stealc | fd58702767e0c671c5b261084e4f10aa59c6d9adf1c622eea85fc189bc3c1e09

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
Size 3.1MB
Sample261001-sapdbasfmd
SHA256 fd58702767e0c671c5b261084e4f10aa59c6d9adf1c622eea85fc189bc3c1e09
MD5 4adbb30a21cc0a08d0f74a3d971b837c
SHA1 f0cf3dc8a57c0b2294d1a0ee5923fff5d997365e
SHA512 4e46a71b3fabea8d8427a816c048c52e4c4a3a9a728957a9743526f12483996358b16e1e37940a7d87135de807e14360c5d6cc9a15d0e4857358798a6808bb85
SSDEEP 49152:95qMGhxSMmT8oWgBCaXZtUaR4vPmd90mb4hxSMmT8oWgBCaX:95q1+M4FHXZtzmUij+M4FHX
TLSH
T1BCE522207B80D03AE57315318A3E87259A6D7DB42F2191CFB7D52B2E6F70AD19A31B13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc ransomware spyware stealer upx

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral1/memory/4688-459-0x0000000000400000-0x000000000071B000-memory.dmp	family_stealc_v3

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe

Executes dropped EXE 23 IoCs

pid	Process
2252	alg.exe
956	DiagnosticsHub.StandardCollector.Service.exe
3140	fxssvc.exe
3604	elevation_service.exe
4712	elevation_service.exe
1264	maintenanceservice.exe
1472	msdtc.exe
3196	OSE.EXE
1396	PerceptionSimulationService.exe
3868	perfhost.exe
3464	locator.exe
980	SensorDataService.exe
1096	snmptrap.exe
1100	spectrum.exe
1720	ssh-agent.exe
4164	TieringEngineService.exe
4756	AgentService.exe
2140	vds.exe
4808	vssvc.exe
1028	wbengine.exe
1848	WmiApSrv.exe
2340	SearchIndexer.exe
4152	Reader_sl.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
\??\F:\	alg.exe
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\be8a9cc8c665fbf6.bin	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0001000000017066-438.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Backup	AdobeARM.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Reader_sl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Reader_sl.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ead41ffb451dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d93ceefeb451dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc9df0feb451dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dba7dcffb451dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f843daffb451dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
4688	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
4688	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
4688	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
4688	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
4688	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
4688	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
4688	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
4688	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
4688	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
4688	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
956	DiagnosticsHub.StandardCollector.Service.exe
956	DiagnosticsHub.StandardCollector.Service.exe
956	DiagnosticsHub.StandardCollector.Service.exe
956	DiagnosticsHub.StandardCollector.Service.exe
956	DiagnosticsHub.StandardCollector.Service.exe
956	DiagnosticsHub.StandardCollector.Service.exe
956	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4688	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
Token: SeAuditPrivilege	3140	fxssvc.exe
Token: SeRestorePrivilege	4164	TieringEngineService.exe
Token: SeManageVolumePrivilege	4164	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4756	AgentService.exe
Token: SeBackupPrivilege	4808	vssvc.exe
Token: SeRestorePrivilege	4808	vssvc.exe
Token: SeAuditPrivilege	4808	vssvc.exe
Token: SeBackupPrivilege	1028	wbengine.exe
Token: SeRestorePrivilege	1028	wbengine.exe
Token: SeSecurityPrivilege	1028	wbengine.exe
Token: 33	2340	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2340	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2340	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2340	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2340	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2340	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2340	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2340	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2340	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2340	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2340	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2340	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2340	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2340	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2340	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2340	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2340	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2340	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2340	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2340	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2340	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2340	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2340	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2340	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2340	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2340	SearchIndexer.exe
Token: SeDebugPrivilege	2252	alg.exe
Token: SeDebugPrivilege	2252	alg.exe
Token: SeDebugPrivilege	2252	alg.exe
Token: SeDebugPrivilege	956	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4256	AdobeARM.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 4256	4688	2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe	112
PID 2340 wrote to memory of 880	2340	SearchIndexer.exe	113
PID 2340 wrote to memory of 3028	2340	SearchIndexer.exe	114
PID 4256 wrote to memory of 4152	4256	AdobeARM.exe	135

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_4adbb30a21cc0a08d0f74a3d971b837c_amadey_elex_rhadamanthys_stealc_stop.exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:4152

