f61b44231f55365e71d0dab493520b550595739dcab802d01beb632e77e05025

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 16:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
Size 1.6MB
Sample260804-t28rpsdf75
SHA256 f61b44231f55365e71d0dab493520b550595739dcab802d01beb632e77e05025
MD5 1abf775945e4a187070d9b70521f384f
SHA1 fb1618cec0c1619d76c5465e77ff371de6edff1e
SHA512 998902eeefa0c62dd7b2b0654866dd4575916bee9fb10712085497910ce8cfa81e92d92a18f652e53c1dd795f56a340266b01293f79c20bfcbc7a2276190c997
SSDEEP 24576:fLv5qMr1nD7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:z5qMHLNiXicJFFRGNzj3
TLSH
T12475E01077D08036F5B324764A7E8669956DBD715F2181CFB3C02A2E9E70BD1EA31B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe

Executes dropped EXE 23 IoCs

pid	Process
2452	alg.exe
2408	DiagnosticsHub.StandardCollector.Service.exe
2124	fxssvc.exe
2560	elevation_service.exe
4420	elevation_service.exe
4492	maintenanceservice.exe
1168	msdtc.exe
3476	OSE.EXE
1452	PerceptionSimulationService.exe
5028	Reader_sl.exe
4980	perfhost.exe
1472	locator.exe
4836	SensorDataService.exe
4472	snmptrap.exe
3032	spectrum.exe
3092	ssh-agent.exe
116	TieringEngineService.exe
1432	AgentService.exe
1584	vds.exe
4468	vssvc.exe
1120	wbengine.exe
2464	WmiApSrv.exe
5040	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c51fd1aa79c0b0e8.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86734\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8c883bf2f24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000004471abd2f24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a415ecbd2f24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000be0a5dbd2f24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
4428	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
4428	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
4428	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
4428	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
4428	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
4428	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
4428	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
4428	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
4428	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
4428	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
2408	DiagnosticsHub.StandardCollector.Service.exe
2408	DiagnosticsHub.StandardCollector.Service.exe
2408	DiagnosticsHub.StandardCollector.Service.exe
2408	DiagnosticsHub.StandardCollector.Service.exe
2408	DiagnosticsHub.StandardCollector.Service.exe
2408	DiagnosticsHub.StandardCollector.Service.exe
2560	elevation_service.exe
2560	elevation_service.exe
2560	elevation_service.exe
2560	elevation_service.exe
2560	elevation_service.exe
2560	elevation_service.exe
2560	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4428	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
Token: SeAuditPrivilege	2124	fxssvc.exe
Token: SeDebugPrivilege	2408	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2560	elevation_service.exe
Token: SeRestorePrivilege	116	TieringEngineService.exe
Token: SeManageVolumePrivilege	116	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1432	AgentService.exe
Token: SeBackupPrivilege	4468	vssvc.exe
Token: SeRestorePrivilege	4468	vssvc.exe
Token: SeAuditPrivilege	4468	vssvc.exe
Token: SeBackupPrivilege	1120	wbengine.exe
Token: SeRestorePrivilege	1120	wbengine.exe
Token: SeSecurityPrivilege	1120	wbengine.exe
Token: 33	5040	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5040	SearchIndexer.exe
Token: SeDebugPrivilege	2560	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2300	AdobeARM.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 2300	4428	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe	96
PID 2300 wrote to memory of 5028	2300	AdobeARM.exe	101
PID 5040 wrote to memory of 2012	5040	SearchIndexer.exe	124
PID 5040 wrote to memory of 4120	5040	SearchIndexer.exe	125

