49e2a315525531344de3e06129b66aec775354af1dc54a4a5b110a5151a264eb

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
Size 1.6MB
Sample260804-stxtsshm3w
SHA256 49e2a315525531344de3e06129b66aec775354af1dc54a4a5b110a5151a264eb
MD5 6f83f77689b349e03b2307abebb8e0a7
SHA1 1a1beb3faefd941792abb6fea3791d5271a48830
SHA512 9330c81ea79101573eb514c5b43f7af3163b18056311dff3a4b29fa3ed4b7d5ebda750df5a1b4151d30ac83300b4d051f06cbf42a2a7d72ba4c0ffa1b75ea91f
SSDEEP 24576:ULv5qMr1nD//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:c5qM7LNiXicJFFRGNzj3
TLSH
T1F275E01077D08036F5B324764A7E8629956DBD715F2181CFB3C02A2E9E70BD1EA31B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe

Executes dropped EXE 22 IoCs

pid	Process
4756	alg.exe
1528	DiagnosticsHub.StandardCollector.Service.exe
1808	fxssvc.exe
3456	elevation_service.exe
2436	elevation_service.exe
4524	maintenanceservice.exe
260	OSE.EXE
3012	msdtc.exe
2564	PerceptionSimulationService.exe
1232	perfhost.exe
4828	locator.exe
1184	SensorDataService.exe
4968	snmptrap.exe
452	spectrum.exe
3296	ssh-agent.exe
3804	TieringEngineService.exe
2336	AgentService.exe
2012	vds.exe
4408	vssvc.exe
4848	wbengine.exe
2356	WmiApSrv.exe
632	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a9a1a489f77cf242.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b10231c12524dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004de6d7c12524dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000812b19c12524dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000003f2dfc02524dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004a703bc02524dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002bdeebc02524dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a3c373c12524dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000529c8bc12524dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c63e0dc12524dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000076f944c02524dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
4332	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
4332	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
4332	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
4332	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
4332	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
4332	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
4332	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
4332	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
4332	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
4332	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
1528	DiagnosticsHub.StandardCollector.Service.exe
1528	DiagnosticsHub.StandardCollector.Service.exe
1528	DiagnosticsHub.StandardCollector.Service.exe
1528	DiagnosticsHub.StandardCollector.Service.exe
1528	DiagnosticsHub.StandardCollector.Service.exe
1528	DiagnosticsHub.StandardCollector.Service.exe
3456	elevation_service.exe
3456	elevation_service.exe
3456	elevation_service.exe
3456	elevation_service.exe
3456	elevation_service.exe
3456	elevation_service.exe
3456	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4332	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
Token: SeAuditPrivilege	1808	fxssvc.exe
Token: SeDebugPrivilege	1528	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	3456	elevation_service.exe
Token: SeRestorePrivilege	3804	TieringEngineService.exe
Token: SeManageVolumePrivilege	3804	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2336	AgentService.exe
Token: SeBackupPrivilege	4408	vssvc.exe
Token: SeRestorePrivilege	4408	vssvc.exe
Token: SeAuditPrivilege	4408	vssvc.exe
Token: SeBackupPrivilege	4848	wbengine.exe
Token: SeRestorePrivilege	4848	wbengine.exe
Token: SeSecurityPrivilege	4848	wbengine.exe
Token: 33	632	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	632	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	632	SearchIndexer.exe
Token: SeDebugPrivilege	3456	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4068	AdobeARM.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 4068	4332	2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe	89
PID 632 wrote to memory of 5096	632	SearchIndexer.exe	121
PID 632 wrote to memory of 4960	632	SearchIndexer.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_6f83f77689b349e03b2307abebb8e0a7_amadey_elex_rhadamanthys_stealc_stop.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4068