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2252

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:956

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1068

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3140

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4712

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1264

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1472

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3196

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1396

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3868

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3464

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:980

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1096

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1100

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1720

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3656

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4756

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2140

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4808

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1028

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1848

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:880
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b1b20dd5a2730e4b639794b65124598e2a23d6284cef67fb6872d9307198c708
MD5 911f489c016a739d36a0dd67cc637428
SHA1 f3c7bbcac9511ae0312fd7ebf67abcd8eb97608c
SHA512 2395d1133699d86818945a4ed0f30503a619ea30ad07219b2a3228876cd05580c2c6351e6245ca38d74a549d828b18657dc8adf7004bfbf1b90da1f1f784093d
SSDEEP 49152:pb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnghxSMmT8oWgBCaX:/3q6HjB9+M4FHX
TLSH
T17AD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 b7e96eb62c9cb8c226603d73d6d3046e16024b965a649ea5b41341af0e0d9166
MD5 968788b72644877f8852e48742f6f63c
SHA1 599e7dfcace43c16b0997b311d817b563b748437
SHA512 a8ca940dc8e413e10116ef9729662c875d423bf7e58fca450e91328a48791608047e3d8fadb612d2b6865de80c2601f9713e9032ee469ba9e2816ceb9f014c89
SSDEEP 24576:AXYfDtczAOrKhxr+EHNmT8oW4ll1JCrLKXI:3tcehxSMmT8oWgBCaX
TLSH
T1F885F12877D508F9EC67823CCCA28512EA737C954360E79B03B49A691F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 a9503c1963bbed9bd87cff5201a76fc18b7c7cc807585a3363f6ca0ff402ed36
MD5 f7ca29cae62c0f922d4574491f15bef0
SHA1 2b9c32efbcb4e8f0ea0784e779ac25759113db87
SHA512 8815010e9e13b387388f2ab21eaf588a3f6056119aabab6d1bb5ba9fbf2d13fe49e59e63a580ef3315fa42acb502f4bbf384155aeaeec9067bfe580c504a4a66
SSDEEP 24576:i0Le5ji0hmxYrMRrKhxr+EHNmT8oW4ll1JCrLKXI:iPji0A2ThxSMmT8oWgBCaX
TLSH
T18795AE26F6748335D073C0B9C5D2A68AED71308657308ACB4296D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 04a8bc98da089ac10a5e65df6db80660e79c60a28fed560b39b35a8797998e90
MD5 6062572a48bbd9825dc35ba115c549f0
SHA1 f3eaec12e511768f96020b9c4ff1cb65d0d2cbdb
SHA512 214a676853d88508e14a1c597ca6d8cb3ba638aaf13f7f4b94c1d6c668b398b7325d4f63a9ea68257455c661962c9460b0866a23b623f900086f9dd3e7206875
SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWE6q8wyuvrKhxr+EHNmT8oW4ll1JCrLKXI:C/ezSC6vUzPvxHjy3hxSMmT8oWgBCaX
TLSH
T1CF756C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f0019e58fc51463976eff0da21c00fb8742a23e02e22122f0347f9305685a6e0
MD5 f0dc310adaa4e19cca27139c58b7a8f1
SHA1 f0b3f60bbd00fa3859b18cab17eca0983a585b2b
SHA512 2c7146fa1f285fe8ed034f859789911c0fbeeac5d438a7229671256ab19ff886ce18e6d63ee6b233b7f1c50d489d11f1cad193525974c7971589a43f376c8d6d
SSDEEP 24576:GVbqPb88hv/l+66rKhxr+EHNmT8oW4ll1JCrLKXI:GVO88hXl+8hxSMmT8oWgBCaX
TLSH
T111559E66F6748331D073C07AC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 5e771304af0cbc70ef06ff3d4b6b63eeed6046f7f9b2661b0f642b01f40b15b4
MD5 ce90fe2c7d3a5af95eedb629aeff43af
SHA1 666fd6ecca3e11f60887e88db441607ce335f7f6
SHA512 1ed1ed7a131e6b99015be95bbb902bcc8ba5a8285705eda89ca019f864a7e9791bfbb456a6ba74f6df7588442dd6545b4fc97a9675039f3e94fab552f44defe7
SSDEEP 12288:zH7JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:zH9rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1B16523759F0D64ABEE3B8335F87257129A990DDCD1412E3B9F3A3FAC3934C1A9152212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 a22b1ed4476cee5050526986672e8b6dcc9eec8cea24fcbde1552af365174639
MD5 ccb20acbb0088ce2fb972bef4dee0ed2
SHA1 9ce451429c8a2310aba5f6927b9577944b94c05c
SHA512 81ec47665b9172b2d1138cf0058060cc7766b96dc448a2b7851a67f1024596fc3d30f20df742e88ac23c6e45eb7968f4185863f2583dd5900f8d49db87b98827
SSDEEP 12288:NeBNUbTVO86UCJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:NJIUSrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T10285CF3BEE28FCE2C67A8D785A918700D77278704B52A3CBD175830D9E235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e1d080b6ead2cd03149b0779a3828296955d8f14283741c283c8e87e9350419f
MD5 da59790869f2552724c6ccd2cd72c4bd
SHA1 8abbba787a9668abd8198790d7362b1091ef8127
SHA512 13dc70707023c3f0c11c98da5cfef0f4cf1c819bf209d676735db37f0e71d73243b581634db24b6d030911abeec631079e7226d8f9cc10f67ecd721dcf872e8a
SSDEEP 49152:dQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THw:dQvGAdlCEL8c/yRNw5C++M4FHX
TLSH
T167266C656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 6d564c856da4c7e5177c63ef5a115ab34898233c226005a1c6c6d9889ae8a6e2
MD5 18e0d5da4e1f306bdc1ab55d7afe523a
SHA1 4a2800525ac8e4cdbc7a38cba51a564e8efde919
SHA512 ce6e6359f60b7a32fd9274a0104efb001e22f1bbccfe75ecd5833c5bcf27c9fbd47605799ed6ed621840fd92d479cabba4d7c27300bec8034a1808645741bbfd
SSDEEP 24576:z7ewsAjwrKhxr+EHNmT8oW4ll1JCrLKXI:XljDhxSMmT8oWgBCaX
TLSH
T14385E031FF74E036C67F0D766B36C716586C6A604B522AC3E3B88E9D59302D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c14a2aa847c66c3d1f82d6d7252afc6b3d3d7079d85c853f6aac600505ddec0b
