149139bd0f999bc89dd4669518b748c6bfca78eb921c1ebd437641224b1d4f5f

Analysis

max time kernel
144s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 11:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_837cbcc63d0995728e18f0c796086a0c_elex_rhadamanthys_stop.exe
Size 992KB
Sample260804-m59d3saa48
SHA256 149139bd0f999bc89dd4669518b748c6bfca78eb921c1ebd437641224b1d4f5f
MD5 837cbcc63d0995728e18f0c796086a0c
SHA1 e1896b3935b99b6e671ad02390b8168a98250d63
SHA512 afe9ed33566da269ad9d0187177f39e81701490f6f411157824e58bb4138da82b1034dc40eadaa517dc03194f09c207a69c44d92d7575a5153483c423d631b79
SSDEEP 24576:od1Dd70iTWCDZKB2DOdyyEe/Tw7RvojeH6zUe+YZb:IDd79WC2sY/Tw7RSeazU1S
TLSH
T19B25E01037D0C035F1B329768ABF9724656DB8B15FB885CF9388166E4E70AE1EA3471B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
4136	alg.exe
3488	elevation_service.exe
1360	elevation_service.exe
2960	maintenanceservice.exe
5332	OSE.EXE
5944	GameInputSvc.exe
4504	GameInputSvc.exe
4404	msdtc.exe
5340	PerceptionSimulationService.exe
4140	perfhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_837cbcc63d0995728e18f0c796086a0c_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_837cbcc63d0995728e18f0c796086a0c_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_837cbcc63d0995728e18f0c796086a0c_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8db0655a24febf98.bin	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Backup	AdobeARM.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_837cbcc63d0995728e18f0c796086a0c_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_837cbcc63d0995728e18f0c796086a0c_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4728	2026-08-03_837cbcc63d0995728e18f0c796086a0c_elex_rhadamanthys_stop.exe
4728	2026-08-03_837cbcc63d0995728e18f0c796086a0c_elex_rhadamanthys_stop.exe
4728	2026-08-03_837cbcc63d0995728e18f0c796086a0c_elex_rhadamanthys_stop.exe
4728	2026-08-03_837cbcc63d0995728e18f0c796086a0c_elex_rhadamanthys_stop.exe
4728	2026-08-03_837cbcc63d0995728e18f0c796086a0c_elex_rhadamanthys_stop.exe
4728	2026-08-03_837cbcc63d0995728e18f0c796086a0c_elex_rhadamanthys_stop.exe
4728	2026-08-03_837cbcc63d0995728e18f0c796086a0c_elex_rhadamanthys_stop.exe
4728	2026-08-03_837cbcc63d0995728e18f0c796086a0c_elex_rhadamanthys_stop.exe
4728	2026-08-03_837cbcc63d0995728e18f0c796086a0c_elex_rhadamanthys_stop.exe
4728	2026-08-03_837cbcc63d0995728e18f0c796086a0c_elex_rhadamanthys_stop.exe
4504	GameInputSvc.exe
4504	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4728	2026-08-03_837cbcc63d0995728e18f0c796086a0c_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	4136	alg.exe
Token: SeDebugPrivilege	4136	alg.exe
Token: SeTcbPrivilege	5944	GameInputSvc.exe
Token: SeTakeOwnershipPrivilege	3488	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4672	AdobeARM.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 4672	4728	2026-08-03_837cbcc63d0995728e18f0c796086a0c_elex_rhadamanthys_stop.exe	90
PID 4672 wrote to memory of 3856	4672	AdobeARM.exe	98
PID 5944 wrote to memory of 4504	5944	GameInputSvc.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-03_837cbcc63d0995728e18f0c796086a0c_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_837cbcc63d0995728e18f0c796086a0c_elex_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    PID:3856

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4136

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1360

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2960

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5332

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5944
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4504

