f8ff393b4f0f852003655de228f5103cef4970edd282c474d30517518ba17ab4

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
Size 3.1MB
Sample261012-sty2vsf15k
SHA256 f8ff393b4f0f852003655de228f5103cef4970edd282c474d30517518ba17ab4
MD5 97c4e12dbe4c67e23f98f5479a2a0c6d
SHA1 65d32ab6d9331e83dab6eccdcab51523095e83d4
SHA512 b28c1f95c3417f597b8d5b7524d9981f77a75fc0eabfa807fa496c2fc12f9ef57a27fbfe2392716abd4e1ba293447ec2e67a7c9960705830c2d438fb4ee34996
SSDEEP 49152:X5qMWA9n/TDbXNKddoOUTuZ0Y8ozJJgA9n/TDbXNKd:X5qYfb9sjUaZ0YfrFfb9s
TLSH
T10CE5120077E48036E2A324754ABDD71989ADBD756F2182CFA3C5262E9F306D1DA31B1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe

Executes dropped EXE 23 IoCs

pid	Process
3484	elevation_service.exe
5404	elevation_service.exe
5636	maintenanceservice.exe
2980	msdtc.exe
2472	OSE.EXE
4576	PerceptionSimulationService.exe
1972	perfhost.exe
1392	locator.exe
1348	SensorDataService.exe
4932	snmptrap.exe
2240	spectrum.exe
3016	ssh-agent.exe
620	TieringEngineService.exe
4268	AgentService.exe
5132	vds.exe
5388	vssvc.exe
5264	wbengine.exe
4944	WmiApSrv.exe
5860	SearchIndexer.exe
5876	Reader_sl.exe
6064	alg.exe
3880	DiagnosticsHub.StandardCollector.Service.exe
208	fxssvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 46 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\84bffe81227ba850.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0001000000017bd0-123.dat	upx
behavioral1/files/0x0001000000017047-122.dat	upx
behavioral1/files/0x000100000001700a-121.dat	upx
behavioral1/files/0x000100000001700a-868.dat	upx
behavioral1/memory/6064-869-0x0000000140000000-0x0000000140167000-memory.dmp	upx
behavioral1/files/0x0001000000017bd0-890.dat	upx
behavioral1/files/0x0001000000017047-899.dat	upx
behavioral1/memory/3880-908-0x0000000140000000-0x0000000140166000-memory.dmp	upx
behavioral1/files/0x000100000000c53b-929.dat	upx
behavioral1/files/0x00010000000233db-924.dat	upx
behavioral1/memory/6064-956-0x0000000140000000-0x0000000140167000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107609\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Temp	AdobeARM.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a037bffe5d5add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092b5c0ff5d5add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060dc05005e5add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000694ad2fe5d5add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008dd69dfe5d5add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000859ac1fe5d5add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000077eab0fe5d5add01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
5032	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
5032	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
5032	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
5032	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
5032	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
5032	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
5032	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
5032	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
5032	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
5032	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
3484	elevation_service.exe
3484	elevation_service.exe
3484	elevation_service.exe
3484	elevation_service.exe
3484	elevation_service.exe
3484	elevation_service.exe
3484	elevation_service.exe
5404	elevation_service.exe
5404	elevation_service.exe
5404	elevation_service.exe
5404	elevation_service.exe
5404	elevation_service.exe
5404	elevation_service.exe
5404	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5032	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
Token: SeTakeOwnershipPrivilege	3484	elevation_service.exe
Token: SeRestorePrivilege	620	TieringEngineService.exe
Token: SeManageVolumePrivilege	620	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4268	AgentService.exe
Token: SeBackupPrivilege	5388	vssvc.exe
Token: SeRestorePrivilege	5388	vssvc.exe
Token: SeAuditPrivilege	5388	vssvc.exe
Token: SeBackupPrivilege	5264	wbengine.exe
Token: SeRestorePrivilege	5264	wbengine.exe
Token: SeSecurityPrivilege	5264	wbengine.exe
Token: 33	5860	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5860	SearchIndexer.exe
Token: SeDebugPrivilege	3484	elevation_service.exe
Token: SeAuditPrivilege	208	fxssvc.exe
Token: SeDebugPrivilege	5404	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1968	AdobeARM.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 1968	5032	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe	95
PID 5860 wrote to memory of 2772	5860	SearchIndexer.exe	116
PID 5860 wrote to memory of 6056	5860	SearchIndexer.exe	117
PID 1968 wrote to memory of 5876	1968	AdobeARM.exe	124
PID 5860 wrote to memory of 2368	5860	SearchIndexer.exe	144
PID 5860 wrote to memory of 5104	5860	SearchIndexer.exe	145

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5876

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3484

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5404

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5636

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2980

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2472

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4576

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1972

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1392

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1348

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4932

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2240

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4288

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:620

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4268

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5132

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5388

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5264

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4944

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5860
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2772
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:6056
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:2368
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  PID:5104