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4756

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1572

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1808

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2436

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4524

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:260

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3012

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2564

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1232

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4828

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1184

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4968

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:452

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1444

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3804

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2336

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2012

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4408

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4848

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2356

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5096
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 16f4068d547b677978202254f656f33ce1a24672399f256882fb243359becf21
MD5 7acabb2b87ad29b985631ee3492da227
SHA1 5cb3c45713035cbb26967a6028eece96328fb448
SHA512 fbc56a3d126497419b7a65c7537af35af734c33cd61e925f4a3a5a2d4250456ea41a5355fbe8dc3e6719643b7924808084a735bf4244746e53e4eee23852d292
SSDEEP 49152:2b+632BuPkFKRrdE6ohdstBhuXjfS4LWxncLNiXicJFFRGNzj3:o3q6mjBT7wRGpj3
TLSH
T14DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 8752a2d67966736a0f0939baca1637b6eb1c98e646974eb4c399a7cab809b5dd
MD5 2ef2d708c82d61af43b1a70f3185f479
SHA1 1a7aeed1590f7183e9be364b7902d4e92643be59
SHA512 d3541192b430a35529d09ef529522f3d81c308238953f997fa7366aec6823ef3cdfe0ca95e167f30466851b79ddd08b6ae6e76631eea86471de550607a62368c
SSDEEP 24576:SXYfDtczAH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5tceLNiXicJFFRGNzj3
TLSH
T1C875012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 25cd114a5cfd89cde87d4691b9f99c8728be1272528057c0d1d4dc1db480dcf3
MD5 39fa264e543cb67bedee0a82d5e3a18d
SHA1 3d0d7d8ab6574adfd81101c02e2ee73142100cd8
SHA512 6e7f9cb6d5e317f6963f12e52bbc7ec7484f194161dbb9aa02fbcac1116b4f83924450422f6921221f3e3703b19ec5bdc9982f62785c74fe8ff29bb02e99555f
SSDEEP 24576:t0Le5ji0hmxhrMU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tPji0AzlLNiXicJFFRGNzj3
TLSH
T1FD859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 981c6eb33385f41af54745e8b7ea2f6cf842452786903caf7d8a967594939266
MD5 6862b110e4b8b99d4752bd8b0b506654
SHA1 e8fe44606948244543738aaed227b42d7646c9ab
SHA512 e4432f72c3f0e68aac4ad4b6d9dc46963b2f6c468dd12f64b9d0092f3b0e94880f4180558ae9b0b96a2f8fbfcf8f2c0a15b968faef8a239b074e9b7b732010e7
SSDEEP 24576:Ja7/ezSC6vUyD/aqgrvWj6q8wyuu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4/ezSC6vUzPv+HjypLNiXicJFFRGNzj3
TLSH
T17E756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a21f36341e9299a909c7c2f09a2a604ce113d79e0a55e4b8a45f2fa9436fefae
MD5 038d7b0c53ea6d814bc990a9e59f1e8c
SHA1 f7994468ba3d1d094f277d65e7a00dfef2f44cc4
SHA512 7e2d8501e6d1834156bce1d7e99b91d251ae5adc566a05f720a830b4ae8590235716a48d45dcc3162f89efaeb3db499b23348d7779eb3e70a470c5e4f5972751
SSDEEP 24576:CVbqPb88hv/l+Bj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CVO88hXl+FLNiXicJFFRGNzj3
TLSH
T1D0559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 d7319b62995501eccb09d77420147322073a554df4b0f07650ea363f90c8e013
MD5 e7dffd0aafe69b27a50688524f8310f9
SHA1 dc26ab56fcb051ce76bad92008e93476602eb33b
SHA512 3f1c91e24ec384af868ff6b3c213fa37df61c4e64d10020999b9e859df956f502d1750e4b8295f9e9877c96d52818ea80b428444b8293fcaef7d74367f724644
SSDEEP 24576:KGg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2LNiXicJFFRGNzj3
TLSH
T1BE5523D3468864B1FBFD0039867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 19150fe850296ef75b8f5d614629b8bf43fbdc771a1291707fd673611043fe51
MD5 457465fdd618361de4d5d4e71fd45e8f
SHA1 cb66b482a324c7a4cad84fa2debc5f492104ff90
SHA512 f60ea42f6385d03ecc5937a3214b1f637a5b68d1ea7fbe8fe950fc645e042898e0c7eff0dcc8dd0b97d1c282264c6cd06d798301a94de16201437f056bf04972
SSDEEP 24576:eJIU7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eJIU7LNiXicJFFRGNzj3
TLSH
T16F75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9a538d404251fc931b41e28f1c0213ba28af2cbaeb287523336f31137bb4ad4a
MD5 d268d166b7c3e0b1495aef0c3de99165
SHA1 d3ee21f79a5db035226a6ab6d6bd9a4d65bc8e2e
SHA512 19bf1e92040910a4676b7bc4bbf93afb4989dc79cb74783c6d3174658855b7398f9ede21ad637cc55e54b19e1c73b65db704fec84ea6a7c7ce24aa869e6e9912
SSDEEP 49152:QQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH/:QQvGAdlCEL8c/WRNw5C+7wRGpj3
TLSH
T1A3266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 070c2ceecccca5d4dc495275bdd5c0c3b58458115ddf2600ee295a58e0927a7b
MD5 d127fa0c8ee6d89089b708f3e2b10b83
SHA1 f54ced964239d0b2d8d4f138a5aa91afd0a3ce96
SHA512 dcda07e9f897c9e75e16497c75dd8fc0a3b638df03f330d3ba938dd8ad4479fc7eaa5bdb941eefc2524708e785ff875a771cb7bb42f0e6fa6068629ae3f7b310
