0ce1ee962dfa5c158df2fd2f05500da81b7776d81419ff0b96b4ff159d4d08fe

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_79ed56cedd5a931ba9ec79533eaaa88f_amadey_elex_rhadamanthys_stealc_stop.exe
Size 1.5MB
Sample260709-mlvrkshx3w
SHA256 0ce1ee962dfa5c158df2fd2f05500da81b7776d81419ff0b96b4ff159d4d08fe
MD5 79ed56cedd5a931ba9ec79533eaaa88f
SHA1 1f19a299bbfdda99df70b0c90b668f714e3af9e4
SHA512 eaa4fe9b01e9c0a2bc6ee779742392dbb16073df0394c539d97ce763ee5ac8d4767eebe8729aa681af8e8426bb86c9314c8d8b1a45a07cde8004c2b217a2d30c
SSDEEP 12288:TjndvQSr6XvbGIqBGr1m+91PLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcq:TLm5qMr1nDjf9n1i99k32tY5cz84
TLSH
T1E975E11077D0C036F1B324764EBEC665967DB9712F2191CFA3C0266E6E70AD1A931B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
3484	elevation_service.exe
2688	elevation_service.exe
4384	maintenanceservice.exe
5124	OSE.EXE
2132	PerceptionSimulationService.exe
4492	perfhost.exe
4780	ReFsDedupSvc.exe
1952	SensorDataService.exe
6084	ssh-agent.exe
4060	AgentService.exe
6072	SearchIndexer.exe
5488	Reader_sl.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_79ed56cedd5a931ba9ec79533eaaa88f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-09_79ed56cedd5a931ba9ec79533eaaa88f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-09_79ed56cedd5a931ba9ec79533eaaa88f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-09_79ed56cedd5a931ba9ec79533eaaa88f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-09_79ed56cedd5a931ba9ec79533eaaa88f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\bb2945bad8ede1e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_79ed56cedd5a931ba9ec79533eaaa88f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\OptimizeRevoke.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-09_79ed56cedd5a931ba9ec79533eaaa88f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-09_79ed56cedd5a931ba9ec79533eaaa88f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-09_79ed56cedd5a931ba9ec79533eaaa88f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_79ed56cedd5a931ba9ec79533eaaa88f_amadey_elex_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000b95867a8e0fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000558c8e7a8e0fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da57ee7b8e0fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a90bc8be8e0fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b3e227a8e0fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092a062be8e0fdd01	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Reader_sl.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
5004	2026-07-09_79ed56cedd5a931ba9ec79533eaaa88f_amadey_elex_rhadamanthys_stealc_stop.exe
5004	2026-07-09_79ed56cedd5a931ba9ec79533eaaa88f_amadey_elex_rhadamanthys_stealc_stop.exe
5004	2026-07-09_79ed56cedd5a931ba9ec79533eaaa88f_amadey_elex_rhadamanthys_stealc_stop.exe
5004	2026-07-09_79ed56cedd5a931ba9ec79533eaaa88f_amadey_elex_rhadamanthys_stealc_stop.exe
5004	2026-07-09_79ed56cedd5a931ba9ec79533eaaa88f_amadey_elex_rhadamanthys_stealc_stop.exe
5004	2026-07-09_79ed56cedd5a931ba9ec79533eaaa88f_amadey_elex_rhadamanthys_stealc_stop.exe
5004	2026-07-09_79ed56cedd5a931ba9ec79533eaaa88f_amadey_elex_rhadamanthys_stealc_stop.exe
5004	2026-07-09_79ed56cedd5a931ba9ec79533eaaa88f_amadey_elex_rhadamanthys_stealc_stop.exe
5004	2026-07-09_79ed56cedd5a931ba9ec79533eaaa88f_amadey_elex_rhadamanthys_stealc_stop.exe
5004	2026-07-09_79ed56cedd5a931ba9ec79533eaaa88f_amadey_elex_rhadamanthys_stealc_stop.exe
3484	elevation_service.exe
3484	elevation_service.exe
3484	elevation_service.exe
3484	elevation_service.exe
3484	elevation_service.exe
3484	elevation_service.exe
3484	elevation_service.exe
2688	elevation_service.exe
2688	elevation_service.exe
2688	elevation_service.exe
2688	elevation_service.exe
2688	elevation_service.exe
2688	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5004	2026-07-09_79ed56cedd5a931ba9ec79533eaaa88f_amadey_elex_rhadamanthys_stealc_stop.exe
Token: SeTakeOwnershipPrivilege	3484	elevation_service.exe
Token: SeBackupPrivilege	4780	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4780	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4780	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4780	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4780	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4780	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4780	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4780	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4780	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4780	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4060	AgentService.exe
Token: 33	6072	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6072	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6072	SearchIndexer.exe
Token: SeDebugPrivilege	3484	elevation_service.exe
Token: SeDebugPrivilege	2688	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5832	AdobeARM.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 5832	5004	2026-07-09_79ed56cedd5a931ba9ec79533eaaa88f_amadey_elex_rhadamanthys_stealc_stop.exe	92
PID 6072 wrote to memory of 4884	6072	SearchIndexer.exe	102
PID 6072 wrote to memory of 5268	6072	SearchIndexer.exe	103
PID 6072 wrote to memory of 6036	6072	SearchIndexer.exe	104
PID 6072 wrote to memory of 6088	6072	SearchIndexer.exe	105
PID 5832 wrote to memory of 5488	5832	AdobeARM.exe	107
PID 6072 wrote to memory of 2668	6072	SearchIndexer.exe	108
PID 6072 wrote to memory of 4288	6072	SearchIndexer.exe	109
PID 6072 wrote to memory of 3564	6072	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-07-09_79ed56cedd5a931ba9ec79533eaaa88f_amadey_elex_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_79ed56cedd5a931ba9ec79533eaaa88f_amadey_elex_rhadamanthys_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5832
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5488