MD5 36ae1c87012ffc99f2a59f4e4bfbaf34
SHA1 084909ceb942d5c953d72b008a62b2c5553dbe66
SHA512 ac95fbb413429a54ebd4eda9dcffe1f737933f0dcee39bd311ccf54ccf7dda1aa1bed9cd1904a6cf6930e71eaa20dda35837a366b4ab0e038ad21e584f493dea
SSDEEP 196608:yUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHf4:yUEtQevvqc2W1cpV2EI32f4
TLSH
T16F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ed02959f74dbb71127309c2f6a66974ddc38b39ee0ce1b396facbe925e75e0a7
MD5 c845e778702c521251755047b02a073a
SHA1 d5b6c424cadcf1c2b272fe43ea4de7455f4d96c5
SHA512 81b5c73cf0b0ea1e84385119f3cfd370064ec6bc29e14c6efd8b211b2443edb25611eb55b5f0c94fe6698a1ab94c6cc208f31d5823db9eacc1d29afe38965b0b
SSDEEP 49152:MCbRquA/m2yL5zTfFiV+XenmE3/zjhxSMmT8oWgBCaX:loquVjnmy+M4FHX
TLSH
T1DBD58D1976B8C1E4D1F6C37886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3424f7dba4648ec87d533cf0a266e633c738891111224b2372e75f90a8a48a5b
MD5 0cd3605721aefbc492c77a101f9d1918
SHA1 c29af141082a1998e97f030b2e9f5b2cd82cb59d
SHA512 60a828175b1540a69c73bbb0b8a1655d69eca5b0a5c53a224ddd51c6fdbbd64bd6c5220ec3931f8725bffdab0d34d13ffcff6e10c0c6752ff3e36110a9ef4cbd
SSDEEP 24576:fAhGLJIFoiwtA5l7S53jrKhxr+EHNmT8oW4ll1JCrLKXI:fAMyFoiq5ihxSMmT8oWgBCaX
TLSH
T1A635AE80EBF955D4F5B3AA7899B68171EA76BCA95E31C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 5b2b47addccbed477ab82c5371f9bc19f8886f62953439d481f99a6563ae8aaa
MD5 6b969939dc6dc0fe29d75f8462945d35
SHA1 5094838459ab71da3c42f40aafb8070df3f10fc7
SHA512 b3999d3c9ba94e99b7498780523b4c88d56a6bb8121f9241b4cc2d857ee7adef9a731623ce9e2670a214274a0d584998fca04f0a6a83312d2f56f44d7d86f796
SSDEEP 24576:AwuSOWkrKhxr+EHNmT8oW4ll1JCrLKXI:Aw9OGhxSMmT8oWgBCaX
TLSH
T19E85F14677A91CF9E9678238C557C136F7F2BC052621DB2F1770C65A6F33221AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 de1003c5b9bec18a5b0fe6499c0aeb14d0d37729bc03f6f1c483f008adedf7fb
MD5 04294f015db41f4d01af2115d1468219
SHA1 332b0fa179d8516b1a4eca0fa15bbc52b2d3003f
SHA512 bf50fec8b24f15e8a9e61ea58e66e2c198abe4dc096048f7e210ab2c0d70a4a5b36d3edb08c26a7fdf21cdb0cab8c9e52a104d8009764b7093f0ca54dd07c38e
SSDEEP 12288:yjZ1Iy0JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:+ZuprKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T15175126A279860FAE967823CDCF24605D7B23899633143DF1A3547A92F33DC65D36322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 cff0b35eb54fa846575e6d47098ef4b7abd75b0a79b3a8ed1fe588101cb14380
MD5 4ffb1f043ae3df1840b5f17fda86db0f
SHA1 2d34eadd373e3f84a235f976b63d69f8e5b17e4c
SHA512 c89c9866bc3d3fe0f44e116181b88eda452955f0b74549f1c1c0a15ea6fa7c6736bdbe62920cf0cb3986bec3a03d0c602d2d392546cdf152874c22c3f2e0c571
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Us:TQRQyi36YOcPQLvw2gAf+PN3J+M4FHX
TLSH
T19D667B13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1653f1d077f812715c9e2b665a76b32ddb70430a5c87f2ada0cc9d3ba982ee1d
MD5 4d6a22e847c5bd16ee54972b552eee4f
SHA1 5855919062173ba6f070a800542e9e1045e3c2ef
SHA512 f1a9b8f17618e7dbef0fb058387c2b5aca72a1bccc5f8fb49b8720ae547ea3a294603891367d6be1747c687c801424eb830e7fdb599ecc174a63ae3f69aff480
SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Us:4QRQyi36YOcPQLvw2gAf+PN3J+M4FHX
TLSH
T145667B13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 882b7a16737c97dd060448219c801cdaf4f2518fdaac6ac2fa2f4b9ec66bcaa0
MD5 b78af89c7e8b6e41e6f631ddb5e31816
SHA1 75e0bdbd29ada241638f7bd67dbbdc8be5b1c834
SHA512 62700d11e7132c00c7311adfbfee07949e45ec1ca07f883b1abb4c8c217ddf0d5589c587f71489717ceec7962f4c4805b878f9bbbd6d9632deb8f83e7f6847db
SSDEEP 49152:X68Qg55nhheWu7PNU3/ThxSMmT8oWgBCaX:BthWRc/T+M4FHX
TLSH
T108B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7f5ea5e5858c8b08a7d9d851bc52d64e20f018c88dce9f4527b450c1f4dbced1
MD5 7cca91ff1e2e335433bff1ff6ecd3360
SHA1 036e3ba23ccfe6715b58727e36fd18987d30b821
SHA512 46cf6d6ea434b8ed27af31523bf9cc0fe52c6e46725f1989bdcd6830d779fdba595172e432662089b695e44fa84bc0268953d66e2fd565743747a373cd606eae
SSDEEP 49152:43aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99W:1y5112gYy5azzVvL69nLKnhZE+M4FHX
TLSH
T1CB167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6a27eb0a0d968f558860ee0ab777408604f1bde246ec317ee699506bf62d0afa
MD5 a8d5dd5e37781d7f09b899f2cb895db3
SHA1 3a481f6506a5e643734dfc24c20baa350c7b5deb
SHA512 c70ef4420338de6fe1a9715b037186a4daff082018c256e32bc3dc83a90dbf0eb761a755594ee5ddaff466f604c300cc844928e582d458244d6b623b81fdeb50
SSDEEP 49152:6B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glBhxSMmT8oWgBCaX:ou6JmVxd2dB+M4FHX
TLSH
T183D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3d9079ea1ef49ea780d9a6338990c2779c26a508fedc41402e3ac5a50326782a
MD5 a22a31f8b46b364254b3ea778266ff11
SHA1 e20cd6f2c786af332be1ee24d9e10ee1e8b498ce
SHA512 b1b74b408c03c9c9f7638b5ad62120c2adbbffb26585339c74bd3f9d65683db102d3b1c53531d0915d0b6fb05dfb589307dcabd4f482dcd2cf9e30e996b1b050
SSDEEP 49152:21hpsNoJpF1A6UU44CwH7R4xFhxSMmT8oWgBCaX:2mifPbRy+M4FHX
TLSH
T1C9B5BE13F2D900E8D06ED17887569632EA62BC450B34B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8854d843708f4750775371af32343b0fee79f7c20a0384ba048e2acec9710439
MD5 4dc9ec652161824ab3a00f5ed02e8379
SHA1 20fcb85c4b6df921cb1dd2d0311c4099dffd01af
SHA512 53a690cf183215656a025afc70ce8ceb67efcd94a9543a5f8b3d5af9f40a45a92ff673275ec7bc41c5cba5ec0568f857084c4d46787956e57ba41c62dce91a39
SSDEEP 49152:MSuZQIY0Be2KRRVtOnks6NMHqQhxSMmT8oWgBCaX:u5dKTi61Q+M4FHX
TLSH
T12CC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 588f4f74fafede0d6c1397ed9624fc807d72b3b25bbed48f280f88587267f9f1
MD5 fa9bca46c719f017519cc8d2fec7a4ec
SHA1 adf4e2a4946a159e9c6cbb3d13fad94838acae93
SHA512 b9cf34e3150ca5c3574152e87ee4086e0d3c5654d4250f4c5fe4cfeb65c8e7b06765559b20c6f863e9df139c29694cab77a3374163bc03d0e1082cab9f7f8875
SSDEEP 49152:ehtSn8EApI0figngiDn0AP5wxhxSMmT8oWgBCaX:/X2iyphm+M4FHX