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4404

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5340

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4140

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:2660

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:2424

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:5092

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:5784

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:2780

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:5040

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:4704

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:5764

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9c493d5c39aa59200a4db15d7438563217ef697c66ce4dd213d011f87ed76c35
MD5 20c7e04fdc3be081944a7bb0a921f956
SHA1 bd967d141b70bce411b9108c11c29031bc18e702
SHA512 a8e023ffc38156dac441c0e2243159afe18ba376660264655c556a2bfb06d3a5971c3c17119598a79d27ed295a090ddb3d2acca72c5d8f9d1b1bae18dbbdac94
SSDEEP 49152:gb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnmsY/Tw7RSeazU1S:K3q6gjBBDKSeazX
TLSH
T13DD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 37af97b2c33fec7df1ce713ca89d2639f2cf5d7a1c494d07d9411833666bc297
MD5 02bcab46d47bdc3d799d71953f3c0b6c
SHA1 68fe287c4724472c73131d847bd563836171b6c0
SHA512 1dddaadffb864cb22e3ff073d3d25cbbb9ea5289bacee3bf10eeb1a8ae5694c47cd794d24e213f44e4afe1c55ed9fc76ccfe5c60360adea5157ef7e10e2a840d
SSDEEP 24576:7XYLGtczAwKB2DOdyyEe/Tw7RvojeH6zUe+YZb:ntcisY/Tw7RSeazU1S
TLSH
T13505F12867E408F9EDBB817CC8A28502EA73789547B0E68F03E499754F237C85E3DB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 004cfec9c60792809f1e3772ac5e8a9007c8a5319d79afd50bb5eae9c9181c62
MD5 ed853a37d497d5596442d8257c0fb44c
SHA1 fb6efc626e53f82d7922f0d47bd72c9084ae6475
SHA512 1fac4237bcb130b5640d163c1389ca64245f7c6188b295c438b9f368b1163156f13ddb0dc16f326b5fa3c601fab09d4ceb06efbd771a8bac5da242938c1915d7
SSDEEP 24576:Owu+OWLKB2DOdyyEe/Tw7RvojeH6zUe+YZb:OwlOLsY/Tw7RSeazU1S
TLSH
T10505F14577E40CF9EABB853885978136F7B7B8512A70DB0F0760C66B5F23251AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4fc3b048cd93529ef106900b997a136bad875cef2ef8dcab12aeb6727041e04a
MD5 0921d4659030ed9a3020acae61f03dcd
SHA1 80d5b90a455213b75ce4018ca615b0a0b686110c
SHA512 41c1b214dd55e89801414916f10acd7ee685c41605e57ef2f4c9cefcc9d726948d4d44133151e6b04a5d495868fbf13bcde9c45b8e4580ff463033882cf266d6
SSDEEP 49152:XB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glCjsY/Tw7RSeazU1S:5u6JmTxd2dEDKSeazX
TLSH
T179D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
MD5 29f1b2d1b6f9290138596cf180847e53
SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
TLSH
T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 178B
SHA256 f20eb3d055db25679f3b89e68bff9a38b427052a28c95b36c70bf1f3d0eb8b4c
MD5 61cc283a10be9fe4c492527d34733dc1
SHA1 6bd7296891a05577b95a06895a56e56e38b3517c
SHA512 dcef3ef710f1523ace55d6fcf1e63732433094d2a8fa9a7661fad29674200429d1787b5234b1c4355775ff2fc784a71f0b702fd8e7b27ba62554e76e73a2a11c
TLSH
T168C080375F7F50594F27004CB5052F5359837751CF414528B2307706F6D04010957C1C
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp9987.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp9987.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

TmpB29F.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpB29F.tmp
Size 3KB
SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
MD5 ec946860cff4f4a6d325a8de7d6254d2
SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
TLSH
T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
MD5 SHA1 SHA512 TLSH

