stealc | 4c7d86f0aac5886a0d27fbecd66b628b0588df15a440b1877e822b5769468517

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
Size 3.1MB
Sample260930-pphmjav1bs
SHA256 4c7d86f0aac5886a0d27fbecd66b628b0588df15a440b1877e822b5769468517
MD5 334c85aac66aacf2bde24d85385a6ed0
SHA1 851086b10245fc31e9a683c7f5b44d8fbf8b24ed
SHA512 13ed16e86fe39c530d13e852639b8dcb714a10f52101a66abc2381b9958d70c0d8c9bbe9054f491b962be11a855d20ff20824ef916db0e53a910e70aed3e5413
SSDEEP 49152:R5qMXA9n/TDbXNKdnTgd+IVtBg2A9n/TDbXNKd:R5qffb9snTI2fb9s
TLSH
T1FFE512007BE48432E6A315714A7D97188A6DBD756F6182CFA3C0372E9F706D1EA31B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc ransomware spyware stealer upx

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral1/memory/1800-462-0x0000000000400000-0x000000000071B000-memory.dmp	family_stealc_v3

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe

Executes dropped EXE 23 IoCs

pid	Process
3416	alg.exe
2068	DiagnosticsHub.StandardCollector.Service.exe
3956	fxssvc.exe
1840	elevation_service.exe
1912	elevation_service.exe
412	maintenanceservice.exe
3308	msdtc.exe
1804	OSE.EXE
4688	PerceptionSimulationService.exe
1312	perfhost.exe
1792	locator.exe
4692	SensorDataService.exe
3084	snmptrap.exe
1364	spectrum.exe
1380	ssh-agent.exe
4464	TieringEngineService.exe
4624	AgentService.exe
2020	vds.exe
3900	vssvc.exe
1708	wbengine.exe
4916	WmiApSrv.exe
516	SearchIndexer.exe
5792	Reader_sl.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	alg.exe
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4bd835405ef7726b.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000100000001703f-449.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112140\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Reader_sl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Reader_sl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ea4f0988d750dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f49e9e89d750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000269b7488d750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d4cfcc88d750dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006fd73188d750dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000033e78288d750dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
1800	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
1800	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
1800	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
1800	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
1800	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
1800	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
1800	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
1800	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
1800	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
1800	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
2068	DiagnosticsHub.StandardCollector.Service.exe
2068	DiagnosticsHub.StandardCollector.Service.exe
2068	DiagnosticsHub.StandardCollector.Service.exe
2068	DiagnosticsHub.StandardCollector.Service.exe
2068	DiagnosticsHub.StandardCollector.Service.exe
2068	DiagnosticsHub.StandardCollector.Service.exe
2068	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1800	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
Token: SeAuditPrivilege	3956	fxssvc.exe
Token: SeRestorePrivilege	4464	TieringEngineService.exe
Token: SeManageVolumePrivilege	4464	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4624	AgentService.exe
Token: SeBackupPrivilege	3900	vssvc.exe
Token: SeRestorePrivilege	3900	vssvc.exe
Token: SeAuditPrivilege	3900	vssvc.exe
Token: SeBackupPrivilege	1708	wbengine.exe
Token: SeRestorePrivilege	1708	wbengine.exe
Token: SeSecurityPrivilege	1708	wbengine.exe
Token: 33	516	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	516	SearchIndexer.exe
Token: SeDebugPrivilege	3416	alg.exe
Token: SeDebugPrivilege	3416	alg.exe
Token: SeDebugPrivilege	3416	alg.exe
Token: SeDebugPrivilege	2068	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4672	AdobeARM.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 4672	1800	2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe	112
PID 516 wrote to memory of 1048	516	SearchIndexer.exe	117
PID 516 wrote to memory of 4028	516	SearchIndexer.exe	118
PID 4672 wrote to memory of 5792	4672	AdobeARM.exe	134

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_334c85aac66aacf2bde24d85385a6ed0_amadey_elex_rhadamanthys_stealc_stop.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:5792