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5028

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2452

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4200

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4420

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4492

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1168

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3476

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1452

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4980

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1472

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4836

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4472

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3032

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5064

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:116

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1432

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1584

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4468

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1120

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2464

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2012
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 3.0MB
SHA256 31d8168fc1e98441e2a96591c0e5256b58fd7f1439e3b4acdbc650b87541fa06
MD5 928c44824de909b355aafd00c92ef72c
SHA1 fad34155fedc847b15767291e58c147d34e698af
SHA512 1a94106e1bc388cf688f560b7d11a33ca9d95c66aff93273eceb6c6559394066db1f17d6cd1b3c39553934e54fcb3067d8518987c58c6e0dbe247f6b0d30b7ad
SSDEEP 49152:6TfiUEWo6zuEz439S99akTBc4O8b8ITDnlT4NvJqLNiXicJFFRGNzj3:6TfiG/nzl9027wRGpj3
TLSH
T19AE5E52662C8C1EBE5642070CC69BBF900546D78DBA2CDD7BD447E16BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
Size 1.3MB
SHA256 40649f922093f1fdd32c89fa60d501fc9d89e2557eae1b4e946407a8e105959d
MD5 88c30331018e52983333192505a41422
SHA1 2e41408d3fc1aa176712ec2c1409ca4778829107
SHA512 0920d32c9e5001ce01108428b3f39ea7e219b419ce0e68284fa7cca4187626de79ebfe85e3de2586f5006621ea5c7c8c6b73b27a1c9732cf1b06af0c91386638
SSDEEP 12288:7FWvrP1kgHuO+stpudHBZYuh2ohk9nX5s5rAD9ZWTWoIc:hWvBkPsLudhZN8r9nX5sw9ZRoF
TLSH
T1DB5522136F8B8BD2DD4306B114E11BE891E9EDB0CF9127E76A0632AF8D784D90D3652D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.6MB
SHA256 8000d537b7f2506a4da1b45368b6743e4d359a657df7d4b8e505d11efb529f93
MD5 1601cc041d502d9413a961c9b6970c5a
SHA1 a977f4d25d469421b3c6aad3fbff0044cbf4dc8e
SHA512 3c698363aa46b385693284a5dda28be2637a85d4c29ddb5db42f94a6661bc6950ead71075bfe135c0dcd31435081d006d9bfd7e86e4579fc380fe0d7eccbb10a
SSDEEP 24576:rGTAbD+OmeTBkPsLudhZN8r9nX5sw9ZRoI:yTAGOmeAsL4hZNq9XCko
TLSH
T1E175E11037C1C135F5B329768ABF9728556DBCB15F6882CFA388167E4E706E0AA3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d620086e3c9004e3d3cc62dab427f45bd9f50ada5f96994857f15061faaee231
MD5 1ac893e9b42ed4a4a6ebb165736ea0d3
SHA1 7bf66641ed8046d7947b0d1a06d52d10d846bfd6
SHA512 df61bb1b8a5fa327931943362aba94dba852ca685de90e89135ba38a2eb097f1620a22bdc86f841b95d6f99a712355a18393a2b144d103af067d911b8fa1ba15
SSDEEP 49152:Rb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnmLNiXicJFFRGNzj3:X3q6mjBd7wRGpj3
TLSH
T1BAD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 2ea0a95f9dfbec64c6469c179c054798af1aac1b7ec90614884f3b30f919ccb9
MD5 a5d77969cc9d98916eab109901f4d7f9
SHA1 11d747e2aa321e1482ed9cc4ea411568d5eca711
SHA512 7b4a02be9cbbaf437b8cc7d68468df149ac695094aed0d204684d0b8b9ad60c752e9a86fe14f3f88ba6ff2e6dddd3d0cb7ef1701f9c803c46b2e38f26c0ebbb1
SSDEEP 24576:bXYfDtczAB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+tcoLNiXicJFFRGNzj3
TLSH
T1D775012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 fb780773b7fa8624291e0b35120bc235093904708a062f462e588d0331f02d2e
MD5 edc8050da0c5b3ebe3522e2094ca8211
SHA1 e8720fff8a95d1fce39a3edf1bef1214328495a4
SHA512 835eeb6b86bac28a68eb67c8e7ebc5a57b3490bd170a4dbac48c160768d28a55083ba43ce9d69ba20df5cf9792b5ec81e5b9ad5226fcf062c17628e1bb637aa5
SSDEEP 24576:Y0Le5ji0hmxhrM+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YPji0AzXLNiXicJFFRGNzj3
TLSH
T1C8859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 29b2b16f0535fa72d4e096696e38860de1530dc1b9c76cf9a841fcecb5167e09
MD5 278bcb3f5885b1d022caecbe124a5757
SHA1 6973aad6e9363e7125f8bae45e7aca1c0c73674a
SHA512 4472768f1edf6d13373b17904eb6c1d5a3b903cd5fb6198e75db727e0ba5dc0165636e91d239c2a6eeab75beaefb596ec7512c63628af6dc0dd7fd8f8fff6346
SSDEEP 24576:0a7/ezSC6vUyD/aqgrvWj6q8wyuo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:j/ezSC6vUzPv+HjyTLNiXicJFFRGNzj3
TLSH
T13E756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ef31d5726f9c9db24afd4f4ddae2c5ecd2f4a9c908fdcc8b93d818cd2d9d6cbc
MD5 96bca5466f0646f2638b841ec8fdbea7
SHA1 42d7d688216b126464003c4682b755d97b011e19
SHA512 729e2e52cb598fefbe8c8b0f2cf5b4c05a9d887b9c68d7338b1b7960f04b281d5840e5aacafeddd787af511de45d6e9e61d7e1d413b3f899fbeb8bbe498c8184
SSDEEP 24576:SVbqPb88hv/l+BN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SVO88hXl+3LNiXicJFFRGNzj3