TLSH
T1A895BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 9469e2ad3317af7c8111465473682378db5687c31cf11023413e114bff0a04ab
MD5 67055f5ab3a53e54f643410f2ab1096e
SHA1 c8c7b663a9506ff7285e01b19454146d8929e201
SHA512 4e4a4e55537fcd690907ac560d0bbee22f505bb40f146f7a3d248e4a8e59e0ec79f89dbf1e206f3c9c26058ecef51998f3f378103b0f0d350b840354c89340fd
SSDEEP 12288:ozJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:oVrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T16B652375AF0F94EBED2AC335E8624716999C0DDDF201263BAF3E2E683B31C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 7030f6a92183fdbd9caac64edd8cdfcc86d3309a540f63cef6e9ef12654b70b5
MD5 3eb1c3da6dd9eaf72a518f62a2ad9d99
SHA1 f0365bb14b1fbfd8ed4ab85a6182467327136671
SHA512 c46b2791d896eefa5b9f7b17d2a8005f7127870196497ff574388aa2e384e2d51fe3b01643e639b937decb4046860321c1018f6128dbead700811a8ff6e71e5b
SSDEEP 12288:mwJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:msrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T10B652375AF0F54EBED2AC335E8624716D99C0DDDF201263BAF3E2E683B31C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 eeae6d179b9019d22752134f998350633a5637aca538c67648effce995adb497
MD5 a14698d93f2bfc98de0c34013a349065
SHA1 8b93270e287d1247893b998b161939626cc51762
SHA512 39b063833b2530536e2ad0d4abdce5fd5d8dfe0aa59d8c9870c3f3df5574ea35ed6795918cbecdfc0d13e465c56113dd78d37ce23cd45d34d701cb9990c5cf93
SSDEEP 12288:IaJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CXDp:IqrKhxr+EHNmT8oW4ll1JCrLKXIN
TLSH
T15F652375AF0F949BED2AC335E8634716D99C0DDDF202263BAF3E2E687A31C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 b076cad5e68ce0484ce8a9dbdb7a698222dfa527e5312145c05a3d9ab91da05b
MD5 ebe5b0ad822bb19fb75066799d2a58dc
SHA1 9b0a21153aa9b9121547fdfe6ff016aab6f88c08
SHA512 5d70687a637a3eac99ff0845cc33cca7501785cdf68925882c0727cdec9d95916caee04addc19af4819aade3b9cf51a983ef94b8130642cd3eeba191bcb008eb
SSDEEP 12288:VVNJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:TrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T10D6523656B0E50DBEC27C338D8724612D6F93CDCE322277F9F251E682E31A996931B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 96b1ce2e2f2a067be9da794352e8914546522e55a5557afa33179b58ea4bfc19
MD5 6173204c4df570735dd3f3e7a12cef42
SHA1 7e063345b0933dbb93220788b21d19ab9664d9e7
SHA512 d5468dd4b43b625a43f907571fa350f7f97f47da8ad471c3218e75d6ffa76d22182663cf0a3a01a2fd6b53baf74c52a917cfa707101a331a48212f2f329cbf1f
SSDEEP 12288:MVJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:MLrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1C7652375AF0F94ABED2AC335E8630716D99C0DDDF201263FAF3E2E683A31C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 ef75ed11f133a607a8a73f908b78f0620afd1a418f83c59424ee2cb680e625e8
MD5 912259e8fb6b108f19a08d030caa43ff
SHA1 02787102678ae393ad00820bac9f386bc18f2eb3
SHA512 7f544eb3f971c05b2b4de932d477d00666a6de2b2e795efd0faf24a40ff65301017cb0963a8c47fd145a09503a80328efdd76e2b229ca96ff2000065f6af892d
SSDEEP 12288:x8JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:xorKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T11B652375AF0F54EBED2AC335E8624716D99C0DDDF201263FAF3E2E687A31C5A1152221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 78ba21860eef88a123cc4b4c0140735d3fedace0adc8ab92f44243cfc9c4df3c
MD5 5121d8485521022e22ad5b9570371c47
SHA1 3d5209f129e8f1f4a1cc47cb233610fcbe0c0840
SHA512 e4b048aae69eaec4bcdad960b0e61a7cb56b332f8d504abb3e682b02c35e30d230fd3d42b1756d6da5b3f7e4928554a435abda9ef7f0389527333a24d7a1653f
SSDEEP 12288:I4JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:IUrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T14D652375AF0F54ABED2AC335E9624716D99C0DDDF201263FAF3E2E683B31C1A1152621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 98df0158a61e284b2c62bc92a54df5187a13f7244ad07c687ead2305d3cd09e1
MD5 2b27920273b600f7a7d6ee9fd31d83ef
SHA1 e2a648b0ac7093713662fbdb964c51b920877974
SHA512 1eaa68eb2cda4bfaa2a540c61f0f47b82c06198f8d94b774338c53e46794d2cb7e7bd661033d93317addc48f7b3d3282d609e137b76eca9e0f0c92519502dc08
SSDEEP 24576:sZMEzFVSOMrKhxr+EHNmT8oW4ll1JCrLKXI:sZMEzfLhxSMmT8oWgBCaX
TLSH
T1778502A5B35018F9EC67823ECD218906D6F27C594760C61F07B8366A6F337A11C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 13c3d888644eb707ccb34f4f5f33f1b6bb21c580ae08a34d05d18abc263c29e9
MD5 cef78e2b9236dcc661968dda95f09179
SHA1 4d857f75a0757b6665ef6746b211555fa33ae10e
SHA512 54029badae0dae3c8ab51e720764913cea29908288d3996fb04e8b5057caf0b226d143ea2ee9089d5cc3d937911c5df517261df6bb31e57ed1603edc4f4cf64c
SSDEEP 12288:b3JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:b5rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1F8652375AF0F54DBED2A8339E8624716C99C0DDDF202263BAF3E2E683B35C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 821239031cf83bcdea7edf5177687410698734914586213b07b19920d8f444fd
MD5 0eae682f7929f884b2700959bd569615
SHA1 7c08c433aea2c4dd33ba93f1f22256be4d1d6565
SHA512 6da7df87bcc1aa22a778ade86c6e57c926dd4cf094765b6903630377bc785240e237c162db2528c00d9cf7685d2959d1d45be0f94cff3bfd93dee1ba6b834cd9
SSDEEP 12288:DrJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:DNrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1A9652375AF0F54EBED2AC335E9624716C99C0DDDF102263BAF3E2E683B35C1A1552221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 d997ccb1619f6e8a51d065b7446cfcf2a0d2f55d12322c18b6bb069908e3790d
MD5 06dc22c5add439cfb3aeb11270bb8c47
SHA1 9b8d25f6707c673f5b8fefe2753447b7792403fc
SHA512 eed37d3440aae93ab824cd52b214b57ec007d834ac858eacd59dc133503cfb68abf787ac4ae6609c308708ba079eb7d7e6716ab903ac5a3a77b46a0675e66a19
