stealc | bf201b942fe53b27b4ab5f12d737b5d82c056e0d9766f179f3109c2d67566dc1

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
Size 3.1MB
Sample260930-e3lk8ssx8q
SHA256 bf201b942fe53b27b4ab5f12d737b5d82c056e0d9766f179f3109c2d67566dc1
MD5 217a577f0442c33de4fe3aecac5486c7
SHA1 92fc0628c187f2487e38f925ce1eb4176ce39b29
SHA512 0df71279c4682ea56ec08439bab25b3ac8926c1ba8de2397c1d1f575af72f839669f0ed7f78d426f1ece22cc045ece618677ca6b339e2784dd6047d2af884358
SSDEEP 49152:95qMFA9n/TDbXNKdV05w8t5GN/AxsMRqhqA9n/TDbXNKd:95qRfb9sO5w8tANYiMRqhbfb9s
TLSH
T155E512007BE08035D2B328714A7D9B19996DBD716F6182CFA385372E9E70AD1E931B1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc spyware stealer upx

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/4256-291-0x0000000000400000-0x000000000071B000-memory.dmp	family_stealc_v3

Executes dropped EXE 12 IoCs

pid	Process
4624	elevation_service.exe
5784	elevation_service.exe
1956	maintenanceservice.exe
5000	OSE.EXE
5748	PerceptionSimulationService.exe
5912	perfhost.exe
4300	ReFsDedupSvc.exe
3036	SensorDataService.exe
5740	ssh-agent.exe
2784	AgentService.exe
4304	SearchIndexer.exe
3560	Reader_sl.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3e240c973a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00010000000093de-195.dat	upx
behavioral2/files/0x0001000000009952-201.dat	upx
behavioral2/files/0x000100000000934f-194.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Backup	AdobeARM.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Reader_sl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Reader_sl.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002983155f9450dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e16aa71c9450dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b272d85e9450dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec597b1c9450dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fce3a51d9450dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc92c3229450dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c1b2261d9450dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b0def5209450dd01	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Reader_sl.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4256	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
4256	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
4256	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
4256	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
4256	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
4256	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
4256	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
4256	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
4256	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
4256	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
4624	elevation_service.exe
5784	elevation_service.exe
5784	elevation_service.exe
5784	elevation_service.exe
5784	elevation_service.exe
5784	elevation_service.exe
5784	elevation_service.exe
5784	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4256	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
Token: SeBackupPrivilege	4300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4300	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4300	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4300	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2784	AgentService.exe
Token: 33	4304	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4304	SearchIndexer.exe
Token: SeDebugPrivilege	4624	elevation_service.exe
Token: SeDebugPrivilege	5784	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4912	AdobeARM.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 4472	4304	SearchIndexer.exe	100
PID 4256 wrote to memory of 4912	4256	2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe	101
PID 4304 wrote to memory of 5608	4304	SearchIndexer.exe	104
PID 4304 wrote to memory of 2740	4304	SearchIndexer.exe	105
PID 4304 wrote to memory of 1988	4304	SearchIndexer.exe	106
PID 4912 wrote to memory of 3560	4912	AdobeARM.exe	108
PID 4304 wrote to memory of 5908	4304	SearchIndexer.exe	109
PID 4304 wrote to memory of 5484	4304	SearchIndexer.exe	110
PID 4304 wrote to memory of 4484	4304	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_217a577f0442c33de4fe3aecac5486c7_amadey_elex_rhadamanthys_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5784