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3484

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4384

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5124

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2132

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4492

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4780

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1952

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6084

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4060

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6072
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4884
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2532687178-1633831978-1202193935-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2532687178-1633831978-1202193935-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5268
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1660 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6036
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1632 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6088
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2668
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1660 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4288
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1632 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RdrCEF.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Size 9.9MB
SHA256 a79ac2875d39b39bb41feb0647f8a2df4139e172896ea1da4b3ac354a9711589
MD5 61afb82e26b58356bb746f880e656c48
SHA1 273f293fc57fe61c4d812f74114a5b5b7c24aeed
SHA512 c995d2ba8f4bc3beb5fce0e7506f19cd417bac9773c02d9eba12a1de0aa7ed24b5abcdd9ff284737f4428c39703970e52f60c6e57c3d81615ad62b7be9036a73
SSDEEP 98304:0rbT54hEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTVEHGt4:2onfW/JLGMcblLheTV0N
TLSH
T1D9A6BF1D7BE21036CD732176AF4FA104E739D007A215C6977ADC83981FB1AA152B6FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 3.0MB
SHA256 059c982a38fb2860423f48dbfae345e22497a702c71d89a26ee4605680cda1c8
MD5 b7b9f252a5c38d77ce2d10c4667f75d1
SHA1 f1f812dd0e7eb9785754e7c26f0adf7e2bcb54cb
SHA512 92e370c4bf7c449eb2c9362fd0d43233f4e13e8811369dd1d255cfff5085ea3228a9ef026e4b80c4cca53b8ad92567b557ff8e847a04bb69a00714639e7bac32
SSDEEP 49152:YTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJUln1i99ZG5v4:YTfiG/nzU90uEHGt4
TLSH
T1B3E5E526A2C8C1EBE5642170CC69BBF900546D78DBA2CDD7BD447E06B9307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
Size 1.2MB
SHA256 16267bd4a9ab5be0dea46d336924f7654ec7ea977e8c4590d146e04e9b4e0d55
MD5 16efa08ce9b8722a8c84e7450f7aabc5
SHA1 dd963df811d6537e6d61d9b0f106453ff62fa90f
SHA512 13440196a0922cbcecee952078377babc691b6858afa2001187eeeeb9813b43254393ada6a2bbcfd74e2a5b57be373c2c18a42a35d698fd9854adc5a56e50520
SSDEEP 12288:zFYWLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:pY2f9n1i99k32tY5cz84
TLSH
T18A552213BB49C7A6F51212B60CE58FF8E5BCCA18EF9465A3D31126572CFC9E4243162E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
Size 1.3MB
SHA256 8b7d458b6425f60db0524ab1b67b1fe7d356777343779262c508f0482690031c
MD5 9286e3d861c994b8ae101f58cc10d038
SHA1 f1892e04c013d6b59ee2b7c99c8affbc5732e716
SHA512 f7947cd20646e0ee72d22cbe69ee95bc7ac3189f1660fca87e6331adb5a0390ad7d9a2ce396110338a6b76f4385c956f8aa2d6df68dfb6e87ff928588015b68e
SSDEEP 12288:M5CGLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:MVf9n1i99k32tY5cz84
TLSH
T15C551222F5C585F1F62601724C9AAFEED02CEA384F7094D3F3944F3A297C5E25A71962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.6MB
SHA256 c1207d2945c3426fc1a44bff210d6648321894f9bb691948174b278e80191919
MD5 1b7585ef5d5c9c5a8a05ebcb74e884fa
SHA1 24e5dd8ea64a4223b953aec6feb72144a036a022
SHA512 1e117947efebdc9544bd2bb39834ce0a3cd5bb340a6b19526ea3032652d157ad883bd310a4e93adb0430c08b2fe08f8baca70dce0ea7f40c689a48299f4e8a3a
SSDEEP 12288:h6dVWnxlMEn7nFKbltn+Ch/m6X6LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5c:IATAbD+OmeCf9n1i99k32tY5cz84
TLSH
T14075E01177D0C135F1B329768ABFD728556CB9715F6881CFE3881A6E1DB0AE0A930B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8bc9b7c2a1298550841bbc038940e5f6c4b5f624047f9c84346f6bbf577589e0
MD5 ae3bb87a70c9165408e077a140c02634
SHA1 dff37d239d873c68075edaa616f5bded4be56d0d
SHA512 db4dcaccd446619243fece026d6c34a91600bbfde6d14aef5eee4dbec87a19e28c80bb303cebfa5244e12d40f4b7ef7ba4a14ce13521f967f7b363502cd235f8
SSDEEP 49152:+b+632BuPkFKRrdE6ohvstBhuXjfS4LWxn6ln1i99ZG5v4:A3q6sjBBEHGt4
TLSH
T11DD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 8fa23a0a203204b00705fc2e7485bbe10a0c5c0618e387fb30c06633e74062d1
MD5 91f90d82f2f84cb16a0eb62fc2df29bf
SHA1 075f396dca77cba64a4cba518051984d9f47f445
SHA512 ca7cf5fba2b0999d377e732dc57c01139de44fcf19ac3de612bf53a4de0d05d89fb4ad651f3a66af6c64cfef20dbb95e2d23753210e493b645289f152a2c8b58
SSDEEP 12288:C1XLsswWkxy2lRq2czAzLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:IXYfDtczAvf9n1i99k32tY5cz84
TLSH
T166650129B3D408F9FD27827DCCA2C911EA32784547A0E78B03A499662F377D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 93ed1cb45b46bcf9aa5d99fb20b0ac4fa7a6f2e37db2c189b7ddb34f33a7b40e