SSDEEP 12288:cyPz5L80JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:FzyArKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1F5751217779630F9D5378238C8621A02F7B57C7A53209BAF5B64077A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 598a1a8340a92db4f095633bacece153fd13a010d9ffa4dbfc0ae8c556a532b8
MD5 a986558b79ae31d8286f9be6e9b1a320
SHA1 5a394f77e0bbbe5dbd9f64026a2e51b4fae2f0c6
SHA512 39d3107a86af73d66433d8f32ddc34e0ed2cc9d794488feba70b76e7c55f92ac1b4fe974276756a9c51bdc0b437fd77d2131e20e7f95ba4973a4fdcbd29094bf
SSDEEP 12288:53JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:55rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T11E652375AF0F549BED2A8339E8620716D99C0DDDF202263BAF3E2E683B31C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 da2271ec577856b27a7f263a951f449dd033d1485e8f120cf2d075cf07ffa91f
MD5 b5478e66a65985b3f0c530f0596827a0
SHA1 11be6aca4fe3a967ceb16427350db3d4d295cf1b
SHA512 17cc30bc290032998f4dad40b53b53781adbd9bd4d47e7c38924bdd54aa94c59288c2f66dbbf15a87b301357e747ebb710dd3c4d0d655982a47696bd5c970d9b
SSDEEP 12288:W3JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:W5rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T123652375AF0F54EBED2A8339E8620716D99C0DDDF142263FAF3E2E683B35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 9fadad9de12172130e33b77b06e5e7f9a7b83754ef81e81dd3fce51447b83992
MD5 56fd536ffe8438625bb66f852ce6854d
SHA1 cbf66b83258b6290b94561a3bcc539f7c634b135
SHA512 b8c6950197ced3e3417145c7a2b66b69a553fa4262814da4ef61e898d497749b469b6acbfc9554d57afd1f255382bc0622c402f4fff04c1d393b6e2dd3789dae
SSDEEP 12288:PyPz5L80JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:izyArKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1EB751217779630F9D5378238C8621A02F7B57C7A53209BAF5B64077A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 1c5d11b524ab266e8bb37beb4bf71c1c98e14a00889e8ed832eb8b98de05063d
MD5 6cceefa54ca9ad7d178348fc62b34379
SHA1 4172e3405b557c3fd7244515586d7ce747a54a21
SHA512 6a029434c0d1e3ecd9392a4a3e8afc11af1968f3c781091b1f01f246f67039ef752d93ee327f76b972f3f2703e4155329e233c6c467e31e7e0ad5fb34062c7d4
SSDEEP 24576:rcP4mcvIjkGOxhKP2l71SNKbrh/8KBBrKhxr+EHNmT8oW4ll1JCrLKXI:AP4m4IpOO67N8K+hxSMmT8oWgBCaX
TLSH
T19865AE2DABDC0096D0BA913885658A4AFAB1742E1F3286CB1160937C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 58ebc11fa469dc16a5cbf32a3cbf0c115a43e20e9205f891cf8919ba9c9e0f4d
MD5 168eaf635114dab7bcebd8818f66849b
SHA1 c60b4f9d041a9da6359ef80585e1a258796b71fd
SHA512 d925da064f472aeb14fd0f6b2ef025ab421509f80879c2c7b34b8c63dfa7a6b02c8a433ce96ad58faf25c493cd029375d5686791b9450ccc3de8be964cfcfb62
SSDEEP 12288:VzsfHJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:MprKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1DD75F119D24801E9C46E9239CB524A01F7773C6993E193CB5BE0F93D2F36A945DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
MD5 29f1b2d1b6f9290138596cf180847e53
SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
TLSH
T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 168B
SHA256 faa94c68a73f72cfefcfb37d0ff89e1ec8fae39707a168b747dd2413f90ac6d1
MD5 356892a082367d5263a0d240e3512560
SHA1 361961edbc0837ea449b9e3b17b98d0d0d79aa5a
SHA512 657a28921cca9bdf641a08ee406c8adcb8cb3f7e7be986e160deacb25d0f2f0088c73d323e48c6a2cef798a7226a28a4cae136fd9b8628b8e40bad71d207c4ca
TLSH
T152C08049031ED4DD8725014056493FD0106115B1D351499C32F07F06B635C3A4D57C5C
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp7229.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp7229.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp9090.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp9090.tmp
Size 3KB
SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
MD5 ec946860cff4f4a6d325a8de7d6254d2
SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
TLSH
T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 5dd8b4f169000d3a9f94ff045e26a225cd49214e6f323e3c9c56f7f999bbc9ea
MD5 9df39525d2981c769c8dcd0f2e47cbd9
SHA1 e023e03a629cc3d01aaa648b9e7c5a80eca9c283
SHA512 5bad580f27bb6222cebcca5f0a7d5336f257a47dd329ddd1091c48d033cc898964364bfad8968138750791d1ae40f7c9af3a12e3523b11ab83c8228958ae47de
SSDEEP 12288:XnJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:XJrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T12E6523759B0E985BED3B8334E8228335695D2DACE301556FFF2A2B6C3A30C565D62312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ed078307e8d8cb865efb58eaa1a5d9d4548a559ba3936904224a57acea26bd89
MD5 290aef81e6e77826111dff4f5f43679e
SHA1 0007daaeb6ad97fb4c316f08f6ec612c29573495
SHA512 a04f231046f0e649f152939cbacab1845eb9fd8330a2e66c933e3520530316a8677d06cd43a876592517e7a35c4736c2ba6c791a89d538981903d84cb6477a45
SSDEEP 49152:Ma0h2GEkuAe73q3pp46zwwQahxSMmT8oWgBCaX:Ma0hNYG4Jwr+M4FHX
TLSH
T10B85AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 fc63899357611063c939ba981b5951935442f3d817ad5a60ac25e78e2cb34332
MD5 f6308c01a1ee337f74626ba39dacdaae
SHA1 b7386f7d8e92dcf51a0cc4c2be7c91bf47dea2ae
SHA512 46c4d02871f5d68746326e6741d5425138b9453c70f20b4b06c20d3ea7a3b545253ea13a4b7db8a04a828cd1d05ddd0a75f7f2547fec96fe8ca1c5730af12482
SSDEEP 24576:DhbHjPcrKhxr+EHNmT8oW4ll1JCrLKXI:DhbHjnhxSMmT8oWgBCaX
TLSH
T1D775017E279D20DAE932D23CD9528606C771BC691311A3EF27A682791F37DE81C35B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 9a9b3aa4dc37599f0c40662391f3460cb37e32e99972284d2fde35b54a3554c3
MD5 4145a6d48e32261148502aefe8f6a872
SHA1 b445ef5d91aaa1139e979aa022e035798698574b
SHA512 f0b0549437b748fb77f2a369be0ce657288890e7a481137832e057533803a4671ef0c94caa05f7297f1d715148c2db6f1b31b3c08c21930d3a22abcbc94f31c9
SSDEEP 24576:I3YgnJcRTk4yti+R5dpR/krKhxr+EHNmT8oW4ll1JCrLKXI:IIgnaTk46ppR/XhxSMmT8oWgBCaX
TLSH
T1AB45BF2DF3B910B9D8AAD236850147B5FB71782D1F209ACB0170C538AF1AEE85E35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 03d1cadb193f35eeed6b02d250d51aa7137e81606a88263cc21ff2a3c4195efd