SSDEEP 24576:1fewsAj1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Jlj1LNiXicJFFRGNzj3
TLSH
T12375E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3c813e8b83957aa288480039a93bfc93da124a8a6d8d18026b58bd9ffd14cd32
MD5 66d06900c53c76752b694ecd60896569
SHA1 82a74ade4055247404d5d1cce36d1ff7bfa4e463
SHA512 554eb8690a92a35e420404bc7a5e965aa25ae75d3a93842e75f832f499dc34feee3fc90cb5d0d6e2f62b535b8b54dfdec2f34a4f11f14d78d47e00eb2786d039
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHhF9:xUEtQevvqc2W1cpV20I3239
TLSH
T10F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f8725569a4ef49905cc37b2391c1ab7566f194a675d8967c7b763b3a82e8982f
MD5 57cc3de2736e0f53187462b7d791205d
SHA1 fbbc80839d6e52a51529eb70040d884ca7d75c13
SHA512 a3745581e0dedc2329e6241fa1e19f80f1f96252f55cf4b99e2fe2b538d0d4e09c51629dea179c69462c707420583808a1527ac433bfad6533447f2f54402cdc
SSDEEP 49152:BCbRquA/m2yL5zLfFiV+XenmE3/zVLNiXicJFFRGNzj3:uoq2Vjnmy7wRGpj3
TLSH
T120D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 959fe7d803ddb7a7ab2717a62c2e5b4df0a95b90f9cdc5d63137a31d02c1ac4b
MD5 4c0ebcd7e703d5e143e3756901bfdf07
SHA1 c6ff307997ccd33346bcb58af6139997c211393b
SHA512 0840196977573292cdfb3e234800e4c0ecd0381b644b8f1102d2e13ef3bc9b569b190f16891dc37dced9df58831735c811c8406e43513f2a6c38b06ff7553449
SSDEEP 24576:jAhGL6IFoiwtA5l7S53S/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jAM5Foiq5CLNiXicJFFRGNzj3
TLSH
T1D0359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 89cec3b19a81d2c6f49f213786665582ff5e8a78f4138940945be35c4abb4ce0
MD5 17ae72120cf6f5ca3f51ed5397a6007e
SHA1 c3010fda60936040b8e64483438ffcb3ab0623bb
SHA512 9a39e1e16df9c24abf5eb2512ad4478645c8f702fac089e9dc61e9af2d30988c8c79e261a289119dc7c12840360efa5f620fe7f25ab0a72cc255502cbe714a0f
SSDEEP 24576:HwuROWJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HwSOGLNiXicJFFRGNzj3
TLSH
T17365F18632940CF9E9BA41398657C036F7F2BC152A21DB1F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9d4534ff44cc275d29970cc8903fc9b14cf834283c00015e6bd833749dff3137
MD5 ed3f98923af5dc57eb0550325810de28
SHA1 24e1fd30257e21fa85e299f2ab3acf58629a3ec5
SHA512 fd15743bc97f56f1c411eac7c33bb0f52b646a8a4022298a6e43cd2c4061b35cc367801fc80afa9607f6822ff95bb172b9aa46e4bb93472026b3f66b5dd3fe3a
SSDEEP 24576:jZus/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xLNiXicJFFRGNzj3
TLSH
T18355129622C420F5E2BB413DC9F54504E7A17C2A673643CF52242A6E6F36FD68E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e85d3ca6ef64176242b499b15eef01cf831d7eb22801eea9dd913478335d4025
MD5 70f9aa0d4382b771b76ef17b5068fb47
SHA1 1d5d07bde28df60cea35c83ba16a2ccf35f4a44c
SHA512 eed1c0e18c7a17667629de11811484efa560496c5ca87c8011503dba01c186bd7c7f434ae3a3df6b156c3cf4e6acb643a00feaa53bf368edba9f356ea026b9e7
SSDEEP 98304:XQRQyi36YOcPDLvw2gAf+PN3f7wRGpj3:GQyiKanX+PNTF9
TLSH
T1DE667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 def88f617c7d4551bfeb51f4b5a5a7b2d5be38d8c7b87bdcd274fdb9e28bd526
MD5 41c022993c1b79963e21a4e1cd0e7811
SHA1 6c7eb9895afbf54fd707b817f53e593169f49bd7
SHA512 072ebb7ef8c1bf0dbaae8b6171bf47801ce42c54503dfc620b5e240886dcc79363105589b202d1f05ea997a0f228b245ab71cf6fa47d35d03c296c92a59fa12b
SSDEEP 98304:nQRQyi36YOcPDLvw2gAf+PN3f7wRGpj3:2QyiKanX+PNTF9
TLSH
T109667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1ed9c81efbdedd864dfabacaed94531f63807487a71101d61b68900c7d2672c9
MD5 28bfda0985b0495d70066f08b609ccef
SHA1 fb937e71944f9e2f8426828b905f336b7ecd8310
SHA512 142fff13c887a4b2acf1ceb74d118618bf60a2ace6c21df9fe3dd72e91be0227c26aafa0ae6079a981280981fe6f0e7f5e54369713acf6b7782b99b32acd7375
SSDEEP 49152:a68Qg55nhkeWu7PNU3/lLNiXicJFFRGNzj3:IthTRc/l7wRGpj3
TLSH
T117B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fa85c3d97204b9e6ab0eabf4d5e0a2dca3df2bfdc5d8ef81c1f0bf715ab9882a
MD5 0801a69453478b63d120d34a834d7cb1
SHA1 aceff5cd2453bd35d3a8500b3eddc7e8c3236b48
SHA512 6a5cd582b16e427bdf65422bb6a2bb65c99b2680178e483675bd02c186cdea709ec898406b874731a8d51e9244d581764c3261ffc8c46c907d67fafda38ad5da
SSDEEP 98304:yy5112gYy5azzVvU69nLKnhZg7wRGpj3:7LIHRWhOF9
TLSH
T108167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0e125ae8354be0fddc50e8fc0cb04f2b41eaced8f43e868c0dd9cc01441d569e
MD5 cb5c08b4306910a72d3cb118c0250142
SHA1 59d3a8d482ca09344ac2c0428f4bb12265129400
SHA512 e1ef240bf3a5a9996db1af4c1df5c83d14e91973bb91362a2f8b6bd86cdc7791c8917967b9d52750f2091d7125fc2bf86ee0a656d30a7066516e8bc1146ef405
SSDEEP 49152:5B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glJLNiXicJFFRGNzj3:vu6JmIxd2dJ7wRGpj3
TLSH
T10CD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 98bf2a01e8c8e8e6ed4b518c0925244a5e21163e583669a7e8f4ee34c33dfaeb
MD5 78ae4f284eb99e0c49b83313c2d23456
SHA1 9b53ed48f2da7692ec765ea799a16669554fa447
SHA512 23ef28ca8abff3784e8d9a170f0ba84ffb14752579d8bbe438e4129601ddf0adb617b05e540189495e3e8dd572832ad2ce345d264c3206b60126ad0542b6843d
SSDEEP 49152:w1hpsNoJpF1A67U44CwH7R4xbLNiXicJFFRGNzj3:wmifPqRy7wRGpj3
TLSH
T171B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f0513877964e281fc11647dc453b74a4420d11b3505e3cd6d0dd8f61d9b9a1a1
MD5 35997422266deb359dc0f4d3f6e0ca7e
SHA1 ac55cd5cf9dfe464ff8c64c4c683dab67255cf51