TLSH
T1F5559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 47483636b266a5a0650de71cae0745a28e5c1e1ddf638183f32a8190b3016c14
MD5 ac956bf07b76bcc5b5c07d8aed5f6c86
SHA1 3df5f99a7bf508e177826092a1d12fce89cb3649
SHA512 c32429cf063b1d23a19b6e6d7569761931f3812dd1ac2fae9fe08e28bb614a94f9dd3fda3700065e09bcaa6303e7f85a4da7d7641f33353aa4cec88b47f5828d
SSDEEP 24576:AGS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OLNiXicJFFRGNzj3
TLSH
T1A95523D3468864B1FBFD003A867A5828B5845E2CCA595DE2D2543E5E913CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 6bb272aa6340c1e1944e721ce5594ec67d90b68381bd1b9d058c1aff4bc85611
MD5 f88d1c1dddb0e5d720b15ebd37be111a
SHA1 8fd32b74576c4a1b1c6363643d9957fdb902c07e
SHA512 8c88681ad154c3ef599c9d9c610922802ab6580a10ab226fe9be1a30cb619b73a71ff65277ebf231b85ec7bfd4d3266483cdddcc728c12e4a4767783d637b93f
SSDEEP 24576:jJIUl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jJIUlLNiXicJFFRGNzj3
TLSH
T11575CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 cc1c06f0fbe29f424efdaf8f182ba3db5120adcf31eec2d59fb30ebc68877874
MD5 3a8bcd68f84129b94bfebd270cf9df4a
SHA1 b622eb8c6b30b1706a45685933ebcd94515f838e
SHA512 c9f5d8fe98b4946c8ea665ba819dcd4fe34af152ee1b51d84e9f61ed3a97e4131d684cc918b200134ad154f5ad6d7ab34299af72ae6041a757d2160ceef40b38
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THd:SQvGAdlCEL8c/WRNw5CY7wRGpj3
TLSH
T129266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 68d7040eb69f17f9edd889a0df58d6e867a3876697edbec2c83da8c9e7450bbb
MD5 9797477ae939fa5a2db92c76f9cd4c4b
SHA1 78c7858e219f605528393f0046ea9f70a21b2716
SHA512 9380e648415fbc32ee8b5836f56e51533587580e37a0b76f61976e0af1260148f1ce1cdaf01341cb1c4cd42579aacba4e8392419b890eedeb7da10320278b22c
SSDEEP 24576:IfewsAjH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CljHLNiXicJFFRGNzj3
TLSH
T1D575E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 96c8c2e4a928ab21afa18cffbab64ed9a12f23b5abddd6ddc53b5a55144b48e0
MD5 5260796833f8b30f0059d9b8756710db
SHA1 c7d650c7b5579c1a9ef7ca691918fd5994345f52
SHA512 fa96d2209c2b73ddefe85b2e09e34279479174da1ff9bd2e116776bee59784300c2d9b5d1a5c33868eab8042cdf0b6944b41e0fbcc8219eefdf9ddc204be3e88
SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHTF9:NUEtQevvqc2W1cpV20I32R9
TLSH
T13F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 60b805543c7cd0afde9040dc92d8b23136cd99876510dbbf3660c7fdf1398ab1
MD5 3414ac0457389516c14ae5c2dc19c101
SHA1 b31c6c3727aecb21f8e5fb03123a7b8427d39b31
SHA512 844649f7ba9cdf3af5546f501862804c0d9c4de7c0ece35db97b54bdc1cb27c69c6e193986de671f50a4615d9f17f0f8e7e9aa9d13b6eaa2d29f4238ed3e5779
SSDEEP 49152:LCbRquA/m2yL5zLfFiV+XenmE3/znLNiXicJFFRGNzj3:Uoq2Vjnmk7wRGpj3
TLSH
T102D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fc37e6b142b5b4364cfac8b05f6a3ef164c8beb85cbbaca81f41859870718e17
MD5 1f54dbcc34d73bff4f321b92e396b13f
SHA1 6761d08dfadffe3e41162226cd0eef1954f26170
SHA512 0bcef130ccc78310640c6faec8a68311c4aa6c7da2d6e458595bd7122a811fd7b11b55ca90b96724fccf5c7cb7b55c61fa21f27ddc7595bdd0c9775d5bd19204
SSDEEP 24576:DAhGL6IFoiwtA5l7S53E/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DAM5Foiq5ULNiXicJFFRGNzj3
TLSH
T19F359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 15063fb7158e2413958f28fdde1dbdd1322d26b2e77eb9bd7f298cf720c3f58e
MD5 90f9847ba22bb0d839adf2a1a2633f7e
SHA1 0ab850d5bf669e7e8d66ebdfeb5d620a9ab42aca
SHA512 478c5a0f4bfc666e79dda98dc1dfab6ab5426e7e8d6da0b04b26a393be2f07b6e179d642ba24e003424d22fa6683e716add982141d11390ca91166ca0b822772
SSDEEP 24576:fwuROWj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fwSOALNiXicJFFRGNzj3
TLSH
T1D765F18632940CF9E9B641398657C036F7F2BC152A25DB1F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 2230c5e1bdece5b4e5415bb1820536ad2a9b4d219fb7cedf8796859f8833d76e
MD5 530950d33ff0027026df9daf98eeba6c
SHA1 7be5b834581b3382e0b713c26589e9d36ea5d1f6
SHA512 75d3bfece928e03ccb4083d06f969386d75e3e97cb81ce0796ef109c66c25e43aafa8d9ad0169d037f6af14e29d78c4328cc21c62f489962d2cbd01501cf291c
SSDEEP 24576:3Zu2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3LNiXicJFFRGNzj3
TLSH
T10E55129622C820F5E2BB413DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9c2632f1e31c4b124fa7570a8ea7cb4cf7aaca050c5b546e9f2698162444b808
MD5 7e8dc16573ea4d835a9cba03ae46d08f
SHA1 7d69392022ca57e8e7eff90fc7314d0273d01179
SHA512 0d64ed02d0e63f94130b823d0be3cb10b21018ad7594ff559d40bf148e728146f208d03226957322f09a90652ca1303437d59cbb3292e2e8319506de1724cd3b
SSDEEP 98304:6QRQyi36YOcPDLvw2gAf+PN3B7wRGpj3:xQyiKanX+PN1F9
TLSH
T17C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f7e0d346d6dea66919c3529a32e4c08b64093fb2275840274ef9cb439ba013b5
MD5 542d6327126635ce27a09802eb06e755
SHA1 91e71bd6a52a67be0990ccd829233eabc06e7c51
SHA512 f20434bc76605cf640dc5972e4d5faeb3136e54e14f8e259d93a4eff76cfb2631364b5ae7c43ac27760b64787aa47fa372e64e4cfa4768f5fc6edef9a53b009b
SSDEEP 98304:WQRQyi36YOcPDLvw2gAf+PN3B7wRGpj3:dQyiKanX+PN1F9
TLSH
T1DB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1e8dea0e5efcd5cb8fbb4353ccc4b8f6a33547e9fd3f7faf4ffc99c61bd760cc