MD5 9802044a42702e1352118d3d48ad7706
SHA1 24683adc825a83d8224fab34e9df7152787ab41b
SHA512 663d1effec0b66b12a0dd27033fe383d7153f3e1d9ab6da89970acf2463971c67b98e07a4a7bcc24f179e03e4b98e8a20da1e3cf18f46f6d3bd82854364b2821
SSDEEP 12288:VbJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:VdrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1CB6523755B0E649BDD3AC339D863471599880D9CE30217FBAE3E2E683B35CDB1572211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 9e78f92585311a810db85b8c348665366e7a4b5cd76cec7e5e3ad62a4979adb0
MD5 8a8a1dde3eb921b01731d710339b8af6
SHA1 7cc05c5b64dcb9ea36df75d053875dbe8c2c2387
SHA512 3d91a43bf99acc064a6ceeb60c1e214d326786bc1ac0a68cf4d08ea775d9b0d5114e41a636d5e54db30f980a59ce8c8d62cee9a480fce6952d3226c4e381ee40
SSDEEP 24576:TfL3UTOrKhxr+EHNmT8oW4ll1JCrLKXI:TfL3UlhxSMmT8oWgBCaX
TLSH
T1F795F155E79500F9EC7BC23CC9628A16E6B2789D0360E7EF07684B651F236E64E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 20948b93e2106173f2be5ff4e061b5ba361fc6bb24c1f7b2abee0de85e724519
MD5 eeffc9404f802d80474308c2b16e2e67
SHA1 90ee6c1be118873364af8bb37eae540c8bd87ada
SHA512 e6bf71bdf8307fa18a0028eca87e29fb67d9cffd1d0623571474b890e7c69cbb45107ebbd9befeb18f1654b84311bd9fba6256114ff7e2af55678afbb4274a2a
SSDEEP 12288:UpFtfOiJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:EOyrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T140750229379D10E9E93A923CC9934309D7B17CA9531217EF46A085BD1F73EE86C3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 acdd85f8c16c4b05dce6841fabbb36d723f6fe9c16cabad56dfd5507c5d2e1c0
MD5 369052fb94d8473d4850f84f3a805610
SHA1 f782789c98286dae52d971299b532c44bf78adff
SHA512 b67323fa1d61898c6c9f22026b7443a3ce8394dce5105b3c4a78abf8a3b87306852c5381023e03e0d6dcfc508629a563fa1fc901abffe43f29f4e4df177c7b70
SSDEEP 24576:a7NM9YmZqmWMUkPjZM48Mv6bEhs5rKhxr+EHNmT8oW4ll1JCrLKXI:a7cBWMpPjN8DbEhPhxSMmT8oWgBCaX
TLSH
T1E6659E2E6BAC81E5D477D13DC9A28206F6B1B4651B318ACF1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 895134d1d9a10725219c7ccd921e6123d267edb59086430f94c5239aa9d4565e
MD5 b0ad9c56b5a5640d787f18cbc05c9aac
SHA1 23ba9edbaa984458d2de67ebfe407ac9662374f9
SHA512 dc34abadb114fa411313a77b1a9938210927132b477e401a176100ade8a46c4ba957eacae43e66e6a3b48335eef7bc2d330c4f25b3a96c248c4454af05bc16e6
SSDEEP 49152:xF2YuHNETovcvNYf8kmghxSMmT8oWgBCaX:06tCf8kF+M4FHX
TLSH
T13F858E2927ED80A4E0BBD27D85B7D246FAB2B8551B3056CF0255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 5b860e3632b26a95c80140c24859ec61f36d108dec33fbc7a5e177d871b135ac
MD5 a9d92193420303a6c253bf784697919e
SHA1 7310269f64ed8861f07cfdb62a0f4704e396248e
SHA512 2ffc7e77c2b4077d4c7f86da954cf8c1ec33e69b47dbc69090c2311338beb2d2e85652cf83ff899606905931208641c54830d4dd6443807a90c34634e2d39a73
SSDEEP 24576:2AFs06+Omlf3NXEbTomrKhxr+EHNmT8oW4ll1JCrLKXI:fFs060lVXu6hxSMmT8oWgBCaX
TLSH
T12365AF3F66AC00D5D07ED17D8997C91AF6B1746703216ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 2376739ee473e873d69dafdf495b5fbb0e3bf9d222e4c6c1829d00666cbd472e
MD5 50ab56cbef75dba127557983eafcc712
SHA1 4fd0885400c9491a430b3573f465027451c49930
SHA512 55abf5b624ceb6c5b4b377574520ed50f925e6fc3496d13112ed09a3d49017eab38332cfdc76a23e17fe96b52f1ce1fc194636dae1f82bbd94d6a67a807af67d
SSDEEP 24576:kJnJ5D3WLrrKhxr+EHNmT8oW4ll1JCrLKXI:kJnJ5DGL6hxSMmT8oWgBCaX
TLSH
T17C85D03DD2A810E8D4B7C374815A1B56FE72387D2B226ACB28B4D5353F12EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 393cab20abeb718bb07623d5f7911707f01ba8ab8ebe2925285759c33fcd5bd9
MD5 0cdf9fc1fe2d9006cb1a1abe63322a2a
SHA1 e8c53589dbb824ff537627c4e14a0990c1aa841b
SHA512 7ff045315fb84a035da59c7b8acc620758951048a0e44c01cedd9c3e416bddd3af6ce214f973f67b1e9a1f1ad20d46ff124f8ac295a3ea2502560f2950660078
SSDEEP 49152:ko06DIKdwc+eQnSt65aV8hxSMmT8oWgBCaX:5W+M4FHX
TLSH
T19A956C15BBEA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 cb66a441a1630671539ecf8609c13e934cb07d6aa54ca7e76c550e2592b40a58
MD5 e6c31db417930463b2e840f6f301a889
SHA1 48f864e270733684eef1ec1a4e03841876c32d94
SHA512 55493337b300c74ba96be50c455d7880b93d4d19b09a0034075ca2d3a34faf8a61964dfad31a9044dce5c74c53f3aa4b1ce31d19694d09d9a01169b5b7f073a6
SSDEEP 12288:yEP3RBZJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:xBPrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1CA75126D2B5D70EAD82A913DC4A18605D3B2F4B8631227FF5AA5823D4F33DE91D39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 1ce62287a9e4bda6e0e43bc555f9b92035b47dcefcc9f0c237460d529b7111f2
MD5 ab1288020b287d9a8907853553a2992a
SHA1 7c8ee78f5c27d918e61f51dc8bf87b61750c8518
SHA512 4ba4c18afb076c83ae27b07912adee4f57e7b2bbd0721152bbe150cea4d0daf3b4de6dbb7014c4781544977751841ad3d3b4d82a83c3ba5729065c0bbbe90b85
SSDEEP 12288:EjkywJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:EIysrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T12B751214638860D9ED7A4238D97382619E747C24AB1157EFA9A0FB3D7F32ED46C31B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 1a34bd59078efedc347395ad56c4b9c38ef739f3146123026c20a55b9fd54b8c
MD5 3b2897676a7a90a930a1781284f40d89
SHA1 4e37a7f5affa2dbe5f0fb73641d90db5e912c02b
SHA512 f00025b7816086f55044f8a82ed0e428da74671a0d3d61d00bfd1f9f3b9209e7e62df9add0c6c70c09a7c560214b4492d516dd4690fb8af15e017b2159d67bd5
SSDEEP 12288:KrSJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:mCrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T12365237C5B0E749FED268338D932471195A82DBCA30129FF6EB96E786B31CD61172A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 94ab58caab6954b8ada25790f354f6f3b9f674075be40a826c5e831e8da7881d
MD5 92e1982ccc94175497aa4cf7abef65f3
SHA1 1473d6bdb588e7cc220cf182e01b1c8fea9db9d5
SHA512 398850fe2ef0f3921415a3d4c7061a1968c447ae2e5e504f5c521081d2e9ed17835287ee78f71ccadb96541c35c73ab222c90202fc9e37437e390daf98cefb88