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3416

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2068

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1460

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3956

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1840

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1912

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:412

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3308

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1804

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4688

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1312

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1792

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4692

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3084

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1364

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:892

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4464

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4624

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2020

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3900

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1708

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4916

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:516
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1048
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 13c53c9d6fa020f5bb851929ee71573b4c5d1293eb63be3df5105d5c6f89bf2a
MD5 5c7ecb77aebac50ac69d4204d9a88cba
SHA1 5bf70931b4984c410e66b49a7854703314ebceca
SHA512 0d604288f6cdc46b7c97595ffaa3d7dc63c085a607a93de49af092a4db81579cd9b2f1c121464397176122996dff21de6a039a565a8cf7ba28505513f563be85
SSDEEP 49152:6b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnoA9n/TDbXNKd:s3q6HjBcfb9s
TLSH
T1ABD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 79f63fbf001e9aa8634270f05020ca62adb9fabe73beb394229f6db85f154032
MD5 846f23212a1c8b316b3cf839fc0e40b6
SHA1 09fc136dba636e88348a344b61314290ed6a06ed
SHA512 b2ec4b028d98b403d5d11fae4e42586393294b2ce83aac27baf22d4792af0cd4b77eaefc009dd31470712b6c7538752abbe510a7a29e14f184774379d4268c47
SSDEEP 24576:NXYfDtczAHUeA9n/TM4NZYeNm+9MhUwd:YtciA9n/TDbXNKd
TLSH
T15F85012967E408F9DD67827CC8A28505EA73BC454760E7DF03A4992A1F333D85E3EB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 c96c982469e5576e1a72dc9cf8821aa1dc11f003ff894b522b99cedd4725282f
MD5 c86228b317fc977f52dd3b128c642f75
SHA1 c0aa15a2982751cd5d8ac17487b7d4264283e8cd
SHA512 6dc4d1f0d968921aaf4e5fa2e2224f1753808c3b3dd255acf4b37ab2aba9be5c7d6ddb239a3e9fee669771591e087a5161ef672a0392fe52cad6ff9b42e7f872
SSDEEP 24576:C0Le5ji0hmxYrMGUeA9n/TM4NZYeNm+9MhUwd:CPji0A2hA9n/TDbXNKd
TLSH
T1F7959E16F6748731D073C0B9C5D2A68EED72348657308ACB4286D77C7E27AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ca7394854878655f44ed3afdfcd7263eeb12f98ef7b63187b544b7d856921ad0
MD5 ba35f62e9454ecd18dddd9a882ac2c5c
SHA1 3f5b30359ba7d39bce7ea0a58483dd2d7dd09ffb
SHA512 7a7a4e2ae23c0ca421ca30262b163e45d69ab5deb33b6498a16d0c6e0d3072845f4437ef5f1449660e54ebd642b6c1d6b9498e35d34d0575b77b4efb307b05c0
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWE6q8wyuQUeA9n/TM4NZYeNm+9MhUwd:1/ezSC6vUzPvxHjy9A9n/TDbXNKd
TLSH
T1C7755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9c8aa7d19cdbc258ef590e035c38ae10f964a58dd12201337ca30ceb2c35711c
MD5 dd213d7185cba345e1d7d2f0d2a97eaf
SHA1 4357a9ec5c1712809a6e37dc562fd91b10df3e92
SHA512 7ba41ba946333a27f843f85f1a1a2e0daf38d113bee6362752b59e1d8ad9de24df1432c13f1a264688710bd66f79ede3321058b2c4c7913c5e17d3c52be23639
SSDEEP 24576:aVbqPb88hv/l+6LUeA9n/TM4NZYeNm+9MhUwd:aVO88hXl+cA9n/TDbXNKd
TLSH
T185559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 6043e3bd3ac2eddd21f9e4dbe225b56c304c5d9e908236439be1106c0fef53ae
MD5 077bf2bd27c07a475f54903e19a24b6f
SHA1 5347ea8f355e12f16fb908cf5ce69ad18f24b826
SHA512 eb14a9ae8fc4d8c53be9fc2208094d26c1c1a116da58972a0d076b1142c5c2f2dab55c55f276bfb3c7688e169ffdf7e9ea2fa6d8bcf984e806b3bd7958a39741
SSDEEP 12288:FHaBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dGZ:FHaUeA9n/TM4NZYeNm+9MhUwdM
TLSH
T11B6523824BFC08F1C78E0A7544AABF0CCEA2FD4DE585879D4319762E5E385C6C95648F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 03475fef40b693546d87b65927a0c5ab5ea8c6f6f0d5da766ab3914376e4145f
MD5 50c2fda843e33ad83368dc9fa6ab508d
SHA1 e6da442f5d7384b60b3895c2e69df63ee90be55d
SHA512 3cd0f8a5f76e6d8d8df1d834545396cf7be04e834c3c2011f3e00dee6ea5449464c49a775e88bf1822ab7abef175f03652532a218b34599ec7a9147e87d0d570
SSDEEP 12288:EeBNUbTVO86UzBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dO:EJIUzUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1C585CF7BAE38ECE2C27E4DB956918700D77278304B6293CBD165830EDE235E15E7AC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f6df2830dad7212a79b261b350ffc7f256609e6d651187efa6a4de589d7a7097
MD5 9d3f2b3b66ef512940b444b6f99bebc3
SHA1 d92ac7a32d43f8c9aab2b32ce0066d0c6731d7bc
SHA512 d1e2f4a3745398b27060eda8b7a5f3cce9fb17103d616f7714dfd0b343c66064c13173407210dc9d330ae642283a72c745b41c219bc00642395db6839d6c6875