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1956

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5000

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5748

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5912

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4300

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3036

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5740

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2784

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4472
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5608
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1632 1628 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2740
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1664 1660 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1988
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5908
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1632 1628 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5484
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1664 1660 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RdrCEF.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Size 9.9MB
SHA256 f90ddf95156308a5e8174bec5de0a23a06e50207e8ff6046ce616a7bbd8b8737
MD5 a7cc0ec7084e6e51ac0b84037abcc77b
SHA1 44f2cf0e592d03c6be3def20618c0969da4de10f
SHA512 3ae21e76dc5e3b7922c314180545fa828ce19599414c62dd5d63e22edd28ec4fdce935e09a34ea59d7555bbdebf861a94f1553a7bc2ad9ce15252e26420f8db6
SSDEEP 98304:yrbT5DhEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTPfb9s:QdnfW/JLGMcblLheT79
TLSH
T182A6AF1D7BE21036CD732176AF4FA104E739D007A215C6977ADC83981FB1AA152B6FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 3.0MB
SHA256 a22fb040a1443ddf5ad4c15c277b03cc84b3ff9ebe7212ceb90381f4f8e176a2
MD5 c79c6bda2e6c2eedb998141daf5d755d
SHA1 67e58764efd484e0797a7631d7019577ba13c26c
SHA512 1e38a4bea461b82fd9bfef0858606dbf6ca7895bbd77d8a593b6767851b0d0701e4f3716b249c870b799bc49e11bc5b289d82f66112b670e885b42d087b8f98f
SSDEEP 49152:qTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJfA9n/TDbXNKd:qTfiG/nzU90Afb9s
TLSH
T13DE5E526A2C8C0EBD5642170CC69BBF900546D78DBA2CDD7BD447E16BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
Size 1.5MB
SHA256 db461754fb3fa01f685130546536b1662c953418955735df856155dae5a97d01
MD5 a9e5cec20c07abbe4a191ed519282604
SHA1 26bc259f4b18c198dcbfd1cc6afb83a543d81552
SHA512 500163999c0ca27313b991e1311df348a8eefcdbcf605f1e893fca8d5cacceec18fbeabcda2ab8519598b04c15fb5138a114d04f31088da02711b62cefb22185
SSDEEP 12288:LFttBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dvh:xttUeA9n/TM4NZYeNm+9MhUwd5
TLSH
T1DB6522432FA98FB2CA4506B504A96B2CD9BAFD28EF4557E74705362B4E3C1C28D3215F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
Size 1.5MB
SHA256 87d2caeb2f11bc1a15c3ae5b3fa32e5b29b7343b157f02c7373d43443a87460f
MD5 1cdc2232d04fe10bff5ae6e8b817bcb3
SHA1 2411ec641776aa7baa0da1eb61d7b3422ac108bb
SHA512 d019149f6ce99ba7e4a46339c7a7b1728c50bfb08073d6d5d16f3ad71d41de466c9751474996e640e623d4e50347626d1eddfbd4b281483f797e1c69736b0470
SSDEEP 12288:F5y9BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2ded:FOUeA9n/TM4NZYeNm+9MhUwdo
TLSH
T176751211B6C549F2C7660172496ABB4E9418FD3C4B2285D7A3985B3E9E340C3CFB399B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.8MB
SHA256 3e3115beba8f2ba31db479d8adffcf8124589f9c039ada2f90dcea7cd51bf7ef
MD5 e423ae023fef75244b4b877bb3456207
SHA1 c070967590f7e4db9a01c6b88d4a40efd2abf0f1
SHA512 004ac29cf110714ee32237a408dcf3bade96d5cb7b4e0ecd60581ad8eafbe275d7227ecd4ea16f86b76056f93d73d85249f627dfe5b539769496e9a56a8f46ab
SSDEEP 24576:5HTAbD+OmeRUeA9n/TM4NZYeNm+9MhUwdD:hTAGOmedA9n/TDbXNKd
TLSH
T1D395E01037D0C035F1B329768ABFE728556DBD715F6882CFA388162E5E706E1AA3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 45aa3f31fa5bcecce136bd03c71bfd34049176d56d352b5c7f69c65176b86b02
MD5 ce72b4f0608b3b8435b07a52460e1ad9
SHA1 80884dc234a4ed873283df4d24cb06d71d9da823
SHA512 f2714108f94c1522b72ada7d3acdf15c34d213a8a9854e1a8a85f406eac4d37201f9e7cb878a5968343e8d3d88c574b94ead3b17bab549be96e18a0218fcef86
SSDEEP 49152:cb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnRA9n/TDbXNKd:G3q6HjBjfb9s
TLSH
T195D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 489466ff55c64b0c966145e56693ddfac46113ab9a63156edb5ca5fcd208bc78
MD5 dbab87b027d2f36b4bfb35898d3be38c
SHA1 bf12b788792f52cdea444a8f27fd17abd9f8598f
SHA512 e693432a942c9a833b5d087e79b1c5f9813c4e0ce5e8c340e1949d4155346bb8dbe8a751a00497385e3586e2a41d9ee2d9e9f95f5aa00d8445928efe0540260c
SSDEEP 24576:gXYfDtczA8UeA9n/TM4NZYeNm+9MhUwd:XtcPA9n/TDbXNKd
TLSH
T1C785022967E408F9DD67827CC8A28505EA73BC454760E7DF03A4992A1F333D85E3EB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 a49d87d844f3375dbdc56c8e30ed7d118fda475b59b8a53382eb215b6d5fbf8a
MD5 cd17d13c497e23683909fa8a25fd6888
SHA1 40bc26f0ef592bdd442695b5529da201851de40d