SSDEEP 24576:DQ9MxZKdcz97w3xrKhxr+EHNmT8oW4ll1JCrLKXI:DVKXYhxSMmT8oWgBCaX
TLSH
T15C557C2DABE9059AE177D239D5A250C3A673B4301B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 5ca74a56caaf2775231fbee46989d29327283ccc8dd4341b88a86f4597537119
MD5 8bcadb04f7a4276f662f8e535846b705
SHA1 4c51bd5b649502d6e3daef812def39aa62a38ec7
SHA512 532110ee45b80bad554f3d05a23fab31061af285c4b9ec461ed5ed6e7d3ee1e2ea6036f0611d1c5dea51d70bfac023b3ef94182ee3eb904779ae34fc63bce4cc
SSDEEP 24576:YyocbApwrKhxr+EHNmT8oW4ll1JCrLKXI:1ocbApDhxSMmT8oWgBCaX
TLSH
T1BE85EF1FBB6E40A2E036823CC9818705E7B3B4745B6267DB6691C73D4E239E9BD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 2def3d56066fb4c953507ba3124eaae8f2c40478b2165d660217d9c81d94407d
MD5 258c05141da4c7d2b47ffe25e37ebe60
SHA1 14ef39849f38b7bc89c118712b6076c42b92ad75
SHA512 4274f145a0e65e43983f08317f3f08cb6057d6bd1c232090e85b37f65af68928034a392d1156363ad02af6838fb285c6a00124d1ff736af4e5d8acc436d70289
SSDEEP 49152:TWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKDhxSMmT8oWgBCaX:T0zuNIH+M4FHX
TLSH
T1B0A57C3DA2BC00A9D8AAC375C5451366EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 99ef897115c4c9f5d054e7f334b0052f44660c3101a9cf9e4f57030f2416ca79
MD5 554253959eb94c2fae960cfb697f07b0
SHA1 1e08b72ddaf487d8e6d39a57d7784583983c7e11
SHA512 36f3d7bc87d7feb67a214f9926f8104bda6e79edfa0a0bda4f6812b029cb588fca46f88ffffc1a4090390f059d97c43fe9132407ae97fef866869f9e209a9362
SSDEEP 49152:NTDxR+N5YzTljMlhxSMmT8oWgBCaXGtUaR4vPmd90mb:5u55+M4FHXGtzmUi
TLSH
T183A5E12EA7F855E9D17EC6789A238502FB727861033193CF42A0C17E1E6B9D85E76F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 6a418abf32f50395cfc187dbb3b4454499186ff53cd3975ccc2b625eafa173cb
MD5 22848e824556682e0f91cf672730f224
SHA1 4a211afca5fcd34f9da2ab5516d0568382bb2e84
SHA512 9da1bb7fac49e5aa69cd1b007ce1fffcd64e2b9c3619c059336559a7af11a09340f2d5db29ad3ddbc81d086e016e14dd1e6a4f87495f7faedd98af8c54c43b34
SSDEEP 24576:tTMdOz0FFS+kmSLDrKhxr+EHNmT8oW4ll1JCrLKXI:X0K+kmSLyhxSMmT8oWgBCaX
TLSH
T1B185F17EA76D14E5E47BC23CDA538906E6723865032276DB06A0C17D3F67EE4393AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 190dd29abf3ce9b2c5ce87425e6136548fb5b98194e56f3ac7b6c49e5567e490
MD5 c8515a55fe1d3eb0255943f3ddd5cfb8
SHA1 76a25c08dd77a4c4a28303d702f663b23bd65398
SHA512 9403e8e542993ef31bd1a201038a3bfff938fd05c0ece8b405d8b7f42b37c2161260dcf5611b31357f778af04429580755240afef2f37f2b1b3a46d641741def
SSDEEP 12288:Y4pOJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:VOrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T12775122D27DC30D9F8368238DA32421686707C7963112AFF3AE5CA7D5F329D99935B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/956-43-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/956-44-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/956-35-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/980-578-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/980-583-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/980-153-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/980-284-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/980-160-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/980-154-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1028-257-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/1028-627-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1028-251-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/1028-260-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1096-173-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1096-405-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1096-171-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1100-176-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1100-182-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1100-426-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1100-185-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1264-90-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1264-88-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1264-93-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1264-95-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1264-82-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1396-131-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1396-125-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1396-133-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/1396-247-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/1472-220-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/1472-101-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/1472-108-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1472-102-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1720-572-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/1720-195-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1720-198-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/1720-189-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1848-272-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/1848-269-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1848-628-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/2140-236-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2140-622-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2140-233-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/2140-227-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/2252-29-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/2252-21-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2252-30-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2252-121-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/2340-629-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2340-665-0x000000000D810000-0x000000000D818000-memory.dmp