Submit Download

TmpB2BF.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpB2BF.tmp
Size 3KB
SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
MD5 fc2430057cb1be74c788f10c2d4540c8
SHA1 cab67ee8d5191fbf9f25545825e06c1a822af2f2
SHA512 4e2b9709a9e3ca5173abb35816e5a0aebbf2a7aaf971d7f75f3ae66e4a812cbade103baa5016525f5ab83a60c18f8d3c278c90ff83e4afdae419f81673cb5aee
TLSH
T1FC71D8CE0D1A6813ABC7FE8AA1C5E3695C30A3E16AD154CB08BC95824FC6FC51A4901D
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 fb20a47fa275f6f6252971879cd3c760a2dc962d8bf0d51c6b9352722e212ea1
MD5 4ed42fcb3fedf6b85a1443b241f158a0
SHA1 2b0de0fad64ae66694cdcb12da2c3e86d659e5f8
SHA512 deca0fce5320be7ddfbc6990e19d4a768372723565709788851f3705e167c2c67b991f51966d15f0341a94fba63d583373f7640711d28b1714e50694260ab4a4
SSDEEP 12288:ce7VncPsK2DRkdn9LA6VxCXQrUxe/Tw7ogvojeH6zUlfvo7KYFKeb:/VKB2DOdyyEe/Tw7RvojeH6zUe+YZb
TLSH
T1AFD423218BF85829F3FEA9B064AF0106763F69E98AF0D48F884665754632DC5EF7C40D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 966b9db20802b526d9afb3028a151b51d31074d6e28c7314cf9c9b7d6d7f2439
MD5 b68c92baabfa2a9b916b77c5f3cd2e3f
SHA1 c6a4c73ba64e2464ef3f1a6d9e192d99c3f61be0
SHA512 e3d44ff663a5c51e2d52c9b6c91ce4d9798f9b15a95d638d10c4fda377399e70a55a19c8cc5ff1418ffb10de9dae734c5c353851edd5b2553548c1b44d9ae0ff
SSDEEP 24576:Zgb6bmBIi49WNNFpg1rSvFv7bYaKB2DOdyyEe/Tw7RvojeH6zUe+YZb:Zgb4mBIBhGFysY/Tw7RSeazU1S
TLSH
T18765AE1E22E802F5E1FAD2B8DDAA4417D6B278160731D2CF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 90a45941ca0328b9501d6b24c1a7131e77a04c2ed47f960e1122e7bd0135c4ef
MD5 d8dce8855993d53e7f9539b05006ab35
SHA1 831e1d680dd094e9e81c7572668097b4c30983ed
SHA512 e0c577b435bd7d0b7b069f5bcca23f53d8933e4cea52a57e0f0a29e20a7fe5fa46fa92673c5440d6fc8fef9dfcaa86650988eb44dd2001176242358c837dd4f7
SSDEEP 12288:e6GOncPsK2DRkdn9LA6VxCXQrUxe/Tw7ogvojeH6zUlfvo7KYFKeb:dGOKB2DOdyyEe/Tw7RvojeH6zUe+YZb
TLSH
T160E412282AF464A8D7BED6B894B60503B97A35E497F4E4DF08D1A5758B22DD0B73CC0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 2193021713af4907ad17e372e15478522e9d6359247b01618dcbaabd8f6e6fa0
MD5 95261971765994f8243b006fd468e46c
SHA1 1369d07a0a3352e28ea9a9701d7d543bf441869a
SHA512 62dd0b2db5a39f29a14e02b0a606a4248d59c9ce5f32a241c0279a2fc66457a6f1878bcf0918a55e9bf57de6c55135b592f86953989350f13be5f9c209d3e864
SSDEEP 12288:XpncPsK2DRkdn9LA6VxCXQrUxe/Tw7ogvojeH6zUlfvo7KYFKeb:XpKB2DOdyyEe/Tw7RvojeH6zUe+YZb
TLSH
T104D423504AF4986DF3FEA9B4A4AB05027A7F59E997F4D4CF489261318317DC6AB3C80C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 b0b8b01d92c346e953fae0502372f96a6d0a1f2a6d2730faa6a7e429e3b7bf8e
MD5 4241881a708101f3828e8773bedff694
SHA1 c2a6fc1a349066e9d5d9e7d8c5d9c433c3b8f805