SHA512 5c8191032d7570740d1f33370a9ce4c6d3c0bcc212be19172fe45f578021bb92c2197f41cc3dc3aea3e85448b86e76e574efe33778e0dbb0ec5c93c7ef3d582e
SSDEEP 24576:90Le5ji0hmxYrMdUeA9n/TM4NZYeNm+9MhUwd:9Pji0A2oA9n/TDbXNKd
TLSH
T188959E16F6748731D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2fe4724e616c52fd37c077a01accd22d348bff646a38c129e07252b53b3efbe9
MD5 63c073c55c73817760e4662b85b5b973
SHA1 39ff701f3cd04abd9c601faf125855c8f7a31fa7
SHA512 02374b8fd7106ec93ff41b867067e576d6d0cbe0e1c73ba8d2961e571030e913009ce7d0140a2e9822d756d191ed6c3b50527cbc5ed8b56659e8c56c4cc1ae91
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWE6q8wyu7UeA9n/TM4NZYeNm+9MhUwd:W/ezSC6vUzPvxHjyEA9n/TDbXNKd
TLSH
T162755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f8908a34d03e6c004ea2a29c2a91c93b5c04ce4ec53cf58dc88afc1f131f1f60
MD5 1ecf6a59c71b7439c194215f25adbd35
SHA1 9a8b01c8a9125934e075e05abd24f8375f01adb2
SHA512 de0038f52f856a2fc4a1f9e67ebcaf8d43f25bd9c8cff313c3c7a306019bf09a600743e7d8d9a255513cc0fb5857be1235ad6c2e2ddb1805d9651cc31a99de4f
SSDEEP 24576:LVbqPb88hv/l+6QUeA9n/TM4NZYeNm+9MhUwd:LVO88hXl+FA9n/TDbXNKd
TLSH
T182559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 2b4fbd57fd06bb0b077c3abb027d47e18e2e87d926c7079d1459a6d9576718d9
MD5 4065ab0eb592db5278ba76be9f885b55
SHA1 b7ae15a3d0e8d2683d231617518201f632f0f826
SHA512 5d4af363323d638ae4bfef6c765bb3240885b8c22edd724c6cfbb3fbcee924f56820a39ccbb804a42bf5a8bbd85952f44c8492aae6a8bb9ad5f33509c7fce7fe
SSDEEP 12288:sHxBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dLZ:sHxUeA9n/TM4NZYeNm+9MhUwd9
TLSH
T1636523824FFC08F1C78E0A7544AABF0C8DA2FD4DE585879D4319762E5E385C6C96648F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 34b86265d659a8966154d5657a67266a88b2851b9e8f467b2a86537d6f98f21d
MD5 8cb83e6198dd98152e156f1d3a7c9da5
SHA1 0496f9bdcfafdbb37957277ee744770c5c27c6e9
SHA512 db5a177b6858f0634efc66f23206c648d875be0324e74e5ceafd2c50629376d5626234724684544eff5703d9d87c77f29175b5dac18375c1a17d83e33bceb4a6
SSDEEP 12288:4eBNUbTVO86UYBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dw:4JIUYUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1C485CF7BAE38ECE2C27E4DB95A918700D77278304B5293CBD165830EDE235E15E7AC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ff87c8571eea3a6792c0151a0f27787d95c94bf963c0e214ec96124442fe37d1
MD5 972ed14379f32170a5800d7a7852f887
SHA1 ebf2e290705d3387ca5bdf4ee6eb43b6e9cd7cb1
SHA512 59eb02734e864f5c72772545a6ab66151de84c2c5a3478cd1ce5b70bfdd67e672cb0a784139ecc774a7627dd3023150366896030191665539c58fdfdbb63af7f
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THi:JQvGAdlCEL8c/yRNw5Csfb9s
TLSH
T12B267D656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 215032c0141945404ac75e95ca0aec0c664756b2026bf08748cdb15e2db82399
MD5 e1f8d2e9c0ad5d4e43d2136e0c7397ce
SHA1 ff3db241b6d6b90b41ed02aed8be9950c8c6743b
SHA512 d255b0352af84876fa2ea595b09b9dd535b7aa0edcc460e033cf90936772267cede6d92834d5e2855f716a03085bd19e81eadf384bec0623c3e75154c17bbff7
SSDEEP 12288:ZAwSfxL/2Dc3SDLLmt0LDQewsAjuBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9e:K7ewsAjuUeA9n/TM4NZYeNm+9MhUwdC
TLSH
T18D85E031FE74D432C3BF0DB21B36D706586DB9204B511AC3E3A89E9E59302D26776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e046924a0df8030b56e17aace5935019a6c710c393ce9be2ba9f29f6f76689d9
MD5 0800386f1bb28388a70d2f19ccc252ee
SHA1 3d35d1b8c2686f5885af9c0154e375758d16165b
SHA512 53262da05616aeece9443529a64d3e972b237287b8d55c036037bedfd203636a2c432a5c91abc4e96418cd9f695d274e955b3c34629f1849f52b6bfcce266764
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHN9:dUEtQevvqc2W1cpV2EI32
TLSH
T19C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2d9aa617219ff4fd11fc7aba0cfc0ddbe04ecea3f45e1a252ffb132490d9c111
MD5 b44a34ac67162a12c6c5e9e0e87fccd0
SHA1 bc16c887e45c797134ac816f847e995612a80a70
SHA512 29f160a3b099afc72424e9423418b8ffa5a4a940d39988dabddacde65207275fe72404a0c9c425cb90b0760007a53eaff61a34d5e0b9b49ba89a6f76bca4242a
SSDEEP 49152:YCbRquA/m2yL5zTfFiV+XenmE3/z4A9n/TDbXNKd:RoquVjnmwfb9s
TLSH
T119D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 31ac3c9f75cbe6d1be4e6c7837834f4ca7c21a906f7815a0633304543646e31f
MD5 6fe196ace0f26cc9d6fdcbc335c10556
SHA1 6e6c44427384befa161ae4f23702ad8a2378cb45
SHA512 9b4cc609f4f55b2ed307059cea913d0750726ea533e143c109e99927cb16f315a0ab9d7b04474b536692afda1802646ce23a7d800bae40dba3ef29eb69cceb32
SSDEEP 24576:ZAhGLJIFoiwtA5l7S53HUeA9n/TM4NZYeNm+9MhUwd:ZAMyFoiq5LA9n/TDbXNKd
TLSH
T17C359D81EBF945D4F5B3AAB899B69570EA76BCAA5E31C20F1150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 d2bdb985d021e81a63f4e9e9428f2f6583c874309b2f4d5d623ed76b449d1d9b
MD5 e986b24ed295f5be41209afb0ead0cfd
SHA1 6f90c9d216e175b03c5948e6601e2ba77fc6f7b8
SHA512 2f813dba37011c406831c1ab55d1772ea26835d2bd1268e235988a41a40a524dc5470e38aaa0e3566ed25bba26503b1ff7e8cd07b2488b4607d26c02c2dbf152
SSDEEP 12288:5mw5HEjsChNzBFgl0WDm+CbBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dI:UwuSOWqUeA9n/TM4NZYeNm+9MhUwd