MD5 c75fdff56e5d37b862e06f111e638725
SHA1 c083154c221347706fd1e692cdf9ef251ab550b6
SHA512 e8b0f3a419bc4d53e89bf6f5eecffd9746f10f9757caad30668d7a7ac8c06b74e78aa833bdf9df156d92d5eef5ee12b6859a2e0b6d965539db2a1bb76be99988
SSDEEP 24576:l0Le5ji0hmxxrMof9n1i99k32tY5cz84:lPji0Ajvln1i99ZG5v4
TLSH
T116859E16F6748335D073C0B9C5D2A69EED7130865B308ACB4286D77C3E6BAE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 70283536d67e52660bd8e1623f8a867ca94be1c1db8167692d16d453c1f057d8
MD5 5254dbb7113ee2065a3b222b75e7a587
SHA1 013f8401a6f11ae25d9536743951e3611db2f914
SHA512 0e7164d5339585b31a16884713170b01cfb50d4eee3f1be20f1e2434d20ebf52eded7a940c4cfb0d32e07dfbc510241119f9a79681bc9524e5592f80085b84f0
SSDEEP 24576:0a7/ezSC6vUyD/aqgrvWn6q8wyuWf9n1i99k32tY5cz84:j/ezSC6vUzPveHjyTln1i99ZG5v4
TLSH
T179756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a4fde74739a5d503caeee8f3d79207703f434f164a6f55a78142519fb2fe28a3
MD5 864be6d037e8b2113c7ca877460f28d9
SHA1 5f4ebd7a87df79588e024db9d34319481e63f545
SHA512 fad0fd429bf00cd501270adb0e3f4f02953e114faf88f20eff825a51a0f4bdfb244606cf6d805b63ff27ce5ebe1dcb9459b410fedccd1b3be0696bae691fe6fd
SSDEEP 24576:uVbqPb88hv/l+Yxf9n1i99k32tY5cz84:uVO88hXl+eln1i99ZG5v4
TLSH
T1DB559E66F5748331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 c8327d0d365eae7f207f4172c4629f192ee7866ce80844de73781e7123ffb5f8
MD5 42b96528efd6aeb16f88c5e612b1c371
SHA1 c07fc19d43af7573d63cc9d84d847c291d670cc8
SHA512 12f2edc38e88883c8a2e1c5e91124e742d1b77af05cd3d0e256b83195222f173838120eadbfeea3ea83b00aa0bb41b7070d9019075fd3362ba5af2facbe20b39
SSDEEP 12288:LLQLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:LLkf9n1i99k32tY5cz84
TLSH
T1AA452353F64891D9F71722BA9CE5CCF4AA7C5F0CACE8A812D3613A9738FCD78A050512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 f2632eb40a6040124403fea73649ff07f33d579e502a660af2a2d1b0b51406d1
MD5 8846c4a54813178c717a0147d512aa7a
SHA1 fba1a8685139dc5f9a1f0c6e8e8b59dc57c915f9
SHA512 0da222a3d99956ab75e90d0bcb00c4f976fc8d18736da3406c91fe875d00a8b90f43baf14a1ee4b5b5d878d80678c0e88dff70332c555974829ff14f35f2d7c5
SSDEEP 12288:6eBNUbTVO86UJLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:6JIUpf9n1i99k32tY5cz84
TLSH
T14965CF3BEE28FCD2C23A5DB95A91C640E77278304F61A3CBD165830E9E279E05D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 dda762721e9b2e3dab7501020b517935aee5bf5c2720ff9dd979b02a70efd13c
MD5 1d935ee8b25dbd22671c427f516ce071
SHA1 1ccbc0f3478807d7c1de8e1ce36e4ffe30962e1d
SHA512 f5f38e8c99ddb1731bd2a2df9854eb1801bd9c7c3b0972f2fe3257813b17124e49e2be3c7aeb49ff2c1b18e6781abd1778e0edf6a7497315d74ebecc52ee1377
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THa:xQvGAdlCEL8c/DRNw5C0EHGt4
TLSH
T1CF267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 856b9d2f9d443a41cd7c05f9570a2fd8e31fe38c9da76f84a670066a9ea20f92
MD5 35562b3477e49ae416a550993829c8cd
SHA1 be90ff5497e119bbc0d9370bd065f034d6722350
SHA512 24772bcbbebedd3964023df28dda16b67a1a5f0613c8d022122f068fc55bcffc6768fb775233e599386841d53ab6f82d4fd10f58b4c0885a4fd3b90f7caa15d6
SSDEEP 12288:UAwSfxL/2Dc3RDLLmt0LDQewsAjjLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5/:p0ewsAj/f9n1i99k32tY5cz84
TLSH
T1E075E031FE74E036D37B0DB61B66C716583C7A204FA129C3E3A84E9E19746D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c7f732b62703cde440d82f98125305950e28fb0ed7de1f27eebcb52f4806e5f0
MD5 7c41eb7f08108bb88802a0b1901c224f
SHA1 da8674424ee087828404da29c49c3d5e6d327393
SHA512 6971d20d8ce428ba40a4a8993942cdf0de969a7c61ddd69554eabb9cb05245f8a6b63d72465154950ab4480e937a77079cfc03ba1274a9bc54bc984806a854e4
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHN0N:5UEtQevvqc2W1cpV2tI32
TLSH
T144474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b11a71dc1e9fa4d672935d7fa7565e3d27050070f99d22badaf93a17259f9aad
MD5 2d4730a49d6c93a800e7f139580a5420
SHA1 2cf403553f39625e2bd596e87ebfa4d5b73f097c
SHA512 bdea8b405727cb63792593f46718d21301c83adb4d987dd2ef2fdf27aed3429231ec91c974c400f122739e25986fdbb9367871e3a6749f1430665fbfee877cd7
SSDEEP 49152:pCbRquA/m2yL5zifFiV+XenmE3/zfln1i99ZG5v4:moqHVjnmQEHGt4
TLSH
T1B1D58D0976B8C2E4D1F6C77886A2C647F37178154B34A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8b6ba621a9ff56b3751bafb872d92c056209cade9de302298206e17d8edb7700
MD5 b89d9874f3c961b3000f3f9621d7f62c
SHA1 4f1b2556b0bf64090b44b9e69bcd41539750fb0b
SHA512 3243d57af70d04a2ff0caa8144a3dd11d5e9e34e00ac8b40300e31a5e3bf569d051316554fb6232730552c7558b869635a2a35b3ad7a3f83aee047b9b44d715a
SSDEEP 24576:DAhGL3IFoiwtA5l7S53qf9n1i99k32tY5cz84:DAMUFoiq5aln1i99ZG5v4
TLSH
T135359D81E7F945D4F5B3AAB899B68570EA76BCA95E30C20F2160D11F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 a9cc3c17b979780d9706ccee5e49e0896720534721bb56a04e049f55ca574781
MD5 c9630f5c6cdaf7953a843887923dabea
SHA1 8ad9e94a3791ea91287d3e8d0437c30185313ace
SHA512 dc38554e13885d2aa0944b1313d1e795fec617f12c1f6a2b02b9d6dd2e679b76d9432e36ddaad4ae7c217feb89f116f7eb36059fbb8f6e4a6d2cc8d68aea79e8
SSDEEP 12288:mmw5HEjsChNVBFgl0WDm+CoLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcL2:/wu4OWBf9n1i99k32tY5cz84
TLSH