SHA512 99609041a3d24251e795f4840b44b2439dcacbb1b504e08dc77952417c76977a4f1289410406d256874d34526ec6b4c10ca4ccf9734e559936a01685b49d6a82
SSDEEP 24576:E378U8+VJqH1Mzria7/mlKB2DOdyyEe/Tw7RvojeH6zUe+YZb:egb+LqVra7/lsY/Tw7RSeazU1S
TLSH
T13535016577E001F0D47BD13889864663F6B2B82503B4EFDF06A88B611F23AD54B7EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 67fadc8b79c720650aabde075a61297e38bbe7de0d220c6c5112189ce9d14af9
MD5 68dcd4b92b3a82a3be147ccc4b846b82
SHA1 2e0763e8fa7312b5929431bf1c0263d50ce905d5
SHA512 7aea9ad1ecc46926055aaf76ae20586f0e1735274fb792c712ad214084c00d4bb8652a292255682568754e79ec7be55a7c02c9c6b2159d8f4d6f3b2c7099b577
SSDEEP 24576:sPUr+NQ+KB2DOdyyEe/Tw7RvojeH6zUe+YZb:sJQpsY/Tw7RSeazU1S
TLSH
T1D005E12E66E818E5E77AE17C89864609F772B4620761D1CF02E1817E4F23ED8BD3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 c794fe553cd0d4174b0cd98c336a5dec6173d514653f96c0d947589d6b9cd7e1
MD5 40a178f75f9af79126642342cefaff0d
SHA1 37c26053a8759c50dba9319580cea83f565e7e2e
SHA512 d42f5910f280d84a34842d1e4dddaf18a91e0c31c06e64f1cc1cb12c702a29a877723cec12bfde304b787bb4109aeaed5ae7e8aa1cb04e36cdbe9eaec7e2fd72
SSDEEP 49152:yBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjqsY/Tw7RSeazU1S:9G05lO43b3DKSeazX
TLSH
T133D5CF6A62EC11F9D1BBD07CD9C6460BEBB23415033556CF02A486A91F27FF4AA7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e97524ee724e4509bc496c297001e21a702f9064a08b5215d9a0c776011b7aff
MD5 7deb41e2cdcefce7df708f0c1f6b1f0d
SHA1 fd5f125341ae7314fbe5fded1f842b0b85b2058f
SHA512 d5c4df96d0a117b20a98185700c57a479d068ddd5de2dbceb0dea16fb682946024c843e349e3567ba5c89118e80e7b767ea1e50125648f9f786a550d257985b4
SSDEEP 24576:rNcwHdjbyQ4nLC18lb/EOjowL7Fk6KB2DOdyyEe/Tw7RvojeH6zUe+YZb:rNc/zEOVHFqsY/Tw7RSeazU1S
TLSH
T1B7858C1623E901E4F1BBE1BE89779546FA71786953308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 a6d572f87eb585c8f38b44d86b1112b036f3d82e413a6e70d81882182c018f7e
MD5 f5dca977d51326ab0da1d271a0441d80
SHA1 a152a4dce926d617de25327adfa7bf59e409c6cc
SHA512 b93ec742e18fa9bf31c52a4ed1faea4d8851432f8e97942e069b2d33dc88e1bbd2cbe4cca95029e8216dffa4822b8ebab55e1d3b9035450b73953c02171ad9cf
SSDEEP 24576:6JnJPbzB4SIKB2DOdyyEe/Tw7RvojeH6zUe+YZb:6JnJv6SjsY/Tw7RSeazU1S
TLSH
T1E015D03DD2A810E8E4B7C2B4815A175AFF31387D2B2569CB19B4D5343F12ED0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 213KB
SHA256 edbffec3da95877cf278688cc6087714dd0d5ee0a1bbc0ff2deaae32bb7815cb
MD5 fde049e2f76a3717da88854810c06120
SHA1 ad98955aee1998f8357392aafcf98bc9331c660a
SHA512 e204e3708b190d7d5099ed4e3aaf366af5888ba9db201fea6b98b314344208962ba8900c785f25aead62870e1d31e98852ee7481e2250788ce4666464eff309d
SSDEEP 3072:hAI9AEkvVUAFx4pw0dYkmjZ9wAnDgnUhyKXNNYCtZpuxv+jwvkVH:xDkWAFxyw8YkmjvwHGy0NNYMav+jx