MD5 d94407a0707c17af8f0b4ad8a1da509b
SHA1 4b8c71c844ca2b4f139c9497617706b541c6abdb
SHA512 ee367453ee17d269cff39ae2732d83d6a13af58780c32d22afc3fbe803ad6c7c4579edd9bb15e3a70662e76188618fc87ce8300110d6b42d50aa9fd43a417b06
SSDEEP 49152:k68Qg55nhkeWu7PNU3/XLNiXicJFFRGNzj3:OthTRc/X7wRGpj3
TLSH
T1E1B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 98dd6838ff569c439101dbf559a22ce4cec953b07e71578da23cddc2bb1077dc
MD5 8055b32a8df7f3946bba164f7e91c9d7
SHA1 1b1e69641ed9a74c1b3bbfab16888ec987a232b4
SHA512 15c99e59cd1cb440700231ae1f91aac7d3b552436c7e4bdaf60d3cd715cf7b4220737edb3023ced608a3264a4339425bb266a7b281777a25651e1224087c9d81
SSDEEP 98304:Jy5112gYy5azzVvU69nLKnhZS7wRGpj3:kLIHRWhIF9
TLSH
T1E4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7df534aaa249da3727d551111dee8dc76c941cd9cfd489b51c359792c427bfb4
MD5 c270add184f75255c3fb8447e1d955ac
SHA1 6ec5f974c259068263668fafd33ea00438f2ff10
SHA512 5eb04001190ccd520bd3871162c98c3fa02efbd2f616ee6d33015ea0413c5da1b89509e501a3967ab0d2eca52eecf33fddcacff60ed8a042a92911851a069c7c
SSDEEP 49152:8B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glRLNiXicJFFRGNzj3:Wu6JmIxd2dR7wRGpj3
TLSH
T11ED59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c27d2e990a03ebc91cf89195ddacac788c6e5f7c131fe4592b6a9b351507a835
MD5 98199ebecebc8f904f9a96cd6791cf16
SHA1 066bed1e9bf92a783e2e6c3bd94e67293119da82
SHA512 1a6ce58b73ecdb06e40685f6c474ccf0f7c441611bf9328ea483f31bb1c5837b1bdbce2b8b2efa1a9e8cd426963690d8666203e2e1cd4e5b7c4fa6854f8318b7
SSDEEP 49152:K1hpsNoJpF1A67U44CwH7R4xFLNiXicJFFRGNzj3:KmifPqRk7wRGpj3
TLSH
T18DB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5517b297bb992d9fc4f6bab86fc88c025007a6b5ac6c3a1de265deac3bbac8a1
MD5 ac004d0302d50ba6937b9c8e473f81a2
SHA1 9091bdb8fa500c249eb4b4bee4851501c65bb94d
SHA512 4bc4f0231c60e58db3020de94aefd0ecdb20ee07705865a415a70414d213f55869f8aa0280d47a72e8baf5f20c2d71080c9b1592afb9dfd4d56cdbc79e9568e1
SSDEEP 49152:3SuZQIY0Be2KkRVtOnks6NMHq2LNiXicJFFRGNzj3:t5dKqi6127wRGpj3
TLSH
T1D4C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 cfa754a2693559f00da4c671a809c8ca94add793b21ead8973c7a64ba6dd7d41
MD5 06e35e0945500124d09159a3ee9dea1e
SHA1 abcdde8ffe181b8b5015960a70cd5e11315b244f
SHA512 49c3556d139d7e7868af50b0ab6a1a74ae3f645c4f06113c66f0694fa1ee14c313a4310b55ddb381c4fb96f37d88145391036551716ffcebf9e84fb1016773dc
SSDEEP 49152:8htSn8EApI0figjgiDn0AP5wpLNiXicJFFRGNzj3:9X2iWphA7wRGpj3
TLSH
T19795BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e3c3c114f977c6934b9c06f08007dd4824b38e6cf10c71683347c68aa899da76
MD5 b0c00635565dd889264546d5974fa763
SHA1 33204b8c300fedee1d107244c69bde63a88f2bc2
SHA512 8dcccf3e43640509d9c4fa17d4beeb3045b3d66a8325a225bccea55f2fa6aa8241914fc5a7e896399a85663fe146440f9ef8727c35986c945109dfc194a77184
SSDEEP 12288:J4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:JK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18A5523D3558955B1FABC003AC6754428F5881E2DEB5618E3E3483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 10c843f680dc63fadae8bf21a4c051d24d2498af5d297af485666c14a3b75c6e
MD5 161d075b8f1579980643c4152b7c1d93
SHA1 db4eb0e1efa65e8198620495d9c3d6f58078507b
SHA512 60ccdec99ef56300ca7cba620284797c8638ad929649152ea5f834742e48036b25022e9a5cdb4ad2116a9c61656cbea3f9ab7afd5c88903bf7da73b07ef80a60
SSDEEP 12288:fPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:f7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CD5523D3548955B2F6BC003A86754428F5885E2DEB5618E3E3483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 5acc5f01cd01ce6e3e0d4e979fa9ef1451726ee395f41724ac60fbdbb68bfdf6
MD5 376386c3cab86cff6f7fad229775358c
SHA1 96ba83bead1f7ce970708d7b003ce50a1ebb0249
SHA512 794850190fef43a97357dc0f345e6f57e9c52fbe5275087420fff2192a64d0485b28999e13555c125c37e0ced09eac636c6f791b8853a900a731d2e6d18bf40c
SSDEEP 12288:2RiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2d/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C65523D2558955B1F6FC003AC6764428F5881E2DEB5658E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 02fc0ddcb3c1d407233ab459f918c2627810a2d634e6e9f2fa10ca58dc14e01a
MD5 64d08850850907e3c488eae625b90908
SHA1 17e4ffc2d4d0d0eac5af2e20c865d526f3338051
SHA512 84793f3e590d8a64afd5822eda899869f109655a06929d3ad3b12ea898dd6264eda25ea6f3352b8f531db1f26bedea993bf22cf5f7935971c2274bc929642f02
SSDEEP 12288:xViiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:o/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T188552392168900E1E9FD803DC6764424F2A47D6CD7365AEBD3003D1E5A34FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 10df32a5a0cdcb5383563786f71800597532c1431c0650a5b360518f729628d4
MD5 d68844dae55c1c7529b2e2150b3bed82
SHA1 afc0e46faac824c4d662ba4e0a7a4a46df64accc
SHA512 53f93deaaba7e12e0cb8ca567afe957083dbb0e4173355652b86ed5d1f4945c9f946c37cfeced4806e8184c2fa9b59745d95cdfa4be9e415127476699f0d66a4
SSDEEP 12288:UqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Us/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14C5523D3558955B1F6BC003AC6764428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 37d860ed04149cf7df32e4839953bf598640bd787a7e9bec65e2eaa5a03acdad