T1C965F14676A80CF9F9675239C997C536F7B2BC052A64DB1F4360C65B2F37320AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 4b904d2f22776ed561020e10c286103cca95f9b31aec6eb7a9d183751dbbff3f
MD5 a155c4ca526016ea2b7442f208f0feb5
SHA1 c69fc1eb7e0e8bfbcd9576f8b54c37a53e25d9ac
SHA512 a4661a887a06fc9956f1be638ae0f811bd3e84883f3ccaae34da061c4a365839fdc484a0dc4428c0473480a21b54fc6a0401439bada43ff02efd81066717fd3a
SSDEEP 12288:XeZ1IyTLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:uZuAf9n1i99k32tY5cz84
TLSH
T15E551257339860F9F223527DCCE18A94E771781967B493CF532446AA2F7AEE42C34722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7d07ba6978eabeba64e602fb76a12159462018b6719bd0cfdab439f1a4bd567e
MD5 a978da1fe31cb884005f208ef9b41ac6
SHA1 41bd03d1d2ef86575c90b424e13c3d1a8d6be448
SHA512 c004b479a66f7ec77bd2eabc39110ec84da83b53670d1cc043a4deade30ddad7d173d01183973bebca1d6421a76bbb847eb4a99ca4195bf1378b32757ab37062
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U2:xQRQyi36YOcPbLvw2gAf+PN3rEHGt4
TLSH
T1DD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 706b670eb9988091d228b42269a8051c920ed13c076c0914e299564395bc1f2a
MD5 1f4b037a054912fde8c60d22b0be14ff
SHA1 95c4a1a4560ec438fd3c174758271f43d37a12c2
SHA512 92be0122049aa0d9aecd5e6e4a08d85789e431dbf889d825f15c999823af33be5d7271cfc752839bcdb408b6a4a5496138d32526538c017dc5ed16fd5c114511
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U2:+QRQyi36YOcPbLvw2gAf+PN3rEHGt4
TLSH
T119667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 80502aee3898bfd00215b89f3d62431235ca951c448e6dd93dba3aaed61aca44
MD5 fba7b0ab22582a3e8338ab7edae39bd6
SHA1 64b49bcc133e07abc45e7dfbd28ee6289005a4a9
SHA512 3d644ac23a3b1803c3dd468a222219221fa2461526cbd487c5f6cdec875cf68f38f0161cbaaa179a2789b247f52440c92a384458f88f5a3ad9e55233bb1b1da1
SSDEEP 24576:dwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0wf9n1i99k32tY5:Z68Qg55nhceWu7PNU3/vln1i99ZG5v4
TLSH
T1E2B54933B2F600A9D44DE1769F4A873196E17C758FE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 db1dd4487782e9ec876fa7c6d4223c6a6f087aad344b06163e098dda81121a56
MD5 8f11ad53c3908893babac1549464e3b9
SHA1 cf6cd32f143d67ea3eab48cb1c48711f418b14eb
SHA512 bf608aedc2e9681c351113e1154b38ba20f61201cde312b703a9c878eeb0b1ddb1c0b70c0223de253c74cb227eae6f6f3ef5ebbf9d7e106d740ba9dba1f67f5e
SSDEEP 49152:i3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99Q:jy5112gYy5azzVvt69nLKnhZiEHGt4
TLSH
T15F167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3c84eca9bd73f0382e647b7838ea49678f00e1ab188c93b94306765238c53a30
MD5 5892b62ae0c0827d78c77b94ed2ca2a0
SHA1 185d9be7eb5136384b784849420d872bfff5e891
SHA512 18273a7033900e8ee3110bb44f8b2096ee4f4dfc4672de2667be52bf4d63f95104e40acb92155d48c25f38747e89bf4ee1a2b5d4bcad3a8452e578309a50fffe
SSDEEP 49152:+B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glfln1i99ZG5v4:su6Jmdxd2dFEHGt4
TLSH
T1BCD59D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4a99afe11b33d2de1df3249672b5beb304b0c6dee6d5170302ed70f0b9d9d4b9
MD5 9e010603b74c50f5997c73f050269847
SHA1 d30607ef7ddf7ddf73369a68f3eb087da39ea3ef
SHA512 c914b0ad348c200246e8579b9c23dc78b0e2a16a59c5cf582acd4b83c788c7d7eba3ca1ca5e1073d6d880187a6cd791d84e180b46fe9c4665d04289dab6fd274
SSDEEP 49152:h1hpsNoJpF1A63U44CwH7R4xJln1i99ZG5v4:hmifPWRQEHGt4
TLSH
T101B5BE13F29801E8D05ED17887569632EA72BC450B34B6DF0A90B7962F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 92eded5bdc40e519aacc1860e504b08146e506c9633ffe23cd681115dcdc8c5d
MD5 e2d6ee638fddf49ab4ce2a9f1d203297
SHA1 7457ac2a0732d20217d3b0fcf3ac698c10eea5c2
SHA512 6343741f6b80b2f362d61c5962db887b0a476f896bb7cf8d89dd1de205fd8c47d432e7b8c748d89002da3fd767d81109885e4a71606043323da1f88d3fa0edde
SSDEEP 49152:GSuZQIY0Be2KcRVtOnks6NMHqAln1i99ZG5v4:I5dKii61GEHGt4
TLSH
T151C5BF03F2E940E8E0BED6748B669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 934084911983da232a38458cf32df6ded982323fddf1f4b68709100d0fe2409e
MD5 0399784a89f1dc21718a7dfcf4c47df8
SHA1 17fc7c2fce9457acfe08d510c707c83b98f58ffe
SHA512 2c522d68bc3c65fedf6106f3f1160e4a7cc5e4bda2a4c24d743e99ff1a567a732fc5642f917cfaeec23914ddac9e1488027d5fdc70f8340bbbe5eccc9708deb5
SSDEEP 49152:/htSn8EApI0fig3giDn0AP5wFln1i99ZG5v4:uX2imphcEHGt4
TLSH
T1DB95BE13F2D901E8D05ED178C7468632EA62BC150B38BAEF0A90B7561E7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 01842fc68b28f093e359431f588b8d6cf19afda76f43d419ebb1eb7296142d7c
MD5 cbdc38d7fdbb5e83872f46d0a365cc2c
SHA1 d4c14bc70781e2b8eb2ba0b740db99b88b2eb596
SHA512 6c2277be491273c4aaffbd514f5944c6f040bb766210c2f8725453fb53c4e334ee3b02af10c94f99043690a6570972041fc32bfe5564ee2a867490526fceaddf
SSDEEP 12288:SYLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:Scf9n1i99k32tY5cz84
TLSH
T1AF452353F94882DAF21722BACCD5CDE4E97C5F0CF9E8A452E329265339FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 aac09850743a3bccbddb174c951589b4d9fef7e9ae13df09f794e9930605b4fe
MD5 c7284f91a6c5448d90603d6a64faa985
SHA1 2084cab103ccac231e2c73c273672a865473f53a
SHA512 faded2e2f81617a22bad5fea42daedd8f6d575aabb8299ae7d1816e745b8e9317da9a47ccab65c3114ffef7ccc5ecb7640b72ecdb9fc82becf74031a4a7494ad
SSDEEP 12288:NXLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:Nbf9n1i99k32tY5cz84