TLSH
T14885F14677E80CF9DA6742398597D635EBF2BC062A21C71F0760C61B5F37261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 c258496e432ab1672db1796ccfca38b5bfff76e391daf3d0ed232b944ba0b34b
MD5 d52fd0105583639d7df33fd62660f3a0
SHA1 4e28ac936089850294ff7fff506de8ce2a300ff7
SHA512 c8848ed6cc9e8694333251ce2f6e377b29f141ce03a2679fa7c8fa1c77e580d5035e3e2ecdf39a28c493df355f502725241998c68ea1c1024a58a05f4fb8a6ad
SSDEEP 12288:WjZ1IyeBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dD:CZuFUeA9n/TM4NZYeNm+9MhUwd
TLSH
T12175128627F810F5C397527DC8E56B08DBB27C5A637543CF0625526A1F32AC28E3A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 721ae382cefbf5d60660bad54676d09b2bf764a10de08d5441cdbb397f73df52
MD5 d6a628794efc2659e1cd62572b75fcc2
SHA1 6f2c62f31759590b49731e70e1570cff5cf54bf8
SHA512 49d9766467cae88261f8ff301074ce8ad772943a35f9a60eec2f72e7e9ccd3a6d1881b4b33d7b589e2f1d2469b1095551a8503831c152b96f4c04f3d43a35a1d
SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UO:lQRQyi36YOcPQLvw2gAf+PN3ffb9s
TLSH
T159666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 151e97f463d2072810bbdef5c4ed9b07e2ac6e537a42e1e5162223c8b18b6148
MD5 56906c9991c40e046ffdfa332c08627d
SHA1 e1df0d2660c4281f64dca4aa5254c79b303b4821
SHA512 3ede40b34910375b20b8cc2c85a4197ccc64d450d66d2fcb1ebe06ea26e5475596ac25ca770b54e41786c7ba6bbc6c284d3bc6120e3de7467b257fe096ceb5d1
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UO:uQRQyi36YOcPQLvw2gAf+PN3ffb9s
TLSH
T1D8666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 49b262cb34dbcf8b2a78099a1c86cc6ca047b1b78778ddfa136f5a2408611099
MD5 27176670f7c6887e097b5fd4dc21c20d
SHA1 be1121800f30e89756af3129bb5073e5b414bf47
SHA512 1e6d44419bb854dedd63460401ede5e998d740496e833cc250fd334702baf48dde9a3bd1f074dbe0bc810eae1f6669a2116cd5e0c54e8251944e7720ce6e1b14
SSDEEP 24576:JwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0VUeA9n/TM4NZYeq:V68Qg55nhheWu7PNU3/oA9n/TDbXNKd
TLSH
T16FB55A33B2F600A9C44DE1769F4A972196D27C758FE0E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a71a8421ceaa5618fc2880aa08e6e873ac19b3dffb72ad8bbe9b667851e73ed6
MD5 926f8ed8511427b7df53cba6a49fada4
SHA1 76406061fbd7ce68a2d3a89a14c6af4d76b99a24
SHA512 477d933c37fc5815c5e30921fdc573d9b0f27f1758fa4a55db53480900b3ae396a39d86aba273cd0d262d37983ce1b2726520e9d5f5c8571b0f7209d361d049c
SSDEEP 49152:Q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99s:dy5112gYy5azzVvL69nLKnhZOfb9s
TLSH
T1BB167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 70689d006b97a7bba9e35b00570857464cb6cdad13c6c688f9024b616a66c724
MD5 29c0465f7e472eff96e2dd1b4b02b8bc
SHA1 4a2f741113e533f8c399128212b42b670bcebb1f
SHA512 ffae59b727d8d6ca25ad78730f6d2c530b71ce225eb9bae1d8401e531d5d7fcc2dd85ecf6f47cd574bc056ff00ad89944aaa74d86ed762c94723c628bb12ed80
SSDEEP 49152:PB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glOA9n/TDbXNKd:xu6JmVxd2d3fb9s
TLSH
T1ABD59D13F1D901E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4db02562c27fe777bb6e4fcad8ccc5c9884ea4b6786c0d3a6695e721a037efec
MD5 31b71ada180c0e25bd94db392eb655b6
SHA1 ddc75c770fbb8b113ae795d7ae2cc3597e2d8f2f
SHA512 be7782bffdbcfe776379283d5290c5f18e6a91cc905aa7d8a783fad3fc2096b06ff58042fb32cb19d2446b0842c4294fef7a32dc5eabd15565f1cabf838c0053
SSDEEP 49152:b1hpsNoJpF1A6UU44CwH7R4xcA9n/TDbXNKd:bmifPbRKfb9s
TLSH
T1EAB5BE13F2D800E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 867ac925456fec4b562986b8f8f8c51ca2567c5e6c8c05345567bf6b0fe512f9
MD5 97c938bd2646c8ad784d11ef0715b83f
SHA1 f010366d558d477b366fe6c4a08adc5b4ec6dc64
SHA512 6f185c8ea6ffb5bd5b2bd98acc85a19f77b726ae73ee94b427cd925144a835c46919ca1e12d74f3307a35897e6d30aa92ae1f85740c5064876bb4c0d97d5fdf7
SSDEEP 49152:PSuZQIY0Be2KRRVtOnks6NMHqrA9n/TDbXNKd:15dKTi61Afb9s
TLSH
T15DC5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 162139cfbbb814dcdc2bd25ddb8abec492ca4eba39522fb5473da66fdeec17c8
MD5 a3ff69125b4c77ab96c87d6c0729add8
SHA1 3d8557a655acbf231d819c1b89d83962df4caa5d
SHA512 28910b703fa0f88f633cf3756bc300a6a12f02f54203c3b1c23da90262580161a6f3552b128317c76bbdcf9cbe469693c5d3690b15b0f775a294f04ec8daa2a3
SSDEEP 49152:+htSn8EApI0figngiDn0AP5wAA9n/TDbXNKd:fX2iyphOfb9s
TLSH
T12E95BF13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 a1b10e39a2f8e81101a9017ad1702785c0b4c46e5883a8ea87f30dc9e61ea021
MD5 dad797ab705e617e21773144916152d3
SHA1 df890084222d5d61b1776a4a6948c32f122ee0d0
SHA512 5dd8f76beb2b1df7856dbf3fa92cd874a1811c047f674ad19935be5c16bbebffca74d18ab47a57b18225daa58ed736de3c1bdc4752c2b86db39c1a67de5faa66
SSDEEP 12288:/7BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dM:/7UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1A46523824FFC09F5C74A0AB580A57B0CCD92BE4FF685439E471D722A5B345C6CA664CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 249c26c306edb9c85a41cc9c279efe34aae71d37b6a2c0387c2fc2806ace65c1
MD5 49eaf413f74b5d02b988669963c2bd5a
SHA1 eb42597c792fb9ac0b2c5ebf45dbdba3697991a7