MD5 1080bf354c9c33ab512f701fff1afc21
SHA1 2672962963e8761313bf0f64ffe02000fc11fe5c
SHA512 9782b7438ecd7c76530dd3ee05e0398217651224ad092d37c952621e745e64c326ce367774b0f0231f8d1141d10c2d87e2743f81fe04033bc29472634e1cae44
SSDEEP 12288:QriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Q//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1345523D3558955B2F6BC003AC6754428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f9f5f0e9e9d205f3ecde88245e9f64f0a3b32ff680fcc7f7eac589786540158e
MD5 99d42479d1521f372546b2352095a6e3
SHA1 5d2034cfdc4221eaf2264ae17cbc066809567b67
SHA512 d27494e8c43994e3e9b8d28e1d6a590896e667ac292d395370978c64f420d67aa9569d8aaf4e696dd75bf97f6b5b2e244dd80677eb070aeb1e61839682b550d0
SSDEEP 12288:d3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1465523D2548955B1F6BC003986754428F5881E2DEB5659E3E2083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 b5ebd4cc1a34c2bb176eaee5fee5c6fc11da43259d8d26185ff5ac4cf1008886
MD5 662a25cb2e005be98b09bcba92d0f2c4
SHA1 d4f92a73cc7f447047f92f152b2c7f24a55e7220
SHA512 ba6c33cab7d79ae96d61260b748965c260143e7d9ee09991c466d214ca3cd1d8791c41905e6884bf2e30ee5cb9e72410f2c7e1ede59453357f0a32081cf8177a
SSDEEP 24576:1ZM3zFVSOb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1ZM3zfvLNiXicJFFRGNzj3
TLSH
T1DA750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ba0aaffecaff0dc2cd8b0ccf4f53850f8c3aa8b8cea26238d0e11db6b9fc3191
MD5 19af17041472cdc90970c4d32b5e4769
SHA1 4316d2d5ac932ea0bcded6a61944b5e54d5bf7d3
SHA512 14fb16d017bbc09ec699d2e330953e838d05146e6e46977b8f81b96f9ed571621dcacc4826e81b4daf3a34a8373ac7666401854bc9641f13af355af9b17503e2
SSDEEP 12288:fciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10A5523D3548955B1FAFC003E86754428F5885E2DEB5658E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 cdda3cccf61315f73b6ac99e3d796dc32a1fd7519da6ca274e1bb085ac398395
MD5 c58ae9705a1665148d758a7ae8367a9c
SHA1 adcd9746fe792c14d02f7175ce60a95c117d76ae
SHA512 2a555ee3aa2f47de88dbc9adb652618e0495643315790a90a08cb39dfa2d329ae997d4b625524d2e2e8d7bcb0b8f9b0ff93c3dcc2a06a829b5dba142969f39c5
SSDEEP 12288:PQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:PC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BA5523D3548955B1FABC003986754428F5886E2DEB5659E3E2083D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 4417be17218b48df6cca2ee69047dea7bfaf541a302d536cdb8ba74a66ba2d3e
MD5 15c1ef9ce4d33bb4b665741cb06f7c39
SHA1 55027402f562b7fd67268b5916b81a4749dcd465
SHA512 b5989d1071576efd3c18af2b2ae4d9b51289f5635037a55d5863ce2373a1c85e42bec56047d5306e487874af4339fd59d889eed3d3df900e1c5b71ad0ad99b99
SSDEEP 24576:8zy3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8ALNiXicJFFRGNzj3
TLSH
T1D4650247629530F9E17A4139C9620911F3B57C364B208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 4c7970f61278240c281f08dfd638c1faec89e54cceba7cf66ad83e4f93d3424c
MD5 167440508b8821d759a6b4ff6451269f
SHA1 8e4cfc546355f6c3e2eccd3f68af1bc2f188ff3d
SHA512 58a48b0ab49934fc506a889a66b1ff1706ea11042f3cb50076abe657e62694e0c9825c9f21a7a0f1133e5bc3abdf5e005a1fae87408903176dd7433d976dc53a
SSDEEP 12288:xciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1045523D3548955B1FBBC003E86754428F5881E2DEB5658E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 dd1793e9dbd442a63bea7e71359c4876dd9e85958f7c8dfcba766d3326b04d13
MD5 e3bd2aebcf1ac028eb4acc754bc2e874
SHA1 28e87a160c7f86a64ff74f289fa0fcff88a4b23c
SHA512 9a985e48059f15c3350456038cf5636bf5a114bce7bfbc619c2041fb48aa96065df9ab8bf831bcda00be628109cf8ba29b508e41d7282cd4d09688cc4a8fabb6
SSDEEP 12288:fciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1535523D3548955B1FABC003E86754428F5881E2DEB5658E3E2483D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 34fb46450cfbe8de98ec3a1bf2774cc90529cf0de91e695953fdff2c9afd9fb5
MD5 28eb0c390f75c8b9734ec4907492cef7
SHA1 7b27e053def579ea7106e36e52f136d0a059310c
SHA512 34fbeb09c58af80eaec5be906e7b20e8e4fc86be5d633107a623de437a4a977246868bb74b042a44e9801c15ee2b8b650157af89b9166d34477635c1de0148a7
SSDEEP 12288:HpsfMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:o2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DB65F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F3AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
MD5 29f1b2d1b6f9290138596cf180847e53
SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
TLSH
T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 168B
SHA256 2061473041240f19cd815a3280260ccffff5ab8bdf3f7922bf1a2e7e9833a2d4
MD5 236c81fff1060d03a2d02598943e29f8
SHA1 a40991e49fb519b47e1f25eb720099400bd74204
SHA512 f72f6d627cbb392e096dc82ecd588b347c0ddef09e1a0802f37721aab1967dd6ee8479b6a9dc452b545fde40889247173560e0f0eb812a67a2d9239f0fd00b92
TLSH
T136C08C0B37BE51E90F3700CAE6923F9292827260CB46CE30B3327B06B8A14120C1BC1C
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpB1E6.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpB1E6.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