TLSH
T119452353F94882DAF21722BA8CD5CDE4E97C5F0DFDE4A452E329664339FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b9597c1dcbf5c2b97f8f5624badf271df137582550a35fdf71ee13cceb14bcc4
MD5 ec41ea9ee8d5222706596d2059be427a
SHA1 c409628356c546001e945e815682a7eb6c44df4d
SHA512 00793616e5b8edfe159d39447796687ada1bdb79d785346609f88ef5499b56e9cd712d5e41f8dbb0e3c7038466be3a1c2021f0b1e699fd8902d7db15b4471fc3
SSDEEP 12288:fxLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:fhf9n1i99k32tY5cz84
TLSH
T174452353F94882DAF21722BACCD6CDE4E97C5F0DFDE8A452E369254239FCE782010925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 dc32c5e3c566ea3dcf523def1e6c0ba6b76dd215dadd7a8a7064c95afc56af11
MD5 f1c585366fefefde038626a69ce5e409
SHA1 a26d9db7b9094da14663eb4391109c872a66e201
SHA512 500b885e05648d25502c697d7fc1293d95e70deca7011a8e82039c48d9eb3e7c0785c2dfa56c969eb15be3546a767e26329c932dcab8a2c8597074a3d40c3796
SSDEEP 12288:aVSLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:7f9n1i99k32tY5cz84
TLSH
T1C2452353B65841D9F523A2B9CCE2C9A4E6787E4CEAB4A59BD31019473DFCF782420B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a2bde546f2992a13898d068a219351679490f45bf30627c9f81c414c5d037d8b
MD5 125206926f05d7291a839505d9f1b933
SHA1 734f11eb1ebb638f276b75850295caeb105c0a92
SHA512 11e2abf1f22a016edec2ffcefd18c471de818d2cd4f1780a5e3c1348e3aeef62377747d690ac6a033ad0931774a58995d472b42bbee6f2c6dc306ef846c78dc7
SSDEEP 12288:9KLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:9yf9n1i99k32tY5cz84
TLSH
T142452353F94882DAF21722BACCD6CDE4E97C1F0DFDE4A452E369255239FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 52f0559007ab66e3fd1b794dd629175c433adf32a46b908c3d1025e3aa14b3fd
MD5 c40ca607dccf28c16e50ffa4ad3d02b3
SHA1 506ca6cf82e57f39d83568fc92b74d0c877b2c11
SHA512 ae37282084070ce2f14de844df110c2cf24a709a0bd68e7dda9b3bb798ba9b71826239f8f4ffc0b9af167283727766ef1abe8b588f458fd265942ed3d7eecc17
SSDEEP 12288:prLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:pXf9n1i99k32tY5cz84
TLSH
T179452353F94882DAF21722BA8CD5CDE8E97C5F0DFDE4A052E369664339FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 76a41d2051f4f0d19eb66919643e008f47793ef51f498a29f8ae151afb0bb415
MD5 60ccf93bb26470090b9f63da9ff33386
SHA1 9c2870b4872d070c29452db18d7f63edf4395da9
SHA512 921a82bdee0dd81bfeeeff3028efd59c69c98c5af700fc82ce43d385f68f3f1c8654248b67255aeefce9a58787294d38f3d8c54223ba7d73b66dea5813f542c6
SSDEEP 12288:wPLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:wjf9n1i99k32tY5cz84
TLSH
T129452353F94882DAF21722BA8CD5CDF4E97C5F0DF9E8A452E329665339FCE782010925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 e26d59e0fb4c0ad38d284a5b3fc94f34c4a48f293df8a9113fdaf68a4c9227d2
MD5 000a36a5e41a6b7999f65e3dba418ce2
SHA1 0f32b1f95ab8d429007814e1404bedd78285be78
SHA512 1d8b1b34c1c1db53838ca85f08b04558334f8958e761add46c40f8627030d112160f07950a0ff8ad39f3e1e6b3a6f969af56bddeebc4217a125f136016f37299
SSDEEP 12288:SiZwbVzzFEoS2cPvy3LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:1ZMRzFVSO7f9n1i99k32tY5cz84
TLSH
T1FB650195B39018F8EC67823ECC658D56E6B27C194BB0C61F03A436672F777A01C2DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 d6351c50bb9a5475e1385553b8821190adeb5f366fe7ebaa8d565ff19475f216
MD5 a39885a887a38bdc37839e415950a3c4
SHA1 8b387a4912357580e80fb5bc225326c87b5df1ae
SHA512 18ce6c31591f0d2e35f991fdbe9c24cd18c96d46b359622f9bb4f0fd465feee39ad27c541a1416d0e1cdcac485b2e4844273aa87a7979e4e77f56d0a0adbe9c3
SSDEEP 12288:ckLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:cQf9n1i99k32tY5cz84
TLSH
T16B452353F94882D9F21722BACCD5CDE8E97C5F0DFDE8A452E329265239FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a20f8478e15dda2feb751355e1bd4696ba59fa62693d1e9b2906717031221e2a
MD5 9e92bc8c7bb6bd90301b34e023074f12
SHA1 ecfcf4191ff09e575226497a82d40477229ec5cc
SHA512 975b8deacf3d514acdb35241d71b731b0d1ecc3b2f96a1fb25790c92e3852751488d70f91255219bef832660c6e4abac0a61d5a94e099bd8a475516e9e08ba96
SSDEEP 12288:+ALfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:+0f9n1i99k32tY5cz84
TLSH
T1D0452353F94882DAF21722BA8CD5CDE8E97C5F0DFDE4A052E329665339FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 e92f276f1d0ce04f71958ed184a5391df10a531a4a249f61c683c9d8f59effd4
MD5 cca92670cc43146d71acd29effb25410
SHA1 68be5b7ad930cf41a2b8b0b773ebe5dd9765b21b
SHA512 1cafeed4279ec8aa5a37ace7cbe48506f74813a927f0c3565cc754e087c9e19a384182d77599595383440a299ef5add911233ecfe541d4e4285877ceee5f2ba1
SSDEEP 12288:WyPz5L8TLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:rzyPf9n1i99k32tY5cz84
TLSH
T1B3551207B3A430F9E1279239CCA24E51F77578355B609AAF536007773E7BAA06D39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d70e7f8b4709f76ee502e8c4658ee72cd1c5e5a5794538ac9d6e567af4b487ec
MD5 7d06a32916626e5c85af09b2f5df4890
SHA1 696bfa1cd2586f010e232cf6e59a6af8258e6a29
SHA512 cf9cca996c811f01c8b3dca86fbfa4da0df56f23d0e10bc87f341803c72967d2279e4838c1b0d272af0050f3ee2091a84abe3999235cccbc46a59f6df471c70c
SSDEEP 12288:VkLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:VQf9n1i99k32tY5cz84
TLSH