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THt:jQvGAdlCEL8c/yRNw5CDfb9s
TLSH
T18C267D656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 15698c4fc441868dc3773ee93c7b684bbf829dd8d4c6fc75eaa1acea6b3081aa
MD5 2aefea7b52c1801f6d3d539299e2942e
SHA1 a94c074e01427f156ccdfa5625c415f055857ff4
SHA512 3e0f3ef7efc3c1707fbbcecdd96e27b2990a229a565f738c258975bd2f33afb93a2fae59826a4918ccce3a66a47a9927bfb7f1d12902591f8befeaa9bcaac4b7
SSDEEP 12288:TAwSfxL/2Dc3SDLLmt0LDQewsAjVBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9U:M7ewsAjVUeA9n/TM4NZYeNm+9MhUwdA
TLSH
T1AC85E031FE74D432C3BF0DB21B36D706586DB9204B511AC3E3A89E9E59302D26776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 00e0e31e4b3de81197294703fbffec23642c14071388494a569aa91a203bdc39
MD5 a99043908b795d60ccf8bec33f7bf9fd
SHA1 7a3178e1193353d0716aedfb9571b0963e79e460
SHA512 bec842e0619ed0ce914cea1b91f7e48c89bcd8efdedab07c8ff43cc4ce16e05c6be95d92e4c6af2f8e4c4db169cb8ad63847b7ac439d5adbfb9bcc2b2402adbf
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHQ9:0UEtQevvqc2W1cpV2EI32
TLSH
T1F1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cbc925d78efea5b71ed99e0908828aba53284440f787b6be9e0e5205a0340938
MD5 6b6650436764deae2f03d8deac101d38
SHA1 caca18e3635fd11eaf6a67c354804c7394dbcf93
SHA512 38fc4816b45b1427ad9328160137af66702a98377e95de5d2a5c51e3e1026526a6aec081dbea4b43108d946727a85495c46f21ff11ac9b16e7a98cc4cfba93d4
SSDEEP 49152:gCbRquA/m2yL5zTfFiV+XenmE3/zxA9n/TDbXNKd:poquVjnmnfb9s
TLSH
T143D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4c7e0594f9cc8735a30e860a3188261bdf9b4af63084a0c88bd44af65484b1bf
MD5 66c0f0f5f5761f67467da723495b31b6
SHA1 07b3d670c354fc834aac9a9f8e5fbb15061cefb5
SHA512 c130f7462669ce445628b9821692871cca8cffa10290a05a7899a10ce01758d59d7b1b06665a2b9979597860dd832a788dc25fbcf96598851a3700dfcbed69e7
SSDEEP 24576:qAhGLJIFoiwtA5l7S53cUeA9n/TM4NZYeNm+9MhUwd:qAMyFoiq5uA9n/TDbXNKd
TLSH
T188359D81EBF945D4F5B3AAB899B69570EA76BCAA5E31C20F1150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 d9a0233fa9e0686edda711ad70a673703faf50952786d90253bcca9ec367401f
MD5 8c2c33c39b96388b418dc32bb7db15d9
SHA1 c7f2dfc7ba9cdc71a2acbfe8724b9614b9f5dd29
SHA512 b9056a3732479ae5cb41bfcf352a53451d2ca280dadd8c716d904daffeccb9dec9e5184b0da6b7ee9fd9383d272157aab45e63aaef0a718a712074ccaadf3277
SSDEEP 12288:Emw5HEjsChNzBFgl0WDm+CwBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dT:hwuSOWRUeA9n/TM4NZYeNm+9MhUwd
TLSH
T16985F14637E80CF9DA6742398597D635EBF2BC062A25C71F0760C61B5F37251AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 4142895eb7e5ae2d2fbc6659dd34ef47934e8818fd6f50c3937f3f14e3eeb5f2
MD5 938f3ff5d3d33939fbf2fc920701f078
SHA1 f65731b036e0a65b36d38aec5fcddbd92427026b
SHA512 b3f22c0800d61e018549eb560bf3c309b28b5d5e52e516747167134271472520df1a87b4e8232bf584f700903b050604510c4010c25dfd93d419128cf0f2a2df
SSDEEP 12288:0jZ1IyFBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2db:QZuuUeA9n/TM4NZYeNm+9MhUwd
TLSH
T19D75128627F810F5C397527DC8E55B08DBB27C5A637543CF0625526A1F32AC28E3A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4d203bc5ec3dc31c027144f1a2064f8efad02f234c01959c84ff74bef4b34999
MD5 6f69e052cbb31919ae903a2d65109539
SHA1 64250d95132f3790a11590b39002f0e08fa90e8b
SHA512 94dd59ec6123a7ea0f1a66214bfbdbbbb920d83dd6bac9feb17731dbe460c43e5467eb9322d3545936b9b84dcfbfe0df9c6e39d090fee038459be4490d78a347
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UZ:3QRQyi36YOcPQLvw2gAf+PN3Ifb9s
TLSH
T16E666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a5f081cb8d10e9ed37e15fc79e53d1a77557bfe21698efbf58c18c787be73d55
MD5 ffddb60950624ef1b5ea8df2bc1ce8eb
SHA1 6b4818d6010417035ae8f21c9bac8bb5ddb14136
SHA512 f8c6e105f2ce1708439bf9b6ee893ff03d117f5a90e200e8b40bcd3fc87e43e0abd3e1fe8f106af10949cfffa60a52e9f1d8787c86a9a98221c9c567d6390c1c
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UZ:2QRQyi36YOcPQLvw2gAf+PN3Ifb9s
TLSH
T1A7666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2e8be3fc702be7d5de5636c628b049d55c444072c4975639c527b7685c47dbb6
MD5 d2a1c0d17e7a42e862be5ddb67cb5372
SHA1 d3f49c043fef88c26c86139522da61d52d3f7c2d
SHA512 1b6cd935fc1b489c6bb372236e5da04f0e54f7cb094fef6774d3e66ee6a22c86a65e9a8fe0e267d59991cbad1fa952fb0c5ce1586bad9ad1147a7ed1f175f93e
SSDEEP 24576:FwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0+UeA9n/TM4NZYeq:h68Qg55nhheWu7PNU3/hA9n/TDbXNKd
TLSH
T15FB55A33B2F600A9C44DE1769F4A972196D27C758FE0E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a9c24c908f4de0bff1e195e63182119334cec4b4cb861e87183257beea4fb2d1
MD5 bd0c457b50a0a0d924fba06b7d6e3751
SHA1 4890c4fc323df4e6a1cf99a701dd04ca44e1d230
SHA512 c5d7cda04d327c71bb20e7138b166a7f0f4b5bad555ba9d85538a1d90ef3ad325292313c9700f4fd1c388b8659f8b5fe9779775ef86b70ac950f42c6e3dc2049
SSDEEP 49152:93aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99D:sy5112gYy5azzVvL69nLKnhZxfb9s
TLSH
T107167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7d426baccc80f85a464b3c8330d3a6137e652c49788ff2b8b8bda25344b74434
MD5 9a57f322faab218f5038d9747865947d
SHA1 80eb59f2e16a6f6edf7dbb342df01ec16907f33f
SHA512 68113277f1df72bcef37e4dd7d1a4f64be6ba28e27bfeecf18bbc2f481fae1c2d2cf18a504ef3b5693dd21be5e4de2fc7dc101c496669cdce4afb562006c1b26