TLSH
T17A24F81DE3A681D9C8B9C0B0C70A6227EB317C28573476DF9F95CE769F25AE16138E01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 21ecfa7f860dbf220590b7ae9f8b70bffe3413911af3d8e6ac5363cd4bdc58d0
MD5 d3039ea295e2225343484795684b4a52
SHA1 341c23bcc4d248c15cc03be44a819d2585c27432
SHA512 ba09fe4220b378f7a87ca7ef60f81a47593e18d7ed86ab21c252de3b20bbcc855e732702abe26ed4990b9f7976635e762142742caa1a7026491462ebe3da5a61
SSDEEP 24576:26DIRKB2DOdyyEe/Tw7RvojeH6zUe+YZb:26DIKsY/Tw7RSeazU1S
TLSH
T197F4015C23BA10F9D2BBD07DD5930502E2B6B4B587A299CF0A94C5794F63EC8BA3CD05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 e65a97958fd43a56a98dd1d7377d360b191db4c27afbe147ee1aaa0086f9b596
MD5 c5811a51f44d126378e0f3a7e98710fd
SHA1 1079ed6c9006af2cb743801d62a5953affcdf1f5
SHA512 66ae63e7558cc0fd6e6ffa0bd21c45f28fb62f777acc4498bca9924d768a8b8e2942c6bfcc59ea69aed69068e29b594a22a43cf23f597e9290e61074c3c7669e
SSDEEP 12288:fG6kyIncPsK2DRkdn9LA6VxCXQrUxe/Tw7ogvojeH6zUlfvo7KYFKeb:utyIKB2DOdyyEe/Tw7RvojeH6zUe+YZb
TLSH
T102F4120057E464A8F7BE557899B70151AA3ABC649BF0D2CF4491E63E5F32FC0BA34B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 61a73e17e283e93371cea09345e74618cbdb06731cf03f70cf26bb1233ae6d19
MD5 25ffa5b5d99d04ebb2cc12f6f199e56b
SHA1 dc437cb0e50178dbb257043300ab4ac121203a6d
SHA512 a4078673697c6f5b1d5dc88d4d41e41400224c090f537e57d9222d697a215b01cc2c86f593b60422521c0b688aba12247c97fa7c269c7453e62c71f86d552938
SSDEEP 12288:kUYncPsK2DRkdn9LA6VxCXQrUxe/Tw7ogvojeH6zUlfvo7KYFKeb:3YKB2DOdyyEe/Tw7RvojeH6zUe+YZb
TLSH
T164D423545AF46468E3BEA9B464AB0602A17F79F94BF5D4CF48D2A5318723DC1AB3CC0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 98dd76278975d7dfd2c476adce90eb5be2bf8ef9816eccf590868b2f65f9afc7
MD5 b3a0d2a62a2cd22cad95c7d1191f34ec
SHA1 44922e84bb0d028859becf0b13f9d9a09f44deaa
SHA512 fe228de61e7fd3af14799f57fc7c3f4a1c48f8387ed103f45c138b0fee567183c0c9d5fa7ec0c238d3244d78ef78b92260c0a053ff02e3784f8f4d001b2fc2d4
SSDEEP 24576:FcgILoTfaidZPKB2DOdyyEe/Tw7RvojeH6zUe+YZb:igHTrZ4sY/Tw7RSeazU1S
TLSH
T103558C1DA7EA05CAE2B2D679D8721493D633B4315772C6CF2448C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 92ebc4d941979219cda8b777db390d1684b8f0806f823433484c78267bd19d1a
MD5 106ac88b3bbb0d2e28f67f4d2dd36b8a
SHA1 06afb6023433366ab46c511db85909568f623f5f
SHA512 4e6f3b8ff177046afa80f155380a6e3ae385e77e94c4627c28a80f116c81612fd46a91fa683bdbf6b93aecfac3741b265b39cc721c3e184f82c24162422518d8
SSDEEP 24576:VTkNvNnaFeYhJNtmZBmsKB2DOdyyEe/Tw7RvojeH6zUe+YZb:VTMwBtOmnsY/Tw7RSeazU1S
TLSH
T1F455AF6EBAF846E4D1FEC6B4DD238512E6727461073292CF4290C13E4E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1172-623-0x000001EBEB980000-0x000001EBEB9E6000-memory.dmp