SHA512 ac01e646a60773e46775f4a508d7246d0db20e7256edaf444e29b1d9422be48e9f0a5d7fabfd0fa698e05f5f2a3cac0ba5eeb9d0c062c19e80bb3bc19204977a
SSDEEP 12288:QYBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d2:QYUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1B16523824FFC09F5C74A06B581A67B0CCDA2BE4FF685439E471D712A5B385C6CA168CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 43d4cd70f4f88e6c49cd209d6854174a68f4e72087fa0dcfe6b2dc5980bc2cbf
MD5 38585004efc022d95cc8d50f876d5af9
SHA1 d064c3678244c4caeb9d7c5a7f32a0c49caf1284
SHA512 d460662d752e754b247cd38a5c88d73451d3292aa05ffeed66b960c95e202ea62b19e042f075d9c48cbf86e5ed5e5aba57d0693916f120525c880d63452ff7e7
SSDEEP 12288:SqBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dP:SqUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1656523824FFC09F5C74A0AB581A67B0CCDA1BD4FF685439E470E712A5B385C6CA664CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 936a1b57393761b65819b235fa6dc9a230e9ce754c17b1111fa634e168de9bef
MD5 8367b989490c91222c7803dec89a84cc
SHA1 6a4fd3d6fb58804fa5ff95bc3f862801ffdab1b8
SHA512 fd328008e46138d1ab32f6adaa3500b82b27ac525f85ef384db752f7de851b111eac05ce6edfe5467cf3e7908e651e48dc97bd0c3259028c27be301c0e6703da
SSDEEP 12288:rVlBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dk:nUeA9n/TM4NZYeNm+9MhUwd
TLSH
T14E6523821BFC04F5C74A9679C4A6AB08DAB2BD4EF76683DF4705251A1F302C5CD35A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 4223703fbd4ead49beddaa284c447956906022fcf42de6ddd558d8918f755f0c
MD5 ef987ce53d664cf2a8ea5e87ec6c5a11
SHA1 cc1c54435b7fb21b14aa23af776e3dbd97485d98
SHA512 5494eb7d6685f6678be0e056c4f7fcae6737f97b0aabb821aad3d91d180cad11646fe6eead306ed401a4a702ea949d444d1e9011001b606f1582c3a92d6258b8
SSDEEP 12288:3dBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2do:3dUeA9n/TM4NZYeNm+9MhUwd
TLSH
T15E6523824FFC09F5C74A06B581A67B0CCDA1BE4FF685439E470D712A5B385C6CA664CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 1b21b80615f84f899320be223a25e3addd2726c448a94e08ed36e772f37a1582
MD5 812d2ba6e851e23f0fc410771445f165
SHA1 a88e26bcc0697c901d7bf404d05b6d3eef48d51d
SHA512 c9653a39738dcf102df001723f9bc17e6ed37d3fae5fbd1dad03c3f6a7d1a1c0cfbcf7239fdba46deb3fbf89dcbc0b23339c02ca31628fb1e03ed534d67ab17c
SSDEEP 12288:2sBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2do:2sUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1BC6523824FFC09F5C74A06B585A67B0CCDA1BE4FF685439E470D712A5B345C6CA168CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 99017580684cda37234a1f855d7af3c45911c0755a884b4b2e920f6b789e0e4d
MD5 3059b2ddbb6f133ed4bf211518f8a568
SHA1 a3190704c054ed6494844aa3eb2f0364e6c1f588
SHA512 d932fee84d97113dc3981a23c931f76d8da650758ea668f648876f87ed252b10edd1ae6b3d54003e8debad66e908cf2189d7cb17e3269089c7e6847acbc3fa1f
SSDEEP 12288:BwBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dK:BwUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1886523824FFC09F5C74A06B581A57B0CCDA2BE4FF685839E471D712A6B385C6C9168CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 ef91ffa365866787267b127da09b487d152869fc0c8cac483434391e42a2a6f2
MD5 e49fc57d90510796561b2535175e96ac
SHA1 b8173c122046e27494fb99c6224ca1fb23402bae
SHA512 d14131122f56492cf2d6057b9a85706cf18a1364a7b797b3fc121199cf935b4c4432de5b3404e3864f94b7e37810fdee6e0959e95760e1c4abe2c312a1862342
SSDEEP 24576:eZMEzFVSO4UeA9n/TM4NZYeNm+9MhUwd:eZMEzfeA9n/TDbXNKd
TLSH
T10585029573A00CF4DD67423EC8659A05D6B2BC1A5760C75F03A8362B5F333A14D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 6d6372687129b2ea56b5358626e058fa72a190f0d9e0e91b85a6a8e5d9b8f964
MD5 6d1aee2d72602665f160929ed6346fd9
SHA1 7fb159eb5f26343281d4217ee13c41039eae324b
SHA512 1a60d6e25a242634c9998c5594894321efd1fbebeb849afdb5fafcf636010fe02e4385d8432cd86b73a470bb41722550a7a1e66a675b9e37b0bde8a2d3dba774
SSDEEP 12288:WnBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dS:WnUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1F66523824FFC09F5C74A06B581A67B0CCDA1BE4FF685439E471E722A5B385C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 879afd2c6b045258ee843ac80bdfef8b0bc05f91de10e84fe196441535024703
MD5 b27244616844dd3d75cef10e06d8224e
SHA1 aa7a8f5cce3e9decd9f9e76d605fb4a8a8afbbe4
SHA512 b5d2f11e50f7065436a79c87fb60bf12ad9f10438c771126a8e57d492036acd1e66047254cf73d6595d6d5cd5efa7c426165188569bbf326928ab08335869932
SSDEEP 12288:4DBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dr:4DUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1C16523824FFC09F5C74A06B581A57B0CCDA1BE4FF686439E471D722A6B385C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 2f08e5fe26b99caf822376ce6860f4e27279f50443db63713519d8bb91516241
MD5 2002a5521eeceef7f0a8d29905bf5b2c
SHA1 613d0f6398326d00c05c3d4889d8c0fdf57702b8
SHA512 73acee6fd672ddb15687f084b2b4d7f1f67543be2279b96c9fcb250b7d625dda98ed9d8dc44fdc03e32b49161518145803cc2daa43af6a1e5c97f6f4044a536e