SSDEEP 49152:ZB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glLA9n/TDbXNKd:Pu6JmVxd2dgfb9s
TLSH
T177D59D13F1D901E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 57de1df863c47af8bd1804d2c1afdd3c4622047ad2178c3b07d49d59ad97efb6
MD5 bdebc2f00be32bbdaa84c5279312117d
SHA1 05a72b970bf3ec175fc6d304bb1a0ade540660a3
SHA512 f418e9f80ae7ec132c4a8d434b7c3e53b09091bd256cd59a3efe787501a6fae23071cef726dbd68fcf8fdb97c5e5f9272ba597d22599d2aceed6bc73eb3fc912
SSDEEP 49152:Q1hpsNoJpF1A6UU44CwH7R4xXA9n/TDbXNKd:QmifPbRnfb9s
TLSH
T1BCB5BE13F2D800E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4089ea4e7c3d12baa09b60eb30b1280f194b48c09b876a71e111f8fbecb91325
MD5 5bf86b40893b630a23c63800dab2971f
SHA1 301c5283daacb8fe9cb1950175bd0cfd0d3a5ee2
SHA512 e49812087d2b4b0a38ae418ab4a25a26ca0b1e63696b762f7628caf4293688dfb0497669e331f62b4a117c6efe52dff9da72576dc955388c692c3a84ff9a3809
SSDEEP 49152:YSuZQIY0Be2KRRVtOnks6NMHqYA9n/TDbXNKd:C5dKTi61tfb9s
TLSH
T151C5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7b1019de9e8d716b602064fdadd352b129cf903ea9da588410bfe8acffdbd5f9
MD5 ad9d3e3a713771098db5e1acfd2385de
SHA1 dff0389a24400a9c42112515ea50d4e2cb0ab1d1
SHA512 104acce9b21945a80a9a17c4bc81a0b2e4cc49ddd3ae85790fe7b3eff29873a0727ad427cd0357779eb8faef017187976b4fae954247289f4c19211b2b7d33cd
SSDEEP 49152:xhtSn8EApI0figngiDn0AP5w7A9n/TDbXNKd:gX2iyphrfb9s
TLSH
T1AB95BF13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 d724eb023b1b0ed005d2403e279b2e15027615f0a53ade559af73368bf21b467
MD5 9e1a3e16d8c8e3467bfa6fc71663c2fe
SHA1 8d2f4c73995db0e96c4e149c9e2b5d26be04c0da
SHA512 6204bf52c05e2ba28a1b3d6e4378e165a0cec10d87a8bc476a21545dd49f37b9910f5ada9d8ebb4387935770677f5fd74c03ab089479aebece8aef6c2e635e02
SSDEEP 12288:AiBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d4:AiUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1B56523824FFC09F5C74A06B584A67B0CCD92BD4FF686439E470D722A5B385C6CA664CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 2d7098971cbdc020a1fca54c20636ae16cdf39589e734eada358fa5d43d87966
MD5 7ba76571c15d28e9198738ecc3c269e0
SHA1 aef61ba267f52e950933e4ae268f668b2534e8c7
SHA512 92b27fd2af1603efddeb29cf08e2892c070a0ba16863fc529e7c5c7d785b2479107788ae0a5799067c054bae7b6cb6214e0f248f80e9b42d59aeb9f7a6bfc0df
SSDEEP 12288:fJBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2du:fJUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1026523824FFC09F5C74A06B585A67B0CCD92BE4FF686439E470D712A5B385C6CA168CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 895e1fddec28d89be8ded166c7877244a82f5d122a541429d2c6ee5866d7eef4
MD5 ab4286abf94a67132488e1b4b025d442
SHA1 424c6fabe03bae8848ac5515c2d1cac89ed65208
SHA512 693673651495d549334ea17a89b3c02837dfbe54df923d3ca58c66b012988ee6557f92157f5483078c29a973e00588f2e5bcb0ff8ccd0a6bb56616eb6e3a0990
SSDEEP 12288:VbBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dt:VbUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1E76523824FFC09F5C74A0AB581A67B0CCDA2BD4FF685439E470E712A5B345C6CA664CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 4757a9e4f2575dc67455dbecff2f96404e7e4ce142f6b604ce6e15b8205040c0
MD5 c7b412d45c9a7cda03956378fdccb91e
SHA1 2d3b43c59c85e3a99fbd5fd72acc69ca7316f289
SHA512 688b29c2a2a0422858618a83ef07f32170db0359e3210f49fe69d2cec4a9556febc5efdb511a7ad77bb382ba63fc2e9654f74796dbd1eac58614542bf22681c2
SSDEEP 12288:yV8BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d8:RUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1C26523821BFC04F1C74A9679C4A6A708DAB2BD8EF76683DF4705251A1F302C5DD35A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 27b2e5fd0106d235ec0b3f04342cb85d58e4fc9731eb92456af96df1b76e7d2f
MD5 75c4a0b16e56b451e6370937fe0c2652
SHA1 0f3224d9b97ec13647867a8ff93fd60addc11843
SHA512 675b2a578d20c4c07440b5f378087e42baa50d861a547238ba136c78c22cb1122eda7c6a0a477ea5b5336299438c9eb6f6e24794192663f2f968f6aea84a6fdf
SSDEEP 12288:iUBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dx4:iUUeA9n/TM4NZYeNm+9MhUwdx
TLSH
T13E6523824FFC09F5C74A06B585A67B0CCD92BD4FF686439E470E712A5B385C6CA264CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 84b02905518986d8dd9428bb295b5e7c5ad430acadbc105b1581e8f6265cf77b
MD5 812f9859b1266684b1048e8f4437b6cb
SHA1 ac74dd93a0e7561b3aecad9904d56dac29c89e18
SHA512 e597f97c2be49f8402471c83ab66ebf04710ffd5a102efaa1e8f245e8dc0acc8ba0a58cb909b5de592b1c7f5c17e1920c533b42a2b639a2064778d1803fdfcf7
SSDEEP 12288:I9BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d7:I9UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1646523824FFC09F5C74A06B585A67B0CCDA2BE4FF685439E470D712A5B385C6CA168CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 686b5e38fd80aab40ba4ce2acaee7a082c296e381148bdb1e00f1f1fe7797c60
MD5 9ec11e0678f2c8a7c68568dfe181a76f
SHA1 fd3e3141657f0d3f57248718faee2af9e8e479db
SHA512 78df002d18e05672d36009f60b66a1bb8ef3ba4cb8d4229f7a90aa767fc35a986f6362e5d33e6cb96bdfee179fde4779f212bfdcf2eb91deca00b88b877b7ace
SSDEEP 12288:ChBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2do:ChUeA9n/TM4NZYeNm+9MhUwd
TLSH