T17D452353F94882D9F21722BACCD5CDF8E97C5F0DF9E8A452E329265239FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 a7baf9367a49a7e31790fb662a11b6ecc6e84f3717e05e629bd9431260ba4824
MD5 cc5de6e8d353ac6b2376fd9fe8890dae
SHA1 a920810669e4bfbe8e1d938f7e466c469c48e429
SHA512 6501c0e9b54ae71246305f9490fca615f2b15ee467867410aa65b4ff1e3425d1f798aea4713b75ca121bb54953afad91c2fc12dee3dc1d256b5e5f042ed20508
SSDEEP 12288:LkLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:LQf9n1i99k32tY5cz84
TLSH
T1D7452353F94882D9F21722BA8CD5CDF8E97C5F0DFDE8A452E329265239FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 949bd42a3df7dabccfa26bdf650cc0b916b0d138c071a158f2160a451bf805d9
MD5 670c0a463f1e9a1f9efbb02088320593
SHA1 9cddf6a39353747edb698707c0114d879a2109d2
SHA512 c9276e5e770a53f77f34f08ba5eefaf6c7a0ec8540fc3ba40c0a90fdbf57c97347c8bd1bdc7af03b0e9d90d1cd4a587501aaffa3a483f5a96aa457c6c3956066
SSDEEP 12288:ryPz5L8TLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:GzyPf9n1i99k32tY5cz84
TLSH
T1FD551207B3A430F9E1279239CCA24E51F77578355B609AAF536007773E7BAA06D39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 0388b59d767beb98f673ef6224c5df78fe7c8ea7192bb5f05b038f9cbbe95c8f
MD5 c44eb6ed7bc46e909e93c2cd14743ecc
SHA1 07bda95717d0cf4d1c5f796f5c8e90b99783024f
SHA512 fee4b74b76c0a8e0fcbd8d80885deb4eb39dcbea59f5df9058435b19282e18c727e18000cfb6f1331282110970a22d26a4dca418244a7c795df4096077414674
SSDEEP 12288:/Cd9CWYoaLHF3z0z04PDvhBLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcL2:qTDaLl3z0zDRf9n1i99k32tY5cz84
TLSH
T1C96501A5B35018F8EC27827ECC658956D6B27C1A4BB0C61F03A436672F777A01C2DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 ecb7ed95edec9972517ac08214819326b647f2ddf8d266b8b269f79509d623ec
MD5 64faec3c4241ab02579d6d9d69075440
SHA1 3cc2e063548d092e7f18293042ecc4a58c1fd6a8
SHA512 3181da1ce241b633542bdef2b1e86818785e3cbe10f785992d152a7a1e0f5d0e8c881e0a2a8c81c92fe2651c8431f56a9647a5a8dbfa1118646757bac7c35181
SSDEEP 12288:Ai4e7KRdTfgwCHKy7GLbbdIvuLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKJ:A3vd9CHKy7GZ9f9n1i99k32tY5cz84
TLSH
T11375CF91F3E810E8F1779A35CC768511DAB67C595B70DA8F03A4265A1F33AE18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 aabbd13974247657422ed1b75b181a26e70e6edfafa77b21801a961b5cb7529b
MD5 f1271371a2e026c86aa1d3a5e599a410
SHA1 12d9c53ccc23893aeffb11612244b242194ccd3c
SHA512 2ceefeb7f88a6d24309390e72c9d98220112f696d0e1d6587480255b7b006aa89ec104f6ccfa1827e643ff4bc8259319a8ad58e90fb6ae909a0ad6621dbadaeb
SSDEEP 24576:MfwvUk9RX6wkyAIEf9n1i99k32tY5cz84:oMnYIEln1i99ZG5v4
TLSH
T14385CF29EBDC44E5E177923C89B7460AF6B178581B31C2CF025A53AE1E37EE46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 07d810b4e51af0f21814b652a68b0bcf5427128f629c1c37197673ae505025b5
MD5 f99cb1672b62359fff6e33d70fb4deda
SHA1 1725e41f1a226d9df778769c2a550a3fea395c56
SHA512 ca882a435eeb33e56032230113b9684c201f4d52768f78f1029574fa7a427d19e229115ad099e8bd23f6a75182dbf35e0f25cc3086e26a232bd1b04440c4a6cf
SSDEEP 49152:7YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0lln1i99ZG5v4:eySzPLEHGt4
TLSH
T1A2066C96A16841D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 729ac9e8b3c1d168f42067b95c3e9acaea3502f09421262ecf52c5b228baddcc
MD5 498bb465f35873777afa1e041ff3b538
SHA1 329151bc91e26b01f204f64a70892cd848b44dac
SHA512 538b560449b6aaa1bdf028fa98bb3b85a1aebd359a18e2c373845495c40af3383940e71765e174e68378270835314cef9c7db2bc1c3ff3da9b9d2490366af5d0
SSDEEP 24576:m47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYLf9n1i99k32tY5cz84:m47JUQjTirIhCnDHUPfF/1ln1i99ZG5
TLSH
T1D065AE1EA3EC01E5E17A927889158A5AEA71782D1F31CACF1270837D2F63ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 41ea9a6a0d40ed896b37a789af940298e9a0a60e6f3c6ec38c561c82dab3297e
MD5 b187c2cb22c34917063101f79bdc7702
SHA1 2a49c0e365192f515f3c370827f1bb62ce17ac1a
SHA512 7b3ae13ba60e29c9e3fb3be45a3753a90bc55a51763a118dbd26de5a51207856625332bf1a7884344a2a8dfaa87c0ff8e307e6898e447f99fa37b58a4df8622d
SSDEEP 12288:Ybsf0LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:/Af9n1i99k32tY5cz84
TLSH
T12E55F11AE25802D8D02E6279CB958A40F3373C1997E0D2CB53D0F57E2F79AA45DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 634B
SHA256 4f9b2f699943dc7a42321fde879d884202e9b3bd8391519cc69bd83d8d485aae
MD5 4600ea83e72c40d5b6d25248895c4d66
SHA1 666d119fa0398adce7093f434fc15437ca6913c5
SHA512 08c1e1315bd3be50f47cce09a7b9c36aa38572495cdcbaa1053f6cc14af921437f3972c25d2d5c8df70a5b2e239a62d4cec6b3039de5b99e43b173eab4cb0bc9
TLSH
T108F0F41726E40254F1B72F22EBF990B357377C96AD2994BCA0D8031E48E1A45D5B27B3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
MD5 29f1b2d1b6f9290138596cf180847e53
SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
TLSH
T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 40decb1cd3726aafb3f4b94ae88f1bf0fefe7fb1e2976b4f41a8b591872c9a35
MD5 164d3840db168d925e03be9ddaba0fed
SHA1 1d39d488140af5d05941245d2750fb57786e22ec
SHA512 8195b0c2b9350c7d993738d2acd4ceef25c802939a059fda323b1e239b7d10b985dd13f6b1668387bf812536f9594186701cdc002b05c39598626e8298860dc6
SSDEEP 12288:MAUBNHNPI2ycu9J0V1SIPjK21OIN/IAD5Wn:MAQBIT9aPL1NNgAD5Wn
TLSH