Download

memory/2340-664-0x000000000D810000-0x000000000D818000-memory.dmp

Download

memory/2340-285-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2340-306-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/2340-324-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/2340-290-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/2340-282-0x0000000000630000-0x0000000000690000-memory.dmp

Download

memory/2340-276-0x0000000000630000-0x0000000000690000-memory.dmp

Download

memory/2340-662-0x000000000D300000-0x000000000D308000-memory.dmp

Download

memory/3028-682-0x0000025B3E450000-0x0000025B3E460000-memory.dmp

Download

memory/3028-677-0x0000025B3E450000-0x0000025B3E460000-memory.dmp

Download

memory/3028-671-0x0000025B3E450000-0x0000025B3E460000-memory.dmp

Download

memory/3028-672-0x0000025B3E450000-0x0000025B3E460000-memory.dmp

Download

memory/3028-675-0x0000025B3E450000-0x0000025B3E460000-memory.dmp

Download

memory/3028-673-0x0000025B3E450000-0x0000025B3E460000-memory.dmp

Download

memory/3028-670-0x0000025B3E450000-0x0000025B3E460000-memory.dmp

Download

memory/3028-676-0x0000025B3E450000-0x0000025B3E460000-memory.dmp

Download

memory/3028-669-0x0000025B3E450000-0x0000025B3E460000-memory.dmp

Download

memory/3028-668-0x0000025B3E450000-0x0000025B3E460000-memory.dmp

Download

memory/3028-674-0x0000025B3E450000-0x0000025B3E460000-memory.dmp

Download

memory/3028-678-0x0000025B3E450000-0x0000025B3E460000-memory.dmp

Download

memory/3028-681-0x0000025B3E450000-0x0000025B3E460000-memory.dmp

Download

memory/3028-680-0x0000025B3E450000-0x0000025B3E460000-memory.dmp

Download

memory/3028-679-0x0000025B3E450000-0x0000025B3E460000-memory.dmp

Download

memory/3140-98-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3140-48-0x0000000000460000-0x00000000004C0000-memory.dmp

Download

memory/3140-47-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3140-99-0x0000000000460000-0x00000000004C0000-memory.dmp

Download

memory/3140-56-0x0000000000460000-0x00000000004C0000-memory.dmp

Download

memory/3196-122-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3196-113-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3196-235-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3196-119-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3464-271-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/3464-150-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/3464-142-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3464-148-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3604-65-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3604-59-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3604-68-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3604-184-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3868-259-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3868-139-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4152-903-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/4152-883-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/4152-780-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/4164-201-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/4164-207-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/4164-209-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/4164-598-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/4688-15-0x0000000002CE0000-0x0000000002E29000-memory.dmp

Download

memory/4688-8-0x0000000002FB0000-0x0000000003035000-memory.dmp

Download

memory/4688-0-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/4688-1-0x0000000002620000-0x0000000002687000-memory.dmp

Download

memory/4688-14-0x0000000002620000-0x0000000002687000-memory.dmp

Download

memory/4688-16-0x0000000002FB0000-0x0000000003035000-memory.dmp

Download

memory/4688-459-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/4688-67-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/4688-400-0x0000000003890000-0x00000000038F7000-memory.dmp

Download

memory/4688-407-0x0000000003890000-0x00000000038F7000-memory.dmp

Download

memory/4712-71-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4712-79-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4712-197-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4712-77-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4756-218-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4756-223-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4756-225-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4756-221-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4808-239-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4808-245-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4808-248-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4808-626-0x0000000140000000-0x00000001401FC000-memory.dmp

Download