T10A6523824FFC09F5C74A06B581A57B0CCD92BE4FF685839E470D712A6B385D6C9168CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 e9cabe6fbbaacd7b993a8fd3ddd0d6831f9e57e34192b2253a9a34fbff0c295a
MD5 f8723d92d2db1fc7a76861261ef3a6a1
SHA1 7cff45f0751e643e98eac15baf6633e7fd4b0202
SHA512 0917b259f9288b0721fceecd5a0a183a858e6d534172cacae4a5eabf13b5e552ce1041c90007b3086383d46d17819b5f6ace65c40e0f80e35de0ccb0ca6a69e4
SSDEEP 24576:OZMEzFVSOpUeA9n/TM4NZYeNm+9MhUwd:OZMEzfpA9n/TDbXNKd
TLSH
T12B850295B3A00CF4DD67423EC8659A05D6B2BC5A4760C75F03A8362B5F333A14D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 0b9bda5d2949b154a41c56d7243ad8490749919d81c2bd4a03b436db77586f13
MD5 81b73a3840b61d2f0d686ac5ad3091b1
SHA1 58e9c3090af0238f6d119d40561b1c94157523df
SHA512 c39401a0a9556ac4960c4770641fc0fbda486053d2326aa14642d68e79e2fd821ce677a58bba559f21547a4c9120c5f4b396e7e9499bfe948f34dc6bcf5dd709
SSDEEP 12288:ueBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2df:ueUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1DF6523824FFC09F5C74A06B585A67B0CCD91BE4FF685439E470E722A5B385C6CA264CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 3667d0f57078768ef9f8d696637b860b8cffe4a6533b0f2a2136cb39249ef74a
MD5 0be716c75e7b201d661acd406dc7080d
SHA1 fd56ea2d16362e1d5d9b531bf39e283e06383be4
SHA512 7ebfa02c8ecbfb7a42c867a60b36b4364427d56d79ebaea972cc0d24790669ab618c40dff6d2e31d61d60bae7149ed810cd780d01e6daee36d10bd74e81dfa82
SSDEEP 12288:yKBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d1:yKUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1196523824FFC09F5C74A06B581A57B0CCD91BE4FF686439E470D722A6B385C6CA564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 6ea5d6f5b62e8df4de753c4bcd25868afe1609c1c777207e7b420644f4d40438
MD5 e1a637ddbc6596e112c0fcced0f780bc
SHA1 9699191166f48ce55dcd5b4fe6e4003125225446
SHA512 9d7b32e0de6b0ca1e9dce4f0b98b4a80417a058bd24790542a70b62374915bf6dcad668d43d4d539aa6935baa8a39baaa15d49c098bac2961595c323a5e5915f
SSDEEP 12288:ByPz5L8FBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d+:QzyFUeA9n/TM4NZYeNm+9MhUwd
TLSH
T11975024767B420F9C2674239C8A21B05F772BC3A57208BAF036417362F376D19E3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 a9765477bcb03dc3497674fd36a55720b3f6f572de5488de1c2b4068cd451ad8
MD5 fbb4325922b4e41450e7f41fea603a7d
SHA1 47e9d218eecbbd7a31ae1bc637634b8089649cef
SHA512 6c790ead058a719852cd4bd1d8a074698f03c6b242dde7b265c279ca715dfe27ab4719dbdd69587c9d9a8b18a76053f5209adf0e6d094b45d300ea169f2662aa
SSDEEP 12288:GeBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dw:GeUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1456523824FFC09F5C74A06B585A67B0CCD92BE4FF685439E470E722A5B385C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 72a1464d7b8a5078fa559f9c67645ae5374c8d45dd75d02d65bec14fae254d93
MD5 9010cf33f773eb1bfd45ab5fba7b45fd
SHA1 5e3baacc3912e1b193c3a581bc34f10139ac68d0
SHA512 e55a3a8bf141b416a80fe3570c49697a96f99bac2d7c13ed66e94d8571c240a8860658e18acf2c9f9f63bc4bcc29b7505a02644a878d21f3aa29b2e2ac338277
SSDEEP 12288:4eBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dd:4eUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1A06523824FFC09F5C74A06B585A67B0CCD91BE4FF685439E470E722A5B385C6CA264CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 1652ea32f517608d73040a0c7cf43dfc246f727b1e5bf14f44867b489d4741e1
MD5 efb3e0225cb6537f48ebb830c16f901c
SHA1 41fc247197f9153ae6add4be66bc59f6eabec6ee
SHA512 ba960f84c99bab2b8e3582bc4f3baba1c64abf1de1446dea79dc2c58ae6c0d3f0d8764e14f8af4fb0ce5a950ae6c2cf9cf948f72a25d406ff4094a279fcd7081
SSDEEP 24576:BcP4mcvIjkGOxhKP2l71SNKbrh/8KBWUeA9n/TM4NZYeNm+9MhUwd:WP4m4IpOO67N8KCA9n/TDbXNKd
TLSH
T19F65AE2DABDC0096D0BA917885658A09FAB1742E2F3286CB1160933D3F77EE54F35F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 72ea85cb2445242f607a9d4a0018379aca781f8148c6c45f75c4ab16b644cea1
MD5 4a20a7ef5efa5ba5107652f9c02e20ad
SHA1 513626a559f82df7610a49309004e1d578bb85f8
SHA512 9eb6028b143a1ba512cce6627955f0397a05300e8c8d65dcd52da2ba1de5627ba010e2a261e16d53e346157f7d71e52ba39fc8e49c7015e725b8920180ef5a3a
SSDEEP 12288:kzsfuBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dr:DuUeA9n/TM4NZYeNm+9MhUwd
TLSH
T16275F04AC2A802E8C15E6279C7965A04F7637C2A93E1D3CB43C0F53E1F356D19DEAA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
MD5 29f1b2d1b6f9290138596cf180847e53
SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
TLSH
T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 168B
SHA256 ed1d66cb67afd7edcb7cb5f09eae0906f9e94649c228b8e895db69912a701481
MD5 765cf979208ccb78a9af065c51cb1851
SHA1 de752e1a3110581bb0c6b9dd1956fdd5ec89abab
SHA512 62db5027b14478945b69d7e146b21049385e8b7a6011e117900c29d0d8fb6eb477a572064cdce15cec3634c6263d6e96fdc9cf3d9bd1d168223fdcbe02be32fd
TLSH
T169C01283223E60AA072E00C1A60AAF9D10803278C381CF2122203A26A36080E082B82C
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp1689.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp1689.tmp
Size 3KB
SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
MD5 ec946860cff4f4a6d325a8de7d6254d2
SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
TLSH
T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
MD5 SHA1 SHA512 TLSH