SSDEEP 12288:tyPz5L80BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d2:Ezy0UeA9n/TM4NZYeNm+9MhUwd
TLSH
T15775024767B420F9C2674239C8A21B05F772BC3A57608BAF036417362F376D19E3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 a8451bf0474f1149df4c3bdbf41b8a9d4577732c6c37eca097c64b5187ed158e
MD5 be24e6c6788708ec8c8815b3191aa50c
SHA1 5fc84a1b920c3cc53dfb869f226607273aa1b1c7
SHA512 84fb8c9cd3f5ad1b8262fa3cf7abfbb73b6a9cf91a0051d352d78c46768a89eefc94f66ea7201344219538cca646b1312053b428c479c58e5818eab9ec59ece0
SSDEEP 12288:7nBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dE:7nUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1556523824BFC09F5C74A06B581A67B0CCDA1BE4FF68543DE471E722A5B385C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 77198d3ce20c5a00732e61ee7dd85f3f39b7845e76b8938b8a577e75db8b1017
MD5 847c7699789ac53af756641b0fee275f
SHA1 c461e15d69525ba2b2868cff08ef762a32e1f5c3
SHA512 d91da8b89efdf06f3ff4ac301c7cae2c6644bcae6b5a0c2c1567f3a9113712db1334add33b411631882e426d575f8a47b7a3fc9a176463362d717597de8dc6d9
SSDEEP 12288:KnBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dH:KnUeA9n/TM4NZYeNm+9MhUwd
TLSH
T14F6523824FFC09F5C74A06B581A57B0CCDA1BE4FF685439E471E722A5B385C6CA264CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 d0c67fc0a7bfdab79ed4f1d0468f3e88b8554caf766b1f9b5c6a803c5a2d5f17
MD5 b3459d4df06929915405b324c5c658bf
SHA1 ff946a8422d38c73955bc466078c262007a42663
SHA512 37c8508eac535f748dd70c7f472ac7432373d8a6b793d762f520a1d735a696ab0468cac4d84b05128b3cbc146fdfd469361401f37302ecd0b27dda71b53dbf14
SSDEEP 24576:gfwv+k9RX6wkyAIRUeA9n/TM4NZYeNm+9MhUwd:+MnYIdA9n/TDbXNKd
TLSH
T12795CF29EBDC04E5E1B7923C89B7460AF6B178591B31C2CF025A536E0E37ED49E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ba9646bce05e92191c2da7b826b69a36f27f3a68a338521cd5aee21cb851575f
MD5 579a5faf342379621afdd6cd674e431a
SHA1 0b86ab4e2242b8a451e7c4a40268197273396f34
SHA512 86bb47a1eeed52b95b5302cb0129d4cb92efb12488db4cac36aa251a95be7926beb3b98aa07c07dc86a996a2f94d7499a75c3a0fb3cca56989129f0d1ad898fd
SSDEEP 49152:tYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0eA9n/TDbXNKd:tySzP/fb9s
TLSH
T17B066C56A1A801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5cf03358c7d31373f95d40c78d8ba97b67b349122341eef3784079450b89491f
MD5 f44e42a76680f6d6183ff445278fe668
SHA1 24d8193144e58436dda0617422255ce342857ff8
SHA512 0eb36a94a3b65d5a4da71c796117aab2e2c17b29cf594057f5716c1739c2d8deb7b45b1d94eb3d24e95dc50b5125b097238f1cd2baff3947b841acf3c1ec6c7c
SSDEEP 24576:o47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYSUeA9n/TM4NZYeNm+9MhUwd:o47JUQj1irIhCnDHUPfF/OA9n/TDbXNs
TLSH
T1EF65AE1EA3EC01E5D1BA927885154A1AEA71782E5F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 8aaf419ea6b785485a45b1d1e8ad91beae731ac294c593e583652c192c5e0e00
MD5 a6321430e2ca40976e52f5894cb9bf68
SHA1 d7a4d9db32e1a79e6bb96615a8e7f7333d27cd33
SHA512 8ca2951566b95cd21ed7863e720d7769472ba15852cdedc78f534dc5aebcfe3a455b3437570dc4e8030d327a2870627256a33c9dbf74ae040f10aabf32592d31
SSDEEP 12288:CzsfFBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dN:tFUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1D975F04AD2A802E8C15E6279C7965A04F7637C2993E1D3CB43C0F53E1F356909EEAA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
MD5 29f1b2d1b6f9290138596cf180847e53
SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
TLSH
T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 ac1846ef1e423e971c988dd223ef45f4df4993ed566c185cc1429e592e25c0d1
MD5 fa1bebf3bb91f34bb8af805e5a95177b
SHA1 85640a114eed887f3aa0b38cb730554b9ef246e0
SHA512 7304de065cf9d2aa29d4bcec327cc26c5dc2ba2bd09355ad01df253e5437ed51147a207ea023184d9952ec0fd50bf8fa050d8537ca26da2dce5bae15a78b660b
SSDEEP 12288:KcLq+BqwAOS5c7nXxsz7P3fz4MHyM0M4e8:Kp+4j5aXxG7P3r4MSM0M4e8
TLSH
T1B75518107626CB4FC66980325E32D1CCAB707D11EE056F0773C98B3F9576A59BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 a29190ca36ab913348b45efc7215f7306b0ac76a88179577216412afbf94bbf6
MD5 9778e9227b2c431df71f45e214eaf467
SHA1 1a9623eb7eb160b4a870ab2021cbce77446e30d5
SHA512 a728630529ac0ce20cc62b11c039ea470a2a1fd2811a66b2dc98a07bce983be3bffd83c55851c9f3a6d737bb3163b600352130b0be11fdb395b3025d523576ba
SSDEEP 12288:ti9P8XTqnHdT5FMKeFObjxLPxJf4wHEv:DXMHJVbdLZg
TLSH
T10745E8405136A7CFD1FA6071072A5F8CB764EC06B70A6F26B3C9053ED86AB55A0F93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 168B
SHA256 c5c37c1590f24c6a0417359ff379d89f8c0d194274444ae264bf0aa62aae7f30
MD5 6eac7fbf721e1035d8fb68f623f8be2c
SHA1 e76d99e2f584930880799632aeb7b3c9acb23350
SHA512 cc84a65273158a0f3b46b3b97947929f280daad0219941a67c6a1ad72e446a3b310473a0cb8381f94e03bca8c982f565df5321b35c21d422355f454fd87dc9cc
TLSH
T1B6C01282293F70891B692080A50E2FB92081321293819F60B2B02B06A32040A885B818
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpAE38.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpAE38.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