T135551740B626D78FC6A940725E37D6CCAB70BD42EE05AF0372C8973FC476658B6B5281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 16KB
SHA256 8ab774689444a96b839156a4fd45d8743bec9dede100fb03e8f58690dffe26d5
MD5 4418912e950c2ee12250488b07f990a3
SHA1 b7ed50c840398bf9c8ee6787a905fffa4990df42
SHA512 2df1c8a3b8098ccb0217b59db4815d75438ea95ca91c4d27a3b304811ee1b0730a34f0492f64cb855708c38898e8442eab818c283ece560f4240cd8234b3c7fd
SSDEEP 48:MwXvFUREK0kENRu+UKnuJBUdZn4XUXAllKXAllYbYHRTfCyaUdZn4XUXAllKXAlz:Mn+LRTX2SZollPllfHRTwSZollPllV
TLSH
T1C772EE47F744F920EDA101B5CDA6E3E8A739F0A48E61436730CA36BDCC946498DAFE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 a30dab184d674bf5b95743e10a32c936e00e05fa0b62341b7d019660bcf5a4a8
MD5 c1d64f4210e69de2ed4039fddc7efa59
SHA1 b0eeeb7fdc364301c5681f732e4e73f9e696fce5
SHA512 0f31acc9953a716f3d7b6e9980169d746f7afd54bc6560fc4bb4e19341e53694fd3b894c6cb143e4e99c55f8e72612a2466b5c30eaed8cdb35d8f43b5579e1c4
SSDEEP 12288:GuEUdUpUOUxUkUTKT/wxLUOZ2rPNL7dJD7so/ESQk6Q598vhGysrgCVWq3nGXflQ:PEyahm/uLiVXn8ocwh6hGETaGPlQ
TLSH
T131553A00A5A7E34FC9BD9077523286CDBB78AC47F7452B0133488D3D986B56EB5E22D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 168B
SHA256 e4ec38338fc07553f8dfe2c6771504a0a71dd664b8b4c99e43ca5085f26d9be4
MD5 805aaba8d070d227fd4731acae5c3737
SHA1 9eda4f2880a915432ce357f2caff746f62b6c4dc
SHA512 51ee88048ea948ea026a5c84e4d8f9326175a789c82e89bd9e2e975cb9847894d74ddec2d596f012e483d923c97fbbfd26b7597b2f73f646b2666e7d4d4759aa
TLSH
T17DC08C0683FE50A917368080B92B3F9590D0B920CB49CA31B3303B07B3304038E1F878
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp5D2A.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp5D2A.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp8006.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp8006.tmp
Size 3KB
SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
MD5 ec946860cff4f4a6d325a8de7d6254d2
SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
TLSH
T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4585f0e80f8065e9a3526804378be56c3d0d1bab2ebb6651641f98c0e230897d
MD5 6046357a477be8408d66da76c56fcef3
SHA1 b46a828adbeffcad2490152cc37acf1f91329df7
SHA512 998f13726c8197b2b6983e4a0da8d1c97fc899e1539b15cd915d2cad61308cce572d4107ee6931eddb80dfc9e445e0280dfc47bf26ef7f7fd577424f6753e0a0
SSDEEP 12288:Fz7sLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:dIf9n1i99k32tY5cz84
TLSH
T11B452353F64C8599F13722B58CDACD74A53C6F1CAF94A4D3E315268638BCDF86830A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8d1326eab5fcc74bb2502b4fdec6180710336d734a20608cdc63247dfb3ca396
MD5 9910fc62f0b32444466cd8ee83091bfc
SHA1 64b5d20900968cc0e541c83c0d760b7374893dd0
SHA512 28c5e49479a92d7f26f2b1d5fdc44ac5be1e885e604406854a8329dabf6ea0a0e9dbff38b4341b1a728500eae04e3a4a9bbcd45b90ab04d080957872518d07d4
SSDEEP 24576:5gb6bmBIi49WNNFpg1rSvFv7bYWf9n1i99k32tY5cz84:5gb4mBIBhGFLln1i99ZG5v4
TLSH
T13D65AE1E22EC02F5E0F6E2B8CDA64417D6B278161731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 ba0973607c4ef15d41cc9d099e07093b9406b52a96129200b8d19b04f616d038
MD5 28f8a0eba1469eb8f16a59bbb816d082
SHA1 f273e9c3962cb8baa642695b2e8c8885c9e87bee
SHA512 aa8215b9b6c0a4226b3bbf4d68c351b4d6b5683c53feee1cf3dd740d9f90b6393684bb27d4ebee976b6ca2ac09d3b6a319bf78b79950e9096ca000678e19f344
SSDEEP 24576:rG88u8FpJqH1bzria7/m7f9n1i99k32tY5cz84:q7ZFPqVea7/eln1i99ZG5v4
TLSH
T19C85F165B7E001F5E477D13889864A63F6B1B8151364EBDF07A88B521F33AE40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c41d3390fbd9dac9e2823c016aa0370b1e21044a31cd276eba571e91a63efbcc
MD5 44fe44e38dd60a06abb1ba048d56a92f
SHA1 5b709a2805175b8d9f31776cafb7eb80d68f4f3a
SHA512 e80ec1e84601936469ee20a1b565d0c4b8f1d0bc55476af0577a3874d5bbbb4c34bd9d6d7fa0ed8e3d06ffa49c9cf6229ff1391eaba4fc864d3562cb9a054efc
SSDEEP 49152:lBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjXln1i99ZG5v4:uG05lO43bKEHGt4
TLSH
T173D5CF6E62EC11F9D1BBD17CD9C68A0BEBB23815033456CB02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d10ef9b8f7fd5e24fa7d6ec26bbee631cf660ff20d0509e7be4610d8e5912038
MD5 c57588d3683c058b6d476ffcc8d0e4b4
SHA1 486ab3167aaa2aae4856dcc3656832bf00c71194
SHA512 2a7090b92a4f11b263e4e57f5910f6e80cada1f4bcf1855a340bc3c8bf97aa4c5edb59a015263a3c8dcde7ec61f058fdb48ba62eb4d6597f27baea42c6f734e6
SSDEEP 24576:Ufa5POZ3dpuWVM50JicR2hG0lasx2+47eidnlf9n1i99k32tY5cz84:Ma5POZ3BJt2pasx2+mvln1i99ZG5v4
TLSH
T1DD65BF5EA6FC01D5E179D17DC5838A1AF5B1342553319ACB022182BE3F2BEF89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 41e89cf66a2a8b860bad9b51c45f8e608617559ca9d7dacd780c5244d4675197
MD5 b3e95fcbd152aa8c10597544edd92c5e
SHA1 a87a4f9b9050bcdaed0cd49ada0527a3facd2533
SHA512 bca8df556ef3ea0e9bbc3210f47965ba11e795db021024488519ddf22e7175e23fd11acf65f0b3f8f6d0c4d85979f4f8f81992a553e4f1bccc06f0a9f12207b4
SSDEEP 24576:/NcwHdjbyQ4nLC18lb/EOjowL7FkTf9n1i99k32tY5cz84:/Nc/zEOVHF+ln1i99ZG5v4
TLSH
T178858C1623E901E4F1BBE1BE89779946FA717869573086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2c1c72e1678ddd06981d6279ddf161a918c659fb1dc080728dd9d80bbef66b14
MD5 6fdf896dc81dab36731949026e54bc8b
SHA1 e3b078fdddbfa330047cf8655fd8609419659e2e