Submit Download

TmpD1FC.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpD1FC.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 50426cf6ed84773c76aa0f65609708ebded0a1a51f1d1e3e486a26ee58667bfe
MD5 7c007af469f07df82c472ac0354434f0
SHA1 0e3763f8a8d4078ffd74a6477b3688339f2d6853
SHA512 70e63dbb9c2fb020b4cae51e304f1a7e72594e83d5ed18c8df7f0d0d7990f4f2891595cdc14bbae6f85b95580514526c267e38dd96685c2c4f7814ad967e3e58
SSDEEP 12288:mOBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dRd:mOUeA9n/TM4NZYeNm+9MhUwdD
TLSH
T1146523828BFC0DF6C79E1B704066AB0C9E66BE5DEB4483DF860972295A345C2CD3654F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a0f0a37fa1e8a0ddbec9c181685ca9650dce3d8503b08c00f88131904c565168
MD5 38b699921498af848988ff3885df8f37
SHA1 81da2393fc0cc65f7d08913614c4049c96c3c277
SHA512 3680b6df903895ad0f8e30869117c213085992982779605e35ed4b7fd170028387a8dc4c70bd46f308c8d8a4e4c728c2eae7757c8d9f0221aaca79ef27f76b42
SSDEEP 49152:Ua0h2GEkuAe73q3pp46zwwQ2A9n/TDbXNKd:Ua0hNYG4Jwifb9s
TLSH
T1FD85AE1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 f7519cc288be828d29847e28e31c5f87b447c28ba765d9eee457f9af4fa37d5e
MD5 76c80ef4f5e47dba91ee11ac8a6429e1
SHA1 af74ba62c55fb51e38299af660fc74f445be2da3
SHA512 dcc2ee1465a7f9293cd888620c46e438d7362628164e9a603d31de9d8f3bdd4aa796fa30c8a63e4224124cb3dd8ca6da1d40c42c828a0026815c7abfb4959f86
SSDEEP 12288:ohbHjfXZBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dV:ohbHjPZUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1797512AE17FC00E5D276A27D85969609C771BC2A271193EF0381923E4F3BED58D35E82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 f194a5ff3b964d00f217622e3555f2025f724873e22b0f68935d9c212dd68625
MD5 f2ebecb913c002c9b7962b0d248766bf
SHA1 4cb25e5f1f57478de2f39325ab80a1a4f15d533e
SHA512 fb8e5305f8d2f87bba420bf45582453f16c3aae9503ef9a9daaf94ed75bde023bea226537483b3e996a807c6ef73e7d4a86ae0e610c701599c6c06e8335a90e3
SSDEEP 24576:93YgnJcRTk4yti+R5dpR/RUeA9n/TM4NZYeNm+9MhUwd:9IgnaTk46ppR/dA9n/TDbXNKd
TLSH
T1A945AF2DF2B910B9C8AAD236450147B5FB71782D1F209ACB0174C538AF1AED89E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 8afbeb9b087fa83cf4f83612f738b650d330dabde64a3e641db7bb4953b03b24
MD5 aeadfa481fa75aecc2609e7c97dbdd11
SHA1 3a1c4918417f45ed9d7b6276970b6380405f95f2
SHA512 586ad55317d852ff5ecddaed27c5d1dedf8ae8cc8acfe81c0c13e5d48d1a4555d16c12eecccc898a71a6b9189c42bd9045c182bf113c9e44a5c8f977b2025e5c
SSDEEP 12288:v6BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dc:v6UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1036523820BBC08F5C74A1BB540AABB0C9D51BE4EB75643DB4219722A5B385D7CE3648F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 880634ac310ec17df3c496e0b6b49de958b76b7a4c879708690b87d9ab23045e
MD5 2b237db8b56c26c1ac05f71fba7959bb
SHA1 634dc59b88017d1ceb9778cf09c568fd95346051
SHA512 883f38b965c01d10aede904c40580840614b2940686a30930ac5b0aa356a2fca976b8804e17083144e0e71c5e87c27f4e6a6619cd09bed97e106d53ac4dcae87
SSDEEP 12288:4ObrA4LWOsvAYFTHBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dW:VfL3UTHUeA9n/TM4NZYeNm+9MhUwd
TLSH
T15C950245E7E400F9D96B813CC8B29A16D672B85D1364E7DF03A84B651F237E28E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 ac03711d136860bb511b42fb728c5910421d4a96e5dcc1ea014cfbd834000f8a
MD5 01cfeaf8508f0f542ceb26ad6bf63083
SHA1 c60c225c0aa50d079cbcac1221d4c9b55ba9e71a
SHA512 ea6f211e5d11e5b6fdacdf0eea1c2b40ea412e1c013ce6de0ee26b55e60b920d0c055989852b5594cf1584bd96983b83b19d959ffb775791014ce466934253ee
SSDEEP 12288:3pFtfOTBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dm:dOTUeA9n/TM4NZYeNm+9MhUwd
TLSH
T19675025A37EC00F5C26A623D8592930CD772BC6A571253EF0290917E1F37FE89C3AA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7bcc351eeabfe865d1f52da8d8a9120ed7b2cc0256551eb45f437048a55a6bb6
MD5 c4f8a266477c93345ec4034e4d265610
SHA1 8d61f97baffbf6d79451fde6dbb4a24315df7728
SHA512 f4bc9fc13651d6b7eadcb879a1fb658feba8973480d0017fb2d2cadfb57f9b328e12b1fada7771d66ff547908af3458148aba5655e683ffde588a9e6f65985e9
SSDEEP 24576:N7NM9YmZqmWMUkPjZM48Mv6bEhseUeA9n/TM4NZYeNm+9MhUwd:N7cBWMpPjN8DbEhFA9n/TDbXNKd
TLSH
T1F065AE2E6BEC81E5C577D13DC9A28205F6B2B8651B318ACF1152833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 7ee0534336efaf8398333f9c798dac789f0b50b40982ebc6f9c9c9e3865dc8a7
MD5 e7420cbadc685e8aaffb49a2b756591f
SHA1 6f0cd8b930a3620dcda97f44e43f2aa54dea096c
SHA512 653a49b2b792817f7d6da2f0d7d68948b743f7eaea66387a0f590a8c3998ad8448c724c00e7ce1a86bcb6472dd7dde468dfae5b915b2c5388dc54b52b58b1d06
SSDEEP 24576:CW6BApg2YuyuNDYTabvcRvNYf8km1oUeA9n/TM4NZYeNm+9MhUwd:CF2YuHNETovcvNYf8kmoA9n/TDbXNKd
TLSH
T1FA858E2927ED80A4E0BBD27D45B7D246FAB2B8551B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 1b21d2f27a2f4ec6d3a3fb20c22098d1137de5ff54f4f3cb246ecb60b1b7f905
MD5 bc5eaeedac168ae15c7c5c804a3a1b74
SHA1 d7a607a235edfb7ed10512859065c832b958ff4b
SHA512 9894b86a9bd37d0d9f6f39635b4eca4464c5741c936b08f3958e03232f30c56a4ccc64805481d64ebdd9f6f257e40a34bbd30a46ffecddcca1d9ec50f091e593
SSDEEP 24576:BAFs06+Omlf3NXEbTovUeA9n/TM4NZYeNm+9MhUwd:WFs060lVXuWA9n/TDbXNKd
TLSH
T1B065BF2F62EC00D5D07ED17D8997C91AF6B1786707215ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 2caf3531769859891453a0bf4cf9599c6335605bec47e7fa7b845eb81cc9498a
MD5 95865f7ea42e8c8fac44b6d076d7fe86
SHA1 a24b866452e7e22c5cb60290979f4b61b2ad5c6a
SHA512 bdb0785cdda7088637f5eda2ed5b892b6d97f604468029137d2e04339d260bb55c49abe73548980a4dd0d283dc3d3a062be1ad0f656411f2eee618c51c7d7d92
SSDEEP 24576:uJnJ5D3WL0UeA9n/TM4NZYeNm+9MhUwd:uJnJ5DGLWA9n/TDbXNKd
TLSH
