638747e03d4f7e0024e8acc3fa82cbef5e7bb91476d7fafbfdfe65f598d702313207eed69023a2fd894673e68d3f1835e15f15264791353637fc
SSDEEP 24576:CD3FHshBIYQgA8+L6VMRCPU6CENltmVVdpx7fLrQWd:CDVHeBIAAD6ZU6CENlc7dpJLrQWd
TLSH
T15E75E13DD79C04E4E57AC1BCD6638606E77138A903216ADB129481BA1F6BEE47D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/296-168-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/296-390-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1384-20-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1384-14-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1384-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1384-21-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1384-183-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1476-146-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1476-150-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1476-165-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1476-362-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1696-208-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1696-219-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1696-209-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/1696-217-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/1696-215-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2392-397-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2392-227-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2392-233-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2392-226-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2488-196-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2488-393-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2488-198-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2488-204-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3592-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3592-225-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3592-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3592-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3592-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4168-158-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4168-148-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4168-377-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4168-152-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4728-588-0x0000014415D60000-0x0000014415E60000-memory.dmp

Download

memory/4728-635-0x0000014404220000-0x0000014404240000-memory.dmp

Download

memory/4728-590-0x0000014415D60000-0x0000014415E60000-memory.dmp

Download

memory/4728-600-0x00000144035B0000-0x00000144035D0000-memory.dmp

Download

memory/4728-621-0x0000014403810000-0x0000014403830000-memory.dmp

Download

memory/4728-602-0x00000144039F0000-0x0000014403AF0000-memory.dmp

Download

memory/5204-586-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/5204-782-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/5204-528-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/5216-0-0x0000000000400000-0x000000000062F000-memory.dmp

Download

memory/5216-125-0x0000000000400000-0x000000000062F000-memory.dmp

Download

memory/5216-7-0x0000000002520000-0x0000000002587000-memory.dmp

Download

memory/5216-6-0x0000000002520000-0x0000000002587000-memory.dmp

Download

memory/5216-1-0x0000000002520000-0x0000000002587000-memory.dmp

Download

memory/5416-774-0x000000000DE20000-0x000000000E69B000-memory.dmp

Download

memory/5600-184-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5600-191-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5600-185-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5600-396-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5600-394-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5600-392-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5840-391-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5840-582-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5840-584-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5840-171-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5840-172-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5840-178-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5912-53-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/5912-143-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5912-39-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/5912-45-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/5912-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download