Download

memory/1360-125-0x000001E4A0000000-0x000001E4A012C000-memory.dmp

Download

memory/1360-127-0x000001E49EF60000-0x000001E49EFC6000-memory.dmp

Download

memory/1360-126-0x000001E49EF60000-0x000001E49EFC6000-memory.dmp

Download

memory/2424-556-0x0000023285540000-0x00000232855A6000-memory.dmp

Download

memory/2424-555-0x0000023285540000-0x00000232855A6000-memory.dmp

Download

memory/2424-561-0x00007FF60A5A0000-0x00007FF60A64D000-memory.dmp

Download

memory/2660-547-0x000001EC469D0000-0x000001EC46A36000-memory.dmp

Download

memory/2660-548-0x00007FF69B590000-0x00007FF69BCD3000-memory.dmp

Download

memory/2660-549-0x000001EC469D0000-0x000001EC46A36000-memory.dmp

Download

memory/2780-585-0x00007FF77D790000-0x00007FF77DA32000-memory.dmp

Download

memory/2780-586-0x00000252A6D80000-0x00000252A6DE6000-memory.dmp

Download

memory/2780-584-0x00000252A6D80000-0x00000252A6DE6000-memory.dmp

Download

memory/2960-141-0x0000027805DF0000-0x0000027805E56000-memory.dmp

Download

memory/2960-135-0x0000027805DF0000-0x0000027805E56000-memory.dmp

Download

memory/2960-134-0x00007FF6E2A70000-0x00007FF6E2BD7000-memory.dmp

Download

memory/2960-136-0x0000027805DF0000-0x0000027805E56000-memory.dmp

Download

memory/2960-143-0x00007FF6E2A70000-0x00007FF6E2BD7000-memory.dmp

Download

memory/3488-117-0x0000021052300000-0x000002105242C000-memory.dmp

Download

memory/3488-119-0x0000021052260000-0x00000210522C6000-memory.dmp

Download

memory/3488-118-0x0000021052260000-0x00000210522C6000-memory.dmp

Download

memory/4136-17-0x000001FF376C0000-0x000001FF37726000-memory.dmp

Download

memory/4136-18-0x000001FF376C0000-0x000001FF37726000-memory.dmp

Download

memory/4136-16-0x000001FF376C0000-0x000001FF37726000-memory.dmp

Download

memory/4136-15-0x00007FF7AD370000-0x00007FF7AD492000-memory.dmp

Download

memory/4136-133-0x00007FF7AD370000-0x00007FF7AD492000-memory.dmp

Download

memory/4140-622-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4140-535-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4140-536-0x0000000000800000-0x0000000000869000-memory.dmp