SHA512 aa623f558a6ac791508a0048e0ba72bf13344bf2ca2b33c606b71523d919aba5cadaa26ff24a33bb2ba71b3b3a517d6394c2ab6df891dc8a2df2317291b0d109
SSDEEP 49152:KSuZQIY0Be2KkRVtOnks6NMHqsLNiXicJFFRGNzj3:U5dKqi61s7wRGpj3
TLSH
T1F7C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 10ad001f7fcfc3e509614794677f9bfa9e545f96f13ac29289119ace639d5c90
MD5 187c6830dafac475a3e61dd195d60a38
SHA1 44ca8a8a5f8f4765f65c7d58ebbb8a79b9de9feb
SHA512 201042ce47ca7dbbcd3945315bbf9e119df8ea1a0ec7863ddccc8ec40801ee381aa2856a5e8095089ab4c2f7cbb0bdcc5911081ea1ea68fec666416e34e7210a
SSDEEP 49152:ZhtSn8EApI0figjgiDn0AP5wHLNiXicJFFRGNzj3:oX2iWphm7wRGpj3
TLSH
T1DF95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e5e7934a0b7b1eafcf0cb682b91d745308c8709f5435fab3f2967030da27bd81
MD5 0642fb4b74e29d403c0d85434f81dade
SHA1 304eda945cc1e5a6df497e925a03b2631d261381
SHA512 436d06d832dfc8cdabe95bc15094fa7b7ddd4b419783e1916d93f2e18e3c1f11cee64b97cec55e86404a399991403523192ec11d7027301ae5745d35fabf0caf
SSDEEP 12288:OuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:OY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D75523D255C955B2FAFC0039C6754428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 02b8b5d0b150b285b1ad23389fded724530846409b74cea8aaa659b500110d65
MD5 aed05471c9a5431b85fb9ba8bac818be
SHA1 0f2b1b0d18239c4377d22fa1dc140f88e88aec25
SHA512 9e8b1e003ec598e971df2ef6fdf65991851adc49e9b9cbfd76be9d17ec5bea4e99100ecae0d178ae050e9c1290d4b195064538c3ec4f91311cd73bd921cfc09f
SSDEEP 12288:YtiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Yx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1275523D3548955B1E6BC003AC6764428F5885E2DEB5618E3E2483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 7e73698581639e0b02ef537afa8ea69ea008df668dfdcb87ac1b1ff167433ce5
MD5 596fa836e76eda0c45a132f746bba387
SHA1 e7ae261f107ec20134bcb70737f1122e4204eac6
SHA512 fe08d45748b86859b6dd78aa9f8f3f1da64ca035bd601ba84032e848ac542a94b6f36001ba968db9529d6877dacea045f40a273d542f9d746ba3b2d3b0882d29
SSDEEP 12288:EniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ET/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1505523D2558955B1E6FC003AC6764428F5881E2DEB5618E3E2483D1EA278FEFCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 9f0c90ccf80bdf0ff7629d4a6b02e6ddea2fbddfb2ac652ddf30d690d20bc0ce
MD5 a0a73d49d8be2c5f332e58e84977bab8
SHA1 d6fdd65bc78bc5a829da10b23f9582d5a1c011cc
SHA512 82c6926221106dd24ffa3952acd217ea9acea4f49c6ad4905a6cce18a41a3b35a048b6da8f877982b38a1ed06cb0ff2afb2de72ea72c45281762431be2afacb8
SSDEEP 12288:IVgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T190552392168900E1E9FD803DC6764424F2A47D6CD7325AEBD3003D1E5A74FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 18b4ae8f95dcb696fa2581ce0759f49ca3d8a0b933dc24ca6c68d4a6b4fc3124
MD5 3f84857c153c6d665e96b8fd209142d9
SHA1 aebf563d12a539f24ccfc57bece34f27f1963936
SHA512 751600a8e84c84f10591cecd4c9f6fec1e9fbdfd1f7d7cf5d5e9b5a62f1006714314b4210ca12eaf0ee03639e5b285335f4358d14d238803799b41a69e265ec1
SSDEEP 12288:9IiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:96/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F95523D3558955B1E6FC0039C67A4428F5881E2DEB5618E3E2483D1EA27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 dcbb1782eeafe674e2dc3f230ab1e06387b5f57862ad94b119bdcf1f6c18db55
MD5 5f4389a1cd6d4f29c9e8466ccdef5cc4
SHA1 da20734f1cb1edbe98a0e97c2dca14eeb20a5955
SHA512 b69a059c153e02ff7539682c6388446e29d7c4672e72f8a2c7ea65a91fe9d10f0d1d7b25d373e7e5f14a2b9050235669ad3f812277ea1528f3ef939eafbbec0f
SSDEEP 12288:KBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Kt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1685523D3558955B2E6BC0039C6764428F5881E2DEB5618E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1e6fe51cb10892d2fbac8734303a36a74749b01d337b98a39a2e7afcbc16371c
MD5 a8ef04e3026fe3a582ca7117d7562e1d
SHA1 9cfe48c076cb900caa9c60f62324880bb51c3f1f
SHA512 c46cc34b7df9e583bd48ad7e9950d9a5be4bbb7340f012a8510fb5a0718c6e434d6699225dd50634dd669e60b34e074585e81abeca08337ea1743fc91c83b1c0
SSDEEP 12288:SViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:S5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11D5523D3548955B2E6BC003986794428F5881E2DEB5659E3E3083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 9e22b2904aa504e75cdf03f193d93a5ca89851888c6f83fea3bfbf1b6f4756f5
MD5 19472c6317ff0291ab6a18e4033161de
SHA1 c9219b91276a30c3ea191e1fcf38b5fa825fa1a9
SHA512 62ae2d3cedef62f4640bdd0728c2c190683aa0ac8eaf7fbc8820a756c9d5ad218eaefe2d5f561114a58b1e84b529f150d69be61244fec6a23b41f6f427edc2e0
SSDEEP 24576:uZM3zFVSOR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uZM3zf9LNiXicJFFRGNzj3
TLSH
T1FD750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 126630b88dcf01ffe0ec5244e9793ddcc8c0f1d64dd37b2b318baa1eceb77749
MD5 e434f526cb245737435634bb80e7164a
SHA1 e9cb886ca3da72981092285ce9888850dd98782e
SHA512 8b332b17f09c8f9ffac3ca4978cf379f95acef94564d43a829eea8e6b4849bcbb5639ac29fa4475203d193916addeee01fb4ab8e2903358f1699bd89071ba54f
SSDEEP 12288:qaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:q8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1325523D3558955B1E6FC003DC6764428F5881E2DEB5658E3E2483D1EA23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 1f59e178775d1b346a1fbde8ac1de158aa6fadc26e6c877eabaa0c593ac1bbaf