SHA512 cd9ff65f44eea1e5260d35fc64af04278246ac38b38be466044b9e1ad70ff47544ab62e3156b33cfc477d747aa477bae2ac9d6959a4968f22bde9dc2f02c3f0f
SSDEEP 24576:FTkNvNnaFeYhJNtmZBm7f9n1i99k32tY5cz84:FTMwBtOm7ln1i99ZG5v4
TLSH
T18F55AF2EB6B846E4E1BEC6B4CD238512E6727461173293CB9390C13F1E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 77a9c31c9557c8e07f78a9d5536fd0e27cb177ad86eac6fd3ace7ffc00c17e2b
MD5 c8b8b568f1044eb840d07f98f73f4cc2
SHA1 1f916c33e83e02f9ff9ab6a89f5c3ee628b6ed80
SHA512 ac2e7a25172f24bed0b807d6cad395ea2be6850d8c5b3d013f49792c0709e986abcd11f34942d6f812528dc536880d919aa1c843c8c4937e2a14f02d78a40700
SSDEEP 12288:+HvUrBFrEjwaQbLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:+PUr+NQnf9n1i99k32tY5cz84
TLSH
T1CF65E12F72AC18E5F636A17D89828619F77178661751E2CF02E0817E1E77EE87C39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 999f0b62a30ef14103349cf5104ad8308b5910e91e065679924198752fc2c173
MD5 f2633822d0caecec2e2c0cca2a23b31c
SHA1 a16c0e43a641f6abd5d1c3886ff09e692fb37783
SHA512 e381710148fb0a1d5a31bed70e340616d19b41d4c138458b015884f83162b2242f1deaffd678b46de7d0e11f38943cc5008de2e985290c98a051ef1b335917a2
SSDEEP 12288:tQcMxWDXN1Dp/fshBItT1IQgA4LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5cz8:hD3FHshBIYQgA8f9n1i99k32tY5cz84
TLSH
T15D75E17EE65C04E4E57BD1BCDAA38A06E77138AD032165DB029481B61F6BEE43D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1952-191-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1952-197-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1952-220-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1952-222-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1952-190-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2132-156-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2132-158-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2132-164-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2132-217-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2688-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2688-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2688-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2688-215-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2688-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3484-202-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3484-20-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3484-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3484-14-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3484-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4060-237-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4060-225-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4060-226-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4060-234-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4060-232-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4384-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4384-40-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/4384-53-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/4384-45-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/4384-127-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4492-168-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4492-174-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/4492-218-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4492-169-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/4780-178-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4780-219-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4780-179-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4780-185-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4780-552-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4780-553-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5004-0-0x0000000000400000-0x000000000062F000-memory.dmp

Download

memory/5004-6-0x0000000002520000-0x0000000002587000-memory.dmp

Download

memory/5004-8-0x0000000002520000-0x0000000002587000-memory.dmp

Download

memory/5004-1-0x0000000002520000-0x0000000002587000-memory.dmp

Download

memory/5004-153-0x0000000000400000-0x000000000062F000-memory.dmp

Download

memory/5124-55-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5124-216-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5124-52-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5124-150-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5488-598-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/5488-592-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/5488-536-0x0000000000400000-0x00000000005DB000-memory.dmp

Download

memory/6072-437-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6072-241-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6072-242-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6072-248-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6084-223-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6084-211-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/6084-205-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/6084-203-0x0000000140000000-0x000000014027D000-memory.dmp

Download