TmpC750.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpC750.tmp
Size 3KB
SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
MD5 ec946860cff4f4a6d325a8de7d6254d2
SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
TLSH
T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
MD5 SHA1 SHA512 TLSH

Submit Download

3e240c973a35217a.bin

Path C:\Users\Admin\AppData\Roaming\3e240c973a35217a.bin
Size 12KB
SHA256 d3ccfcc11730ed662dc665187daa9e37094c07521cddbb88978f40e5f2e27024
MD5 b3ce92baf000ebb1ab546a63aa054477
SHA1 3346310133261cd48a02826334e3462521020c71
SHA512 01e7289a6cb43376e3ed059d181c2be1a9d6495afe4bdee9a8f4163c3b42ba8ef52aba8f1f7a78a5e783342834e6adadcfa55a2ffb7d93a9ba9d0afcc7abd746
SSDEEP 384:rOCLK+qfxXU6EWR2WExOwJYeJ218/cZ4CJ:Cff9Ui2WEOoV2qI4CJ
TLSH
T1C542AF998E55F0F0937A6AC877F9AFF83C66792B83F1C106670670E5C0A760AA443647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 6ad6ef5428d82ae0c3d9d43215bc41a523e6f65a69c3ef1a962b76ca7ab50fd7
MD5 8a5431bdbb92e9799ab550e9fe87a226
SHA1 69c5b781659455c579ef978e14cdec3413917bb6
SHA512 93a9472025dbf219a671eaef43aa14b29196a99756ab15b1e7c42a37286d5b456f5c734259813ca4bef5574253ebdb998b00e9a3a951c4f4fa509b7ad5c81de0
SSDEEP 12288:oO79BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2ddd:T9UeA9n/TM4NZYeNm+9MhUwdn
TLSH
T1EE6523824BFC0CF5C75E16B440AAB7089E56FD5EEB4083DF8609722A5A345C6CE3694F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 781a319bd8742096d7db7b03805a0ed1dc4f9a7718fc109c3b53d6bfbf53cf32
MD5 8f11608db0dfbb27def2829d3dd2e20d
SHA1 f0332d3589dfd4a32917529b0902677521144739
SHA512 0159238fb9809631d8d1db89b64e6c3fe1688ca2966f7e9c6b61f5f96bf534d70613c95ecbd9d9fcaab5156f7e1d4d3d985c215df2ad4808e190bcba485107b2
SSDEEP 24576:Sgb6bmBIi49WNNFpg1rSvFv7bY7UeA9n/TM4NZYeNm+9MhUwd:Sgb4mBIBhGFMA9n/TDbXNKd
TLSH
T18C65AE1E22EC02F5E1F9D2B88DAA4417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 84ff093de5638bb559c651a25248f3557dda184c8b0526d015472857e4e4cb76
MD5 2cd792a600d4bc0557c72749d6ec5c97
SHA1 b9699d75c04d52aad959a0d1fe6d0f908a905d10
SHA512 ba2cfed563d54c6e93c45622adc02fec5ec8a174bccb561bf10a18a5b946b01d7bab961eab8ef2597822c72cffb3450996b856f308d9cb856cf27086deb7d9e4
SSDEEP 24576:7GK205l62Rao5D0mUD5/Axzi9IrRefq6/:7G905w8t5GN/AxsMRqh
TLSH
T16705236E30F69498C43A0570993509DF7D32399177A066EF49C1E7388F92BF0B5B4E8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 a402fffa027f54047443443b5b20d7f5cac1746b908ba2a6ca3db6697a5d970f
MD5 78ef4fb2241b03086edf967ae0cf0d76
SHA1 1248ec7991da8d5aa191c6691d109168f6ed304a
SHA512 a01ead9002d32753f1c3feb398de4ede56efcb5f159a4137c80788c95a71757e0c523eec8da1c9e994e7f85d44e2981bdd44b27c2c51e58faffb69f9e6e94bc4
SSDEEP 24576:9G88u8FpJqH1hzria7/miUeA9n/TM4NZYeNm+9MhUwd:Q7ZFPqVoa7/3A9n/TDbXNKd
TLSH
T12D95016567E401F0C47BD13889824663F6B2B8251364EBDF07AC8B561F23AE54B3FB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 6e6448c342841f3a871d64e4a5fe9157b715576bb1942c6dcd75ded6a384b6ac
MD5 c05728cfd46d72f2fa593491687b9cc6
SHA1 cc62d0b34fb257600e6573d8f2cecaf3eaec2ad4
SHA512 99cee02db9dc75507d550446399f82083ce4706ee83f9e535a9afdcf2a9068b62530fbf09127715aae6e8c00b5b90e96fe18c528d0f18933bf7952f76ed7e70c
SSDEEP 12288:/HvUrBFrEjwaQGBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d9:/PUr+NQGUeA9n/TM4NZYeNm+9MhUwd
TLSH
T15A85E11F26EC08E5E67AA17D8586870DE772B8561312D2CF0290817E4F37ED8AD3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 34ddaf653c1a394773308fd0b9df058bc06ac9fc82dd2eaf15ab68a683ec8b7b
MD5 73fd15811f3e25076a3eade7527958a7
SHA1 330343df07ee5f8ac6a84c777df5263b0018cfa8
SHA512 1e672d7a8d530201c72ee2f12d6b99d98ebd23695e835c843b40540c46bb6b0562605c5701525f7e1e40857651190a152eca8b470de9a40144f60d0e59412d37
SSDEEP 49152:5BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjAA9n/TDbXNKd:aG05lO43b2fb9s
TLSH
T162D5C06A62EC01F9D1BBD17CD9C64A0BEBB23815033556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3b6bca2280cf7e24347689830bdc5a49c0dc5df354ebb471065738a172fbef5a
MD5 3bbf771f4bd278bfc0b55eb25a243b3e
SHA1 c402bbd384d5fc6f136fd2bec381911abf216a4f
SHA512 52a21e933c0aa22cd1efae35d1a15d6e3434e57a65104102b69c124d2920ff172d92a1c4859484c6af07bcf6984b97ab7d346319b56583444e8f3dfa87cbec68
SSDEEP 24576:qfa5POZ3dpFWVM50JicR2hG0lasx2+47eidncUeA9n/TM4NZYeNm+9MhUwd:ia5POZ3+Jt2pasx2+moA9n/TDbXNKd
TLSH
T11365AF5EA7FC01D5D5B9D17DC583460AE5B1342653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f841c02052c0c6d8c46e7c176d543c7e7e476ae57c021c375435d4e0bdd36bc2
MD5 fa9c6da56c864046ddf344b006d7b174
SHA1 e30b49291a12f893d2fbc309dbaaf5d270b3e650
SHA512 edff9e906b9da5fbe186cd49173b62ef2f5eac9c7b3e242e84e1e0944f019f01461a26607984fd4a8f66f7b85750aab24533bc70de1c3e57c098f07374e8e1b7
SSDEEP 24576:dNcwHdjbyQ4nLC18lb/EOjowL7FkKUeA9n/TM4NZYeNm+9MhUwd:dNc/zEOVHFXA9n/TDbXNKd
TLSH
T164858C1623E901E4E5BBE1BE89779646FA717869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 d30ff3f15cf8441c251120f75b0cb6efe86002b79f6dae3be8ddcd96ad437f2e
MD5 1ebf8eabba2374d54ce350bc50a319ce
SHA1 ef4f4314c921dcc6094107a45ae477259a9c021d
SHA512 16da9cd5e5e676284cf84a0d52d6cbf381e5683e235b338285764e0275c4b3b52ac90f23f7537b580a2fe3a882c12b65651513b24dddd2669a60e495dbaa092c
SSDEEP 24576:u6DIH205l62Rao5D0mUD5/Axzi9IrRefq6/:u6DIW05w8t5GN/AxsMRqh
TLSH
T18225125D33BA00F9D06B8039C693054AD672B4B197615ADF0AD4C67D8EE3FD8B938E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 57d41c4249f10892fa9540ac65006b0c09e0d76b4da044a583be33909fd81cf5
MD5 0bca8d202df5750ddd668e7f23d51fac
SHA1 c73138ff12eda5ebf886c71d63ae8e7d4c42645d
SHA512 d1c8ca041c217deaa0a79dbbb53f469d153935e970d11d2034441e889c6ea296a2aea5e466a170a3d67ca22bc6df3ddd6667cee594063f1b9bd73a42884882e9
SSDEEP 49152:FDMwBtOmqA9n/TDbXNKdj05w8t5GN/AxsMRqh:BFzfb9sA5w8tANYiMRqh
TLSH
T17DA5E06EBAF805E4D1FEC6B4CD238516EA727861173293CB4290C13E0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 0f7bdf931909d2b9b457a777ec3d4b51c07afe52e66b2fea30baad8eebe28d5f
MD5 75535cb8f3caca4d50aeee9cf0781991
SHA1 f817b3d7b7202575574292b1c2d5a46dc00b1bde
SHA512 845f7605d9a2d770d5f7c15975781d8eba9141af23966ef59dfec1bb4f4429b4797071058c865289d7780f07c93da0e5d5418c76d0b2374cec4afcab4293022a
SSDEEP 24576:pD3FHshBIYQgAZUeA9n/TM4NZYeNm+9MhUwd:pDVHeBIAAlA9n/TDbXNKd
TLSH
T11F95E17EE7AC04E4D57BD1BCC6638A06E77138AD032256DB0294917A1F2BEE46D39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1956-58-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1956-47-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/1956-53-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/1956-56-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/1956-46-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/2784-135-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2784-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2784-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2784-133-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2784-127-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3036-450-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3036-448-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3036-446-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3036-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3036-107-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3036-101-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3560-652-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/3560-645-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/3560-593-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/3560-599-0x00000000023F0000-0x0000000002457000-memory.dmp