MD5 fbd500198338e70e95d69de37a9e3cf6
SHA1 b12419f61d4f4ac4849d13a97eae6f6ae9a160e7
SHA512 de764b327fb02c39785f8b369f0683d34d050f91ce1a06911ed9f204170118a3d1ee73d92473fc75387026867597fa7ee4f9994c3c6f95409a690baa7b54dc9e
SSDEEP 12288:sGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:sw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A35523D3548955B1EABC003986764428F5885E2DEB5619E3E3483D1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 48f511275655340c86a2dda721b71799513ac81ad4b95be0ed0dc3589d7a9802
MD5 27ca85a456b9535a2451b5b92168e397
SHA1 342ff930c97513941ed4bcf33f35dc20b40e91d5
SHA512 52d550986e7deb537de0954193a1463022b7be77900b2d258e3bf1c8382ecbcbb1ce00b658432e9679d8e5638fb107877e24c70bedaed28aacec0fdd4218dd14
SSDEEP 24576:DzyF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DmLNiXicJFFRGNzj3
TLSH
T11B650247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b96c36b97f3ec1c7aedd64b56bce2a1602de4ac6278058b802f1419362063ef9
MD5 8dc6df930a97ea5638df795aa6d169af
SHA1 42e3d4d0a6037d18518c602171a6647fb4ba2a13
SHA512 40e09d825c655049a72c05726a769d333d559be174b27bcb36077afb94ac92cd0216d5f7a12d0ca97c094b1d4f0d08311172435a5ae9b400e936f5e70389ecf7
SSDEEP 12288:laiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:l8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A65523D3548955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 160bcd2616d3785bb6be206ed0fd72e0a6f4fbee5b3a5274a39a40a52dd96f58
MD5 3f7db1cdacea1869bf08c505763cbd0c
SHA1 8586174e9c63781b3ae9dea5cdd094c7a3fe94f3
SHA512 b5d123b5379f71208e49e1517397d9206442d1e69c8a72675b8f0243b351c7e7997291d1697b5b15763c18600ee93c9d626441bc7a3fde89b6feca2013d5dffc
SSDEEP 12288:0aiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:08/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F95523D3548955B1EAFC003986764428F5881E2DEB5658E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 a7b7d1e404b7c058414e62ea3e17f53c5ba1912080aeacb39fb3cedd760eced6
MD5 a6508d1a92f78d8a6c7512e05e38a358
SHA1 21be4c17fae507183b5dfec20e89d3e97921009e
SHA512 243868d136c77edeab375f7e619868d0cefd0e839e99e49a448987600e3e3e45db418250afe4d43c9daf253df22953c6da8bd727af043ffd4cb6c6ba48668640
SSDEEP 24576:wzyF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wmLNiXicJFFRGNzj3
TLSH
T14D650247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 b8b61fd9a6cb852802896f7529876f38a071f77f28ded05f7ccbe926b93d598f
MD5 bbff52410930b14bfe41ca2e0f20d01d
SHA1 b765bbb45a6aa7dc62314ced296a518698ccd94c
SHA512 ca7bfce1867d4b8f1a419e9b0ea403fc98da9c4774346678aa3af92f1a9918217458f56c9eb0df74483d10a5bc2dfe45e00af38f05f7ecd23902843111fc2f9f
SSDEEP 24576:ET8aLl3z0zDD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ET7LljuLNiXicJFFRGNzj3
TLSH
T1587502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 9badf923e42fd66f042382488750bbd5694095bb907933562d724da5ad083755
MD5 bb3a98ba3bca638913d26473b76af4b9
SHA1 a09ae3463aa975ead90be718c41bf45d254e44d6
SHA512 1743a89a81f830646235e849263269e1d3c2a798bbccae87505b78b76ca2c2cc40aa609a0992258460a04433c3c0c6efafa33515a15afb56591a92a93fae9bd8
SSDEEP 24576:d3rd9CHKy7GZ//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9rd9CHKya9LNiXicJFFRGNzj3
TLSH
T17C85CF90F3E414E4F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 2a600da5dc3b7218860182d7a86b17d3b4786cc74e5f5d1e69795a6ce502b95f
MD5 cd46d82de1c79398a09195c12c1ddf5b
SHA1 85ce8fae78ba07e5dd5915729ecf72e9538adff8
SHA512 1058bcf5d83c79e79e6cb46449096e109a36779a395cb421cdac1e144bb2552fe1f68f9a13c5586179a41f1a575c5bb683c976b1070d8eb31e320d0b7c55891d
SSDEEP 12288:pHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1395523D2548955B1F6FC0039C67A4428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f9e2eaed97c22251ac5d6b20d8c2abbda8d5b5ce3ca4134dc300327919ff193d
MD5 b8c2db0eccd49e94052609f26f92ea4f
SHA1 05d8dc1f1b7483dc99712805a8e1f4c2e22e3baf
SHA512 b37232def57962aa572130f56bdf911ac934666dbdd3043088817c3f009e9a882b35629e59f469dfd9f10d1def882b034ffe92a88cedccf7dd22039dd8deaad1
SSDEEP 12288:J5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Jl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1835523D2558955B1F6BC003A867A4428F5881E2DDB5619E3E3483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 0065dd686e7162f0a448331f6686452e97ca5039735bbccddb991751459f3ed5
MD5 2f9b68fb405949863ff6a3dbf098ea86
SHA1 9936bdcb232500201e192fbdf442d019056fcdc1
SHA512 837b65b9f97b69cda8ede383965053bd7f011a17b05af1f63278adbc096c1fa368bd5c1878f221b31eea9131cf74aecd4d78f51e3206eda610bb82cb19a3bea5
SSDEEP 12288:tpsfqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:es/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19065F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 168B
SHA256 05e0a62a3d4b5bb23cf494f898c7ec57ea6113aa62b78bdfee2480c69889a3b2
MD5 03dfb8b8f2b5dae4c13344b41d266380
SHA1 6bf9e2196871399a17abd67d07b358be7248af92
SHA512 144d320bdbb5fb40f2bec5209f76c9981d5e0febbbc27b88edadb7f463ae2b844af56c650be85e8afc89f69244502efce71abf86e44bec81e5dd02c56579604b
TLSH
T1A9C08C8201BF50AF0F2702C8AE022F9010A37111CB4D4AF1F234BB8AF9A1426099BC1C