TmpC939.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpC939.tmp
Size 3KB
SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
MD5 ec946860cff4f4a6d325a8de7d6254d2
SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
TLSH
T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a6dd236727ef87c6cd043c011d4c181a91195b38fe0674cda4d95603fa5eda41
MD5 fcd666fdfca0939f3fbde918160a84d3
SHA1 05ff900c30f832b4f7a3041209709d4804ca516d
SHA512 1c48322493a5f7fbfc8e451c4c76077b5351cb82a0aa82d42bef81dcf0a1f3e6b8acffd4bac9dc57d5b98c9264fd2c44d616df976b75c1f70e0ef39247bda4da
SSDEEP 12288:ppiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:p1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F6552393928C55A2F6FD103986758438B54D7E2C9F5598D3E2043A1EA238FEBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 12d71d19958b09a2c7b5658425e76402311eb6a9e2c003756b50f58057aa7997
MD5 1f8df2c343054a5ee1942e483ebaa44b
SHA1 218270aeb244ae05e8b3b4605a72d32a6340490f
SHA512 485abe26ac0693ce437b23945c097d6c4e0ddbeb88e95e6ce1f64590c0b659996f1b8e6d6fc77a2f2f84afffd33832e8ddb612812c22675e97638ad2d60a29b2
SSDEEP 49152:Ta0h2GEkuAe73q3pp46zwwQnLNiXicJFFRGNzj3:Ta0hNYG4Jws7wRGpj3
TLSH
T11785AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 0b7a59ea3e13bcfe420c3ce060979cc9f467f933b734ad7e2d24c647485128e1
MD5 04be3b89ca7c3318f8687058f7cfda35
SHA1 26954f9740fa95f339f2f020fa8d6604d52e1f1e
SHA512 71b4f7bb7ce7ace0e3f7a18fb5d7bd61fdcc03851a619837aa71cc0b951e74faebf3815f897f3a1c6443b46d643ab9ceca35b0170bccd70eef7a6056239a805f
SSDEEP 24576:1hbHjPL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1hbHjzLNiXicJFFRGNzj3
TLSH
T1FF5512BE129C20E5F6B5903D85668409E370BC29172197EF6381527E4F3BFE94E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 45efdc26dcb88412c3511e3c0119b69c65533ed7ef6f841e0b25fca5a850623b
MD5 b4d77a7a192f1f5b09f38ecd0cc28e68
SHA1 8d3b9c2265287f9e71586f8a5fa8c00e58c7a28b
SHA512 22ba22788471a3407af49fdb2119cf435563a9cf7dde974c86eb1d173222fded71d26a59321bb36c7ba25d9d94bc2e916a2cab269b5744e9ad81160bcdcccc9d
SSDEEP 24576:k3YgnJcRTk4yti+R5dBR/j/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kIgnaTk46pBR/jLNiXicJFFRGNzj3
TLSH
T13345B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE89F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 983ec114e9709227891199840216b0d11d4156c561e8674e10e3c3fc60f8edb5
MD5 584fcd0c391f2352a4006c3529ee584f
SHA1 ba1efc4c0423eaf6c240006c5ba99453b7039008
SHA512 c62e0f143090f990253a82a5e62c8d893e08f2b64f507abd7b217ea119eec24a33296735eef7a59ed65ba8eb896d668606386af288420bb54320279f3d4cdabe
SSDEEP 12288:u9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1855523D2518955B1EAFD003D86764428B5842F2C9B2619E3E1543D1EA27CFEFCF38563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 186257a5446cbe4c454d637cdbed6edf5147ff5b205aadde36ce51421083bbaf
MD5 0d2e20064f538f53ad9e65ce48d8dbb7
SHA1 2bf973940437d017d4ca920a13bf40416091415b
SHA512 ac1a961101fea48b29436857976d4d2f41ddab4196819d16b9030b8120d515d78a208ca54844300796c69bf767c450740df318c0aea025adcefea439a1a4f3fc
SSDEEP 24576:EAL3UTi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EAL3U+LNiXicJFFRGNzj3
TLSH
T15D750155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 be8242c30b9b57fc939eded3c57055e2757444240555b27685785c9520eb613c
MD5 a3a101eeda177902f158d33d37d37133
SHA1 e8e6646ed008f02c26d6348b52086859698e4774
SHA512 001dff81bddf99e7a24bf6ed6f33293ac47b075c388d75b8eaa960e16960d382d4d9c603865e369cf629da8dbcc8d8bce77bbf24e2735dc484f965659c69a6f1
SSDEEP 24576:UOV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UOVLNiXicJFFRGNzj3
TLSH
T1ED55126A32DC10F5E579503D8AA2820CE3B1BC29072257EF4290517E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 67af557fef33d9cf718c9feaf9becfb204454058bbbbfdc1f2168bbfaf630f31
MD5 c0b3fb9774b5a9c774ce092848e705ea
SHA1 c396da13cb9e3e1c990605504dc89908ca5c3a38
SHA512 24274649a6b705b277bf27397bf4608e37587b6dfe5d8db312425751762ffd1e23034c851caa7b903c8c7b782a1783abdd5ca3996e7ff5a5a0d9c0abeccbfc2a
SSDEEP 24576:M7NM9YqZqmWMUkPjZM48Mv6bEhsl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:M7cBWMpPjN8DbEh4LNiXicJFFRGNzj3
TLSH
T1F365AE2E6BEC81E5D577D13DC9A28205F2F1B8611B318ACB5162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 0d9a0da6060e4ee6ce727dee230a4d28754306c166b1f5d91037fe8d694fb4a5
MD5 3bf28f99a9b1c0ffcfe872083ddf663b
SHA1 c45b9f403933af337cee834f2943908e256e1016
SHA512 08b5ee75cc4404211c7d607f3a408a129ab09ad5d79bfef0afb1d4737470050bea98e712e15ba24d750ba1540b5b9bf2334dfeb51ac6374d755375f71ed0f170
SSDEEP 49152:yF2YuHNETovAvNYf8kmFLNiXicJFFRGNzj3:76BCf8ke7wRGpj3
TLSH
T1B2858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 94537fc88d1577261dae3257a852272e71b4dd94c1551a0589f1d31c8fb0cefa
MD5 1e66cccbdee20c51b3b46d36cebb2d1b
SHA1 c96f2a6e53cea42895df5be4078e89e38fe155ad
SHA512 1598f6775324f631b449ddf83ed792901e415a0a1222d77c8d75d853c6edf9afbf3ceb60ce9c92825979a5869e7ded7ba0b13072d9303e653a4dd3a2109e8ab0
SSDEEP 24576:OAFs06+Omlf8NXEbTo6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HFs060loXuHLNiXicJFFRGNzj3
TLSH
T1CD65BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 90ff737aa02224f7f9cba117b13a1cabc1e64ab7d0fa70a8a76ae6deb7c3048b
MD5 bee9ce777fcc54305565e61bfacb25aa
SHA1 e01021abba22685c08410c0a7d99d7549d674496
SHA512 3845a8ea6435d9f877fdc8da341e36c1b3591c18e9f697f41306c822299ac627a0f07411379954aa8ca982104e9b82b26563ef042a6f3b0bb83ce61b571419fe
SSDEEP 24576:vJnJ5D3WXH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vJnJ5DGXHLNiXicJFFRGNzj3
TLSH
T18875D02DD29810F4E4B7C274825A1A55FE72383D2F226AC724B4E5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c5153dc816d4a13e77056578f0d95d9f83af9a943884a0f6d9fa9ce4c8e0ccfb
MD5 542ca4d47b40a0d92cc36ae928ac7c56
SHA1 e5783d5cbdfa82a1a91361b55a4038c19ec79faa
SHA512 52286daf2343dfe3be2e22d89bc27ecad5cd15c0e0d9f084b0a32eedf72eaeb00b3ca4d63a476f02f7f32e2128329c7eba4ba9a4791164e0e6afaabb8511b66b
SSDEEP 49152:0g06DIKdwc+eQnSt65aVZLNiXicJFFRGNzj3:lr7wRGpj3
TLSH
T1E5956C16B7EA5294E8B3CAB1C962A5159B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 58a51fd1826024798638b0ceebf3e758e8dde0c5c973f0ea69b32c02fee68eb1
MD5 3d8dc2fa88e87ef8a9e5cba8b785053e
SHA1 7a51b92ad5645db9e8dd7f45cd97f04601002b32
SHA512 abc0c5fead0f9373cca076c7a759d86dc1f9b0a59936865755db13c028947a060b2fb9bfbe795dee05607f173366261b014c8524854e559d6a484c6a9520cb74
SSDEEP 24576:pn4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pn4LNiXicJFFRGNzj3
TLSH
T1425512AE278C70E5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 2687210c4226e9ceac8930c8f59ef0f124cc6ddd60bcf5158590676a52a9c7be
MD5 787dc82d0097922606dba4664b68d384
SHA1 95628a955db1da84c3b0ea704252d043ee73e27a
SHA512 c4c879ca7e767d9b6b46cbfa577fa21ae1086a488859d4f99afe91ac7e4c30eda2228a860649b2ce19b9fc5b676a7714f01732b0a356a8b3f78ed15bdbbde458
SSDEEP 24576:eIy7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eI0LNiXicJFFRGNzj3
TLSH
T15B65124553C860E5E6B9013CCA774064AA74BC349F2156EF9180BA3FAF36FD59E34B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 6b0ecc5ddf67bd60129139ddb3801dfb4881c374d85729b8b174d450fe2daab4
MD5 702eb247e6c29b3f752bb5a9c4afd72a
SHA1 425fb225403c816f07b7ca5ec7bac4b0614a37c7
SHA512 8f72cf230a00edb2b15bd30110ffe1fa617d622069b9167067c11d5686cb425307ef78ea949c765511c80e051bef163041ffbce3f69514b9e6e11c1e18d0f70c