Download

memory/3560-594-0x00000000023F0000-0x0000000002457000-memory.dmp

Download

memory/4256-15-0x0000000002D00000-0x0000000002E49000-memory.dmp

Download

memory/4256-72-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/4256-9-0x0000000002FF0000-0x0000000003075000-memory.dmp

Download

memory/4256-16-0x0000000002FF0000-0x0000000003075000-memory.dmp

Download

memory/4256-174-0x0000000003F50000-0x0000000003FB7000-memory.dmp

Download

memory/4256-291-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/4256-179-0x0000000003F50000-0x0000000003FB7000-memory.dmp

Download

memory/4256-7-0x0000000000D60000-0x0000000000DC7000-memory.dmp

Download

memory/4256-0-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/4256-6-0x0000000000D60000-0x0000000000DC7000-memory.dmp

Download

memory/4256-1-0x0000000000D60000-0x0000000000DC7000-memory.dmp

Download

memory/4300-89-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4300-494-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4300-492-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4300-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4300-95-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4300-445-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4304-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4304-451-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4304-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4304-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4624-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4624-29-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4624-23-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4624-113-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5000-371-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5000-61-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5000-68-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/5000-62-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/5740-115-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/5740-447-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/5740-121-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/5740-114-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/5748-73-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5748-81-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/5748-75-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/5748-417-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5784-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5784-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5784-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5784-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5784-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5912-85-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5912-432-0x0000000000400000-0x0000000000577000-memory.dmp

Download