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 83a080f8ed6f0cde10eb30282a9719b8e3f79203a42d3d4ead6628d79d7e7f40
MD5 c6ed43a89b4f20fddf094aca505407f8
SHA1 1b6fd36d6d5575d509fbb0913e8e6739a38a48c1
SHA512 f57a4bccbad55992115efdcff87d4c6487b9bfca4cac0d77f263106224b2115a6fc7288e1b9ccd7cccb16ac1c2da94cff1c83338146a0a2841fefe562c3b3f30
SSDEEP 12288:EaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:E8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A255239356885562FAFD103986398438B54D7E2C9F5598D3E2043A1EA238FEBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ca5d440a4e25316f8f1f29c43893ba68f9d4758ba3fd5624594bc3ea24df9a92
MD5 c8d4fcf30cd9c00019ebee14388c6231
SHA1 ca5951f00abdcad7c50c48e26d10fa94e77c7ef3
SHA512 54638a4bec586621721f585da3b69f2542b89369c0684e0b8bcaf1f25853ed77de682d8437cf22add336f872442142930d6fdcc17d28e0e360519329814d335c
SSDEEP 49152:ha0h2GEkuAe73q3pp46zwwQiLNiXicJFFRGNzj3:ha0hNYG4Jwh7wRGpj3
TLSH
T11085AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 0b108dfe17cb5b31fa7afed45e3d88edb01b4d01a68be50bde501ccbf8ee7791
MD5 b164249bcbe2f8631df302d4ca6c07b3
SHA1 af73a3f5c256ecc6a5bb6cc3e430190a8086bbe8
SHA512 984c6e87f3ee1fcb670d4ea29170191f62d7b4c70897b03c6f3bf4bdf784ab8d7751a6e2c44b07930259cde4e654358f6807f6f8ca537730965338fd05cad41d
SSDEEP 24576:2hbHjPX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2hbHj/LNiXicJFFRGNzj3
TLSH
T1695512BE129C20E5F6B5903D85668409E370BC29172197EF6381527E4F3BFE94E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 79addd2410a295e06e040c902f1c5dca7817b79d2bba81fe47d0e81193f38430
MD5 6e19fcd374e1c7d5ef79bd0f364d44d0
SHA1 0e1b6434a69616fe17fa3c2249427fdfaa5a8647
SHA512 fff89fe031496193a3f74ea43b8d92a39c3a8ef14e9714334777d2aad0f020791357cf0f91e0b69d7df6a11868c4abc416a004517c1b30f2f057c819ba4ca52d
SSDEEP 24576:x3YgnJcRTk4yti+R5dBR/P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xIgnaTk46pBR/PLNiXicJFFRGNzj3
TLSH
T14845B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE89F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 e50cf00db015feb8d38fd5f44c1a13fe0b3d657cdab1e32ab57f6f94d31c28de
MD5 5a476f0ecf1e2b01b229e284deaad82d
SHA1 7ecad9acd22c13d7227c9c86e84f0387b1542ce3
SHA512 1301506facbbf3c3863e226d9b689b4f7ff6a2cb608d0816578cacdbe01e81b9c25a1154bfea54292a75d6c8eed1395b0c909735c1dffd5368301cbbc32ea2df
SSDEEP 12288:lGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12F5523D2518955B1EAFD003D867A4428B5842F2C9B2619E3E1543E1EA27CFEFCF38563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 46a8eb482660ab835ee1630e9a76f2959750d3b31f343162d7fac5a578b878bb
MD5 a3597831ebca9af865f159646b974c8d
SHA1 ba2101c17a49730ee9da55ec08cb87aa182b1065
SHA512 b7b57ca194513f53561ac6ccfc222fe848c82c1dc221aa12ce44ee3333ac1ed55cf23419c988c8ae80ae0e0d079a05ae12a0c0963de3f50ab7754979269d3188
SSDEEP 24576:ZAL3UTT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZAL3UXLNiXicJFFRGNzj3
TLSH
T12E750155E79400F5E97B813CC9728916E2B2785D0364E7DB03A84B6A1F237E68F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 fa22bb5ae78e89ce2bbd330a49382a30b7630c96e7280cb659b17644d8c88ed2
MD5 e54179ceb2a00ec271e1ab8de3b96820
SHA1 bd71262f76a85516f9fed4117419ac9559014cb5
SHA512 1eb528bdb3a8acab856193f64b202a0cf7ddbaddba166427bc8756620214b1989d7b557c932d50325ef2fb18d728f648403561f9b5c4840ad597c4b2eda79c49
SSDEEP 24576:EO3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EO3LNiXicJFFRGNzj3
TLSH
T1A655125A32DC10F4E579903D8AA2820CE3B1BC29072257EF4290557E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1e338a0aebc85c9284dac2f161a53bc9b27366f6313b7b95e51dbe6996340789
MD5 532060f6da094c1312576c13b919a680
SHA1 2dc82487446f7e1784ad63c27a57037fe4364fb2
SHA512 4dc40386095ea44d63f8ff7f39170595ef4784a7e50461e2bed517c1ecfbdd2cedd150240776c6bd64801266d5be9fae909f4db3c3a9e09a51b99b64d72ac192
SSDEEP 24576:l7NM9YqZqmWMUkPjZM48Mv6bEhss/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:l7cBWMpPjN8DbEhFLNiXicJFFRGNzj3
TLSH
T14A65AE2E6BEC81E5D576D13DC9A28205F2F1B8611B318ACB5162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 a3f670ef4ad6b20e3015ea677be943f38d1ae4a44a38a26652d3fabae83567bd
MD5 b9a6fa4ac0b57f2873b5701ed12b98a8
SHA1 ab31b948c43f8515502866289afc8a0e554331bb
SHA512 e8843a73f5c89f797add3bce43001261da61b183bd89d2c8c8537457033c7fe0ccb765942f3a3cc49f83e7f912a8a86f9846695d690fe3444db5d1ac9c812f2f
SSDEEP 49152:bF2YuHNETovAvNYf8kmMLNiXicJFFRGNzj3:66BCf8k37wRGpj3
TLSH
T10C858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 e48b9c4276719d631f9d15c8a60fd43b57672b40e4750db5ae5742788f4d8221
MD5 6858160eecf13deaebe1f706e9090cfc
SHA1 9eeca72ffe48ade5d6abb1691ddded5e324ae411
SHA512 aad9b600446b2f2a6a9e7ade6c81d1fe4ae964cfaee0de0cb8edd593ea2c9b8ad20a3d156a881e36e5e89ce42d356cf2557339554ad886fdc47c27f872f7e014
SSDEEP 24576:9AFs06+Omlf8NXEbTob/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yFs060loXuCLNiXicJFFRGNzj3
TLSH
T1A365BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 be76a0b8611ea1a0b478ede1f11eab966bd7232997de76d7eaa3fa73bfc0acb9
MD5 ed8cc5873a9a71748ea153bcdd6791b8
SHA1 3838ba240ef620183302a6ac9b66432444af5041
SHA512 bbcd1dfcab1dd2595c49eee712090c26f1398d861d0494babb2b5f5de8a90d7d4ca56f28537dd005967eff66cc4b9adf7671d06dd72bdaa01d31077bdf9f80b8