Download

memory/4140-541-0x0000000000800000-0x0000000000869000-memory.dmp

Download

memory/4404-601-0x00007FF685ED0000-0x00007FF685FE9000-memory.dmp

Download

memory/4404-516-0x000002CF2B0D0000-0x000002CF2B136000-memory.dmp

Download

memory/4404-514-0x00007FF685ED0000-0x00007FF685FE9000-memory.dmp

Download

memory/4404-515-0x000002CF2B0D0000-0x000002CF2B136000-memory.dmp

Download

memory/4504-508-0x000001D01C130000-0x000001D01C196000-memory.dmp

Download

memory/4504-506-0x00007FF793F40000-0x00007FF794008000-memory.dmp

Download

memory/4504-507-0x000001D01C130000-0x000001D01C196000-memory.dmp

Download

memory/4504-592-0x00007FF793F40000-0x00007FF794008000-memory.dmp

Download

memory/4704-604-0x00000181A38F0000-0x00000181A3956000-memory.dmp

Download

memory/4704-609-0x00000181A38F0000-0x00000181A3956000-memory.dmp

Download

memory/4704-613-0x00007FF79BFA0000-0x00007FF79C2C0000-memory.dmp

Download

memory/4704-603-0x00000181A38F0000-0x00000181A3956000-memory.dmp

Download

memory/4704-602-0x00007FF79BFA0000-0x00007FF79C2C0000-memory.dmp

Download

memory/4728-1-0x0000000003390000-0x00000000033F9000-memory.dmp

Download

memory/4728-0-0x0000000003210000-0x00000000032A7000-memory.dmp

Download

memory/4728-6-0x0000000003390000-0x00000000033F9000-memory.dmp

Download

memory/4728-7-0x0000000003390000-0x00000000033F9000-memory.dmp

Download

memory/5040-594-0x000001B79B7D0000-0x000001B79B836000-memory.dmp

Download

memory/5040-593-0x00007FF787610000-0x00007FF7877A4000-memory.dmp

Download

memory/5040-595-0x000001B79B7D0000-0x000001B79B836000-memory.dmp

Download

memory/5092-564-0x0000021FB4A30000-0x0000021FB4A96000-memory.dmp

Download

memory/5092-565-0x0000021FB4A30000-0x0000021FB4A96000-memory.dmp

Download

memory/5092-569-0x00007FF7C78E0000-0x00007FF7C7CF6000-memory.dmp

Download

memory/5332-146-0x00000201926B0000-0x00000201927DC000-memory.dmp

Download

memory/5332-148-0x0000020192910000-0x0000020192976000-memory.dmp

Download

memory/5332-147-0x0000020192910000-0x0000020192976000-memory.dmp

Download

memory/5340-529-0x00000283D59D0000-0x00000283D5A36000-memory.dmp

Download

memory/5340-526-0x00007FF724E00000-0x00007FF724F49000-memory.dmp

Download

memory/5340-528-0x00000283D59D0000-0x00000283D5A36000-memory.dmp

Download

memory/5340-612-0x00007FF724E00000-0x00007FF724F49000-memory.dmp

Download

memory/5764-614-0x00007FF74DAD0000-0x00007FF74DD5A000-memory.dmp

Download

memory/5764-615-0x0000018B882A0000-0x0000018B88306000-memory.dmp

Download

memory/5764-616-0x0000018B882A0000-0x0000018B88306000-memory.dmp

Download

memory/5784-575-0x00000191DF010000-0x00000191DF076000-memory.dmp

Download

memory/5784-574-0x00007FF69A9C0000-0x00007FF69AA73000-memory.dmp

Download

memory/5784-576-0x00000191DF010000-0x00000191DF076000-memory.dmp

Download

memory/5944-583-0x00007FF793F40000-0x00007FF794008000-memory.dmp

Download

memory/5944-499-0x000001EB9A300000-0x000001EB9A366000-memory.dmp

Download

memory/5944-497-0x00007FF793F40000-0x00007FF794008000-memory.dmp

Download

memory/5944-498-0x000001EB9A300000-0x000001EB9A366000-memory.dmp

Download