SSDEEP 12288:9ykiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16255239A118964F1EABD003D86354824B1943E3C9B1628F7A1947E3ED339FDBDF39852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 3af0200a2c2840c8d5f4151e3bd05582a8a4affde08845e0eed9d7fe41d90793
MD5 14a16837e540d544127e8a1381732ea5
SHA1 497f03614e21b0997c753a8f22499df0a4be5739
SHA512 5a90019330606af567051f8f0efc386d545ac942fa0089598a0464a8e83b929bed07336c48b4499d13d7e77e90ed831f5c54ac116e7df4e620f3951bc9326c41
SSDEEP 24576:bQ9MxZKdcz9dw3d/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bVKZdLNiXicJFFRGNzj3
TLSH
T1EB558C2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 16ea574c164d6fe4f2840798e503379074516864aaefecc766d9e19c19fb6705
MD5 74ba3fdad4a19785b9beb2e798482478
SHA1 23b47a74062682592778c43cf8dd79d29da1bbee
SHA512 a8acbcd9255715da68de03ec895624678bc0f670dc42b8d8da008f11f57894e54981e6f9d71a050fe5d754c5fa9b0a458f5ffe5792e85fceac4f920c95338eb4
SSDEEP 24576:+yocDApk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DocDApkLNiXicJFFRGNzj3
TLSH
T14165E05FB76D40A2E176813C89858204E7B3B4345B6257DB6181C73D8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 182e57d5ac15f92849eb9eac4f6ca74abd76e8f6ccad3b6d165351bfa490253b
MD5 bf82422495fbb266fdfbb13d46bb5777
SHA1 9d7df242218a7229336c50d5852848d2a4cd8c09
SHA512 4793c27c0a09a67e8bfd6b5e7e43f3abcca221da0e91c19c52a5bea41ca12bed6b403e317ddd7c4585429b73e6ed41158efb0a176be65d9159edbbc50475d985
SSDEEP 49152:yWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKkLNiXicJFFRGNzj3:k0zuNIi7wRGpj3
TLSH
T109A57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 96d065055f714ae1e9a9b7448ab2e3a065158ae8c61eb9f58f233361da1a2472
MD5 974af6caf11f9aea424e709af24f8dd7
SHA1 8f185118836403e574f4d19315ceed76255f362e
SHA512 2d6ca68e7577a81c64899576d239268610b8dccf643042a0abc2758ce05b59327e7d76f1c3ea22732395da601b0ed906adc0c915d95659a9837cef97e6f8ef10
SSDEEP 24576:S1QT7EcpfxR+N5AWAz3ooiYzjMqb4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PTDxR+N5YzTBjM1LNiXicJFFRGNzj3
TLSH
T16955B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 eb664fb72a43c0c287068f4ec2f050e5ae37e4586082b3a126f8f840d6a9c2bf
MD5 4e4a1542c326bea8a282a2ec162d05bc
SHA1 eb477dc984e0a396ab7ffd4429c669250e800946
SHA512 934406f3b6a4fc80c82ebb09badeab71ff766f985e8c2486ad59b17d8bd75c5846ff9fdc9b5f5114ae595515247799e1ef0d8c9261275dbb115f6edf8c09b639
SSDEEP 12288:B4KdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E755125A13D830E0F5BA5139CA364014A260BC3957255AFF71D0E97E9B36FDACE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/116-668-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/116-568-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/1120-582-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1120-735-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1168-310-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/1432-571-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1432-573-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1452-182-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1452-176-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1452-308-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/1472-585-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/1472-535-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/1584-669-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1584-575-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2124-40-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2124-39-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2408-21-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2408-37-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/2408-15-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2452-23-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2452-336-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2464-752-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/2464-598-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/2560-337-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2560-38-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2560-29-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2560-35-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3032-545-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3032-662-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3032-546-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3032-552-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3092-664-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/3092-557-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/3092-564-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3092-558-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3476-76-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/3476-70-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/3476-307-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4120-689-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-698-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-709-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-708-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-704-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-705-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-706-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-707-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-703-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-702-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-693-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-694-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-695-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-696-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-699-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-701-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-700-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-697-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-692-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-690-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-691-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-688-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-687-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-686-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-677-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-679-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-680-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-684-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-670-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-671-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-672-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-673-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-675-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-674-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-676-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-678-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-681-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-682-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-683-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4120-685-0x000002A2D4110000-0x000002A2D4120000-memory.dmp