T1B685D02DD2A810F8D4B7C274819A2B45FF72386D2F226ACB1474D5353F22EE09979F49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 5ca469dc29abec3acffcfb012bc3ba7cd66bc22b514973000c4d16c2395ca616
MD5 bc4768fda7fe366a974e574757770b60
SHA1 7c2b64248361f73dfca2657fcae34c5a4b2bac15
SHA512 0438fb82226c1849f6f6474e9a9fede73f638371453a66efb3dd8f8b47ecad8a4c8ef957a4fc645f4757cbb66a280f747f2fd0a0a75ad8334a1ffee1c1ac2ea7
SSDEEP 49152:6o06DIKdwc+eQnSt65aVcA9n/TDbXNKd:7bfb9s
TLSH
T136956C06B7EA5294E9B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 3ebdaf8392f7e72199149941f8fe9a4ef389447a7918e63ca279fadf8283708a
MD5 9fc33d4c52dcf721304f76f7f9028e8e
SHA1 7215ae5d22cb566d8205172ae29d6c134ed89d7b
SHA512 f9f142a3b2bcb69979f5020a7ad313fdfcf3343b3af8d5596b07166e8a9651fcf5242fd7294438b071e94ed983e2b6357d54196438a889b85628508c2627eedb
SSDEEP 12288:QEP3RBwBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dv:rBwUeA9n/TM4NZYeNm+9MhUwd
TLSH
T16775129E2BFC10F5C22A917D80918708C7B2F869675217EF0291D23E4F37AEA5D3DA45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 da2ceaf6fe9790eba58333bac5c093be9d28033542ce14e131dcda374024a260
MD5 6ae8428408c990ca8846ef06d86999e1
SHA1 71fc6362afe0e5ad5c2c1dc41e140a0063c7a92b
SHA512 ebc5cb6637946baf55da12e1e896e451884af32c666a89e2a65e1de9ea41db29d3480e3239e09810078e3ac46c383dc1ef5461007c635545ec53c2c3dac90fc3
SSDEEP 12288:fjkyJBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dt:fIyJUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1BB75124557EC44E4C7AA063889A39348CE71FC25AB2183DF4180F63E6F36BD59D35B4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 1b9324286ef1c7bbce99d0d2804ad5f170c1dea40a808603afc2a017d2960fcf
MD5 3bc5eccd8bcd951ebdbb36f24684a18a
SHA1 06b5edb5725d65d466a6f700a23b7a8e4e50d2d0
SHA512 b3097e4783c2c1f2e69e524a96516e2cc1b833ed799a260c003c432f94793ac72b38b3aa8c5f3718563f4fd5f422c237edc4819f0c802a44fb972d1e137343d1
SSDEEP 12288:yrDBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2du:uDUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1E16523890BFC08F5CB4A06B941656F08C961BD2EB75557FF0299B23A8F345C6C936C8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 9c2d6c4ca5888a94672e2bcce805aad7f25f7a80756444ef0e6c82847ba1e8b9
MD5 33b06e0b454cb0ac48e102e689f1009c
SHA1 1515e31dd355b9b4fd3f02a6cabe0f83ebe871a2
SHA512 77d38e80d4b12a00011c1f23b6a846ebfcfddde7dfbf39f693a04bce6bd1178e9c83394696fdfa90e5d44559a7f305affb7541ce3aac8c7054815f673569e4f7
SSDEEP 24576:bQ9MxZKdcz97w3mUeA9n/TM4NZYeNm+9MhUwd:bVKXQA9n/TDbXNKd
TLSH
T140558C2DABF9099AE177D27594A250C3A673B4311B31C6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 5e2514367683c8b837cfb42df8b2cac2b941831466d5111f0b420237f9251798
MD5 c93138dfccce0cbf542b41d1aea124f3
SHA1 b60fb45ba926553c49f855e8954e7e5aa31dd694
SHA512 fa84f74f259c655febb6922d63dcebf1fa7118098da38f4268508a9c734074609d2d246f8dfdc941da012b593ec19d535bba315632e75059595fa645997f7ffd
SSDEEP 12288:tyoKo2hRple9pVBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dK:tyocbApVUeA9n/TM4NZYeNm+9MhUwd
TLSH
T13485E00FBBAD40E2D166813C89858704EBB3B4345B6253DB5691C33D4F27AE9BD34B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 95ba46818564fc941e994c583079f37605485085c10c8ef8ec8ba3e664b046d5
MD5 083bfaec6d76e3f02f9145110adab923
SHA1 ac3e91f1d790f8975a915ab93e85dae048eea360
SHA512 e06138d52bee04120662041187a8811c622a8f3a3922182e58682db9f79b9dd5e26e6e84c60d9f3f4a1245283ad332a86124c96ef95f9124d9a3ef93daf0b46c
SSDEEP 49152:4WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKRA9n/TDbXNKd:a0zuNIefb9s
TLSH
T1BBA57B3DA2BC00A8D9AAC375C5451365EA71742E3F2056DB01B0C57CBF2AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 b23249b54e8710164e16aceec51db824015ee99dd13966d07889535a78703ccc
MD5 a18bd4fa6b29ab97726945afe442bfd3
SHA1 ee5224dcb3bf438b1b4ad0bf54089433d2aa47f9
SHA512 e5740541a1690b3aca22e4ede66291193879d99bd370b393b357dad115ac8235624a6ce6b95ed047d5ad3e17283dbde0b1b927c223ff2436d617cfa6f780000c
SSDEEP 49152:pTDxR+N5YzTljM3A9n/TDbXNKdSTgd+IVtBg0:9u54fb9sSTIz
TLSH
T1D1A5E12EA7F805E5D1BE86799A23C506EB727851133193CF42A0C17E1E3B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 a0a3c30c7bd0fdb80b21517e16575a78d42cf71be3a820bda889ac0b472d17de
MD5 9ba913373f849aa00a6e891b112fb243
SHA1 38701874c10f216e2f0eab0b4cbee2862080a4d9
SHA512 990357dc995d8726d52b844db1142c747f2278325af0ce7590fa3016289cefb8709c8a9dfbda54b4972e523d4f2189aef819391164f19e5f6158cdb39fd82e87
SSDEEP 24576:FTMdOz0FFS+kmSL8UeA9n/TM4NZYeNm+9MhUwd:f0K+kmSL+A9n/TDbXNKd
TLSH
T13585F17E63AD04F5E57BC27CD6438A06EA723866032166DB0690C1793F6BFD4793AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 077604ab8b6f0e322de4d5b73f821a8c9815fcf8c19112b85e5fb7b4e98f73f3
MD5 a4edc7bcd009ec6aca4d31865042dfc8
SHA1 70adc22bbfcefbce447f254de38db611a48f589d
SHA512 26881743893c8c4ac2b045847decb6b11bdc575cb2d9a9b205588bb54ef62cd76ec2fd8124b0bfbf7dcdeaba2fe5cceeb7a077e871b7b00858481f40a9fd4828
SSDEEP 12288:b4pHBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d8:cHUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1F775224E17FC24E4D66652788A765308CA70BC2A232157FF16D4E63E4F36AC5C939B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/412-103-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/412-114-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/412-98-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/412-92-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/412-100-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/516-297-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/516-632-0x000000000D2B0000-0x000000000D2B8000-memory.dmp