SSDEEP 24576:JJnJ5D3WXC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JJnJ5DGXCLNiXicJFFRGNzj3
TLSH
T11475D02DD29810F8E4B7C274825A1A55FE72383D2F2269C724B4E5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 9454970179669d8396b07add634d5bbfc166163af75d656a18179502a514578f
MD5 2d6066ae7fde196709ec87276c767dbd
SHA1 31599a70851aadd8c33805786c6aa35245b6c518
SHA512 acb6e7a2d95fa0aab5803e026a575322bce5009828bc9945810227c9666fa0506f1dd4557c3a4ec25c47f4307783337802e0e327a9686e04287590ebd909b249
SSDEEP 49152:mg06DIKdwc+eQnSt65aVYLNiXicJFFRGNzj3:/e7wRGpj3
TLSH
T188956C16B7EA5294E8B3CAB1C962A5159B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 29d23f7cc641d0682afaa6e3372424db2dc8c6716a443f4619ed2eae08c0d1f5
MD5 f8dc88b5cf7b5c77c4535d3ba1907eee
SHA1 fd3374e6937a917366bbe69b0d3528b25f09bf22
SHA512 f8a480c5ece26be7e2dbffda6bcd1457fa0cd4e9767c29b0fa7395614d3daa3f8d31e79a72ecc7ad579e3ea033749ba4bca1523ccf09f310382d175364090676
SSDEEP 24576:Bn4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Bn4LNiXicJFFRGNzj3
TLSH
T1285512AE278C70E5E579903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 a0cc00b3791e47f2e54ba5eb05192d43beb417d622487eb8765d2aafdbcab420
MD5 160ba457b6f480c7455f8c5946d2a6c0
SHA1 60f7cb7aaa67960ce94bf71c2c81220fe4d44548
SHA512 697a05a52944fae49b92d24786d04c7bad1dd72c6018c58e6de155c4171848738484f0296a2ff54d5a3a67fc0a796e61a5816328e3e33ceee976a7eb53c5dc26
SSDEEP 24576:CIy1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CIyLNiXicJFFRGNzj3
TLSH
T18A65124553C860E5E6B9013CCA778064AA74BC349F2156EF9180BA3FAF36FD59E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 189c52b18b47ae72caae5dda4e0a2c6ba8c2e0d626265bad087c4c5b0c53d03f
MD5 704ba37c1dc6f60870193f453e7f4c73
SHA1 6bc4f3f14d7f2624e94bf3c17fab5b87c967fdfd
SHA512 aefd76067557b52ef4058167a97692c662c3980a337d1fa4c8ff09ef8c8375efbb1ef3a2a693745f6d96fba6fc957f987f163a8e7c46cf0452b2d7f2d3979f23
SSDEEP 12288:PyziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:aH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10255239A118965B5EABD003D86354824F1943E3C9B1628F7A1947E3ED339FDBCF38852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 6741b207bdf0e7e4dcbf5bdaebe8217ed1b01e6062011a5c734ccd4a2ecd42e1
MD5 6f952fdee180fc116608005b8199d558
SHA1 2c81e6793c37a20d230795c2d02a6e9f5fa7eba7
SHA512 6eaef91f2b9bd7b63975117c7e153313055057c4053b4e1c7d328fae3da7bf1f8ccede574588d33bda0967826880499ca504b2af885959226d8c26dc65be2bab
SSDEEP 24576:kQ9MxZKdcz9dw3U/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kVKZULNiXicJFFRGNzj3
TLSH
T1A2558C2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 a548af8c85deea79fa650eece85a0139a7e6f87c76794c144dbaa7e7742f2c2a
MD5 fe4f88906807474079cbe2becf86801c
SHA1 f6a89ae0edfceff92cba116e36ad7e01a169fccb
SHA512 587ad2438bccb6709c836f2366553f560e08d56ebb29db4cc5fd3832f36ddbfe0d64fcb13dd6fe8a860da40c0587d2834e3eb9e2f8215ded3edf90c109ebe4b3
SSDEEP 24576:MyocDApp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xocDAppLNiXicJFFRGNzj3
TLSH
T14F65E05FB76D40A2E176813C89858204E7B3B4345B6257DB6181C73D8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 00596dedb331e4640bf3dc35b4347cd50187e9698fb3425d7dd97ddad8489a7d
MD5 78732a3a126109a1d8b82d5303be1101
SHA1 1e603ca059223fb803452a776e2f19b1f846df3e
SHA512 c967cf0e124865a6e564f2d14554a6fbc79ec9d694df460367725d157bbe1e28b479dd2b5f40463d741347b822adeca6de3d47917c3be11b24f8eb7d608385a6
SSDEEP 49152:TWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKpLNiXicJFFRGNzj3:T0zuNIT7wRGpj3
TLSH
T1CBA57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 63ebd5b929f6a0d41577bb3848a755f7fe9932b30d139e788cf81088199ca95c
MD5 51859362c5e0f953fae0bfba828bb790
SHA1 727bccce99c6222f0810963a135298914d8a42f0
SHA512 ed5a9e7ab5d043520c044d33dab592653ab2ed13b9cd2aee55da762b7fc122d4da159d375f814830b8f285f46f0fc4578e16050b0627f2e8eccf5ad778718c5b
SSDEEP 24576:F1QT7EcpfxR+N5AWAz3ooiYzjMqb4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gTDxR+N5YzTBjMlLNiXicJFFRGNzj3
TLSH
T1B555B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-166-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/260-321-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/260-168-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/260-160-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/452-367-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/452-373-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/452-374-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/452-491-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/632-469-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/632-453-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/632-424-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/632-567-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/632-485-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1184-360-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1184-414-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1184-488-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1232-405-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1232-351-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1232-346-0x0000000000850000-0x00000000008B6000-memory.dmp