Download

memory/4420-306-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4420-338-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4420-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4420-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4428-8-0x0000000000AF0000-0x0000000000B56000-memory.dmp

Download

memory/4428-1-0x0000000000AF0000-0x0000000000B56000-memory.dmp

Download

memory/4428-130-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/4428-0-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/4468-718-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4468-578-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4472-659-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/4472-542-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/4492-62-0x0000000001760000-0x00000000017C0000-memory.dmp

Download

memory/4492-59-0x0000000001760000-0x00000000017C0000-memory.dmp

Download

memory/4492-65-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4492-53-0x0000000001760000-0x00000000017C0000-memory.dmp

Download

memory/4836-667-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4836-607-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4836-538-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4980-526-0x0000000000860000-0x00000000008C6000-memory.dmp

Download

memory/4980-581-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4980-525-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4980-531-0x0000000000860000-0x00000000008C6000-memory.dmp

Download

memory/5028-520-0x0000000000400000-0x00000000005F3000-memory.dmp

Download

memory/5028-663-0x0000000000400000-0x00000000005F3000-memory.dmp

Download

memory/5028-474-0x0000000000400000-0x00000000005F3000-memory.dmp

Download

memory/5040-656-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/5040-599-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5040-665-0x000000000C940000-0x000000000C948000-memory.dmp

Download

memory/5040-640-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/5040-753-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5040-624-0x0000000001770000-0x0000000001780000-memory.dmp

Download