Download

memory/516-629-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/516-291-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/516-306-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/516-322-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/516-339-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/516-300-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1312-274-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1312-155-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1364-198-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1364-435-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1364-201-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1364-192-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1380-623-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/1380-205-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1380-211-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1380-214-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/1708-275-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1708-266-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1708-627-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1708-272-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1792-166-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/1792-278-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/1792-158-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1792-164-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/1800-124-0x0000000003FB0000-0x0000000004017000-memory.dmp

Download

memory/1800-119-0x0000000003FB0000-0x0000000004017000-memory.dmp

Download

memory/1800-462-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/1800-8-0x0000000002E50000-0x0000000002ED5000-memory.dmp

Download

memory/1800-14-0x0000000000BD0000-0x0000000000C37000-memory.dmp

Download

memory/1800-15-0x0000000002B80000-0x0000000002CC9000-memory.dmp

Download

memory/1800-16-0x0000000002E50000-0x0000000002ED5000-memory.dmp

Download

memory/1800-70-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/1800-0-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/1800-1-0x0000000000BD0000-0x0000000000C37000-memory.dmp

Download

memory/1804-131-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1804-130-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/1804-250-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/1804-137-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1840-62-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1840-71-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1840-68-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1840-200-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1912-85-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1912-78-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1912-213-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1912-84-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2020-251-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2020-625-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2020-242-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2020-248-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2068-44-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/2068-35-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/2068-43-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/3084-412-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3084-187-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3084-189-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3308-112-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3308-106-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3308-115-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/3416-21-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3416-129-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/3416-29-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/3416-30-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3900-626-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3900-263-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3900-254-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3900-260-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3956-59-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3956-47-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3956-56-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/3956-48-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/3956-57-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/4028-640-0x000001D9DF4D0000-0x000001D9DF4E0000-memory.dmp

Download

memory/4028-634-0x000001D9DF4D0000-0x000001D9DF4E0000-memory.dmp

Download

memory/4028-637-0x000001D9DF4D0000-0x000001D9DF4E0000-memory.dmp

Download

memory/4028-648-0x000001D9DF4D0000-0x000001D9DF4E0000-memory.dmp

Download

memory/4028-638-0x000001D9DF4D0000-0x000001D9DF4E0000-memory.dmp

Download

memory/4028-639-0x000001D9DF4D0000-0x000001D9DF4E0000-memory.dmp

Download

memory/4028-646-0x000001D9DF4D0000-0x000001D9DF4E0000-memory.dmp

Download

memory/4028-635-0x000001D9DF4D0000-0x000001D9DF4E0000-memory.dmp

Download

memory/4028-641-0x000001D9DF4D0000-0x000001D9DF4E0000-memory.dmp

Download

memory/4028-636-0x000001D9DF4D0000-0x000001D9DF4E0000-memory.dmp

Download

memory/4028-647-0x000001D9DF4D0000-0x000001D9DF4E0000-memory.dmp

Download

memory/4028-645-0x000001D9DF4D0000-0x000001D9DF4E0000-memory.dmp

Download

memory/4028-642-0x000001D9DF4D0000-0x000001D9DF4E0000-memory.dmp

Download

memory/4028-643-0x000001D9DF4D0000-0x000001D9DF4E0000-memory.dmp

Download

memory/4028-644-0x000001D9DF4D0000-0x000001D9DF4E0000-memory.dmp

Download

memory/4464-624-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/4464-217-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4464-223-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4464-225-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/4624-236-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4624-228-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/4624-238-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/4624-234-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/4624-240-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4688-141-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/4688-262-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/4688-147-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/4688-149-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/4692-177-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4692-445-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4692-299-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4692-169-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4692-175-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4692-441-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4916-286-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4916-279-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/4916-628-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/5792-866-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/5792-922-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/5792-936-0x0000000000400000-0x000000000057C000-memory.dmp

Download