Download

memory/1232-352-0x0000000000850000-0x00000000008B6000-memory.dmp

Download

memory/1528-318-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/1528-15-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/1528-22-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1528-16-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1808-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1808-27-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2012-398-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2012-510-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2336-395-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2336-394-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2356-412-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/2356-566-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/2436-140-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2436-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2436-134-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2436-320-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2564-339-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/2564-401-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/2564-333-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/2564-342-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/3012-397-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/3012-329-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/3296-492-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/3296-386-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3296-380-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3296-379-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/3456-38-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3456-319-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3456-32-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3456-31-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3804-493-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/3804-390-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/4332-0-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/4332-44-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/4332-6-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/4332-1-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/4408-559-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4408-402-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4524-145-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4524-153-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4524-158-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4524-156-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4524-151-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4756-314-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4756-11-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4828-357-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/4828-410-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/4848-407-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4848-565-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4960-508-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-521-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-496-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-509-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-499-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-507-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-506-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-505-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-504-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-503-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-502-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-501-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-500-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-497-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-512-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-511-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-526-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-525-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-524-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-523-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-522-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-498-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-520-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-519-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-518-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-517-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-516-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-515-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-514-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-513-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-534-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-533-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-532-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-531-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-530-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-529-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-528-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-527-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-495-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4960-494-0x000001FB5D370000-0x000001FB5D380000-memory.dmp

Download

memory/4968-487-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/4968-364-0x0000000140000000-0x00000001401ED000-memory.dmp

Download