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:6064

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3880

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3032

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RdrCEF.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Size 9.9MB
SHA256 0e9c2fdd718ee2b5d25e35cb6670e599c3303d9d529b00ee872a7104c55c62df
MD5 50ce1e809249f25cc9db222310062dc2
SHA1 db67d2e4c6d8ebdcfd578a85cabab5bdc2cc9886
SHA512 b68cffdea451598506bf9e0043ac398b81cf63290f00400522a85c9a00138af2f1b2b62d591acad24fbf9230bcf697b6057ba2fc868519a823ee8e7aa196431e
SSDEEP 98304:MrbT54hEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTyfb9s:eonfW/JLGMcblLheTA9
TLSH
T108A6AF1D7BE21036CD732176AF4FA104E739D007A215C6977ADC83981FB1AA152B6FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 3.0MB
SHA256 d9ed1fb3aa96fd599862045e5e053bfcec9e6bc2c24214b325e2df2edbf0abd8
MD5 df19ff1a3775fe3a78aecb153d2a8a6b
SHA1 ab74fa733c238e284900f0b428580664388c1da2
SHA512 af146c8d7a96590328f12438173c6d59836c439b9c4113fd9f1a8a927bc3ea86a6d8166c456a356fcc3d6626d53c1509b3ad109e9a0f3ccd84aa42b63822730b
SSDEEP 49152:UTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJgA9n/TDbXNKd:UTfiG/nzU905fb9s
TLSH
T19AE5E526A2C8C0EBD5642170CC69BBF900546D78DBA2CDD7BD447E16BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
Size 1.5MB
SHA256 fd242aaae6a1a0fd0a0ad585be577ff982e1bc9e67701860604bfdd644a13e66
MD5 3da33baa87e1e5d2272483d5a04be7ff
SHA1 6aec46e76ee17aa170ec25987acfecc15d7c2343
SHA512 04e6db537f91f13c791bce1f2297e515bbebbbb197b69b2c71f9fbaf64f2faefefac042764cfbcc151a14074afb099a87326aaf48319cd504c1aac22ebd6ee7b
SSDEEP 12288:DFyABqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dih:5yAUeA9n/TM4NZYeNm+9MhUwdw
TLSH
T1FF6522432FA98FB2CA4506B504A96B2CD9BAFD28EF4557E74705362B4E3C1C28D3215F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
Size 1.5MB
SHA256 6a7b555eeac17f84f179d98e0d2737f7e1740d6a87ab4808acbf329aab648f90
MD5 54f8b078325d9161ae238d15a6f1afcf
SHA1 f9e142030518830f5e6b33fae19bd3a3701b035d
SHA512 8cdcefc953575d22582b187d22f4cc017b2b85bfadc93ab20890e05ae06ecab41561cc4a20954e29cee4c16282c70afc3085db950486767c518b78892dc29780
SSDEEP 12288:G5YQBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dnd:GRUeA9n/TM4NZYeNm+9MhUwdd
TLSH
T11C751211B6C548F2C7660272496ABB4E9418FD3C4B2185D7A3985B3E9E340C3CFB399B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.8MB
SHA256 1b209ba4393f5757c8b2c97a37e0fc9e6953cb5429824ca5c062960fec14a1bf
MD5 915936fbd13f2d1bc534bc6a2e80c569
SHA1 9dcec591230d09ffa48d19f801100e2aa2c54a4d
SHA512 751fe75744e12487d55b7d73d113fb1bd67a7a495d1ea398da5e40a7c5455e9c56298adf13495fe44f901baa957df9c8077ae8642bba8507498006c05984253e
SSDEEP 24576:Y2TAbD+Ome0UeA9n/TM4NZYeNm+9MhUwdV:pTAGOmeWA9n/TDbXNKd
TLSH
T1CD95E01037D0C035F1B329768ABFE728556DBD715F6882CFA388162E5E706E1AA3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 66f3e9adba4d41e184a5f7976778382b8ed77177b290f1b76d1fc32789bc2761
MD5 3a9c21086497e888459a1e79f887c951
SHA1 887de06d9e6d8821390cd965b93f50575b4165ca
SHA512 effdecb2cb6e99753ec5594045c94f9d71bfcd39c3ddc58744459688f79dbbdf496bc476d69adacf73d98566e2b81c3ac89bdbc46581084ac50b8bc2f25ad65c
SSDEEP 49152:nb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnVA9n/TDbXNKd:V3q6HjB7fb9s
TLSH
T153D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 7eb52e497603b8c7c91eb400f11488c25a5d1232522bc02844e5b283714009bf
MD5 b50a8d85b7dc9d69af36d988f7187328
SHA1 b4171c2bd5ee32d24505bf14d15935fa56a5a780
SHA512 cde27851a22bc480d0388b5e53ee6bfe88a2b0833a184388d0828a5cc7486e6de005924d0cccd6db0dbfc6569e778e24a9e32bee946a61db4a0023fcc138c6fd
SSDEEP 24576:IXYfDtczAcUeA9n/TM4NZYeNm+9MhUwd:ftcLA9n/TDbXNKd
TLSH
T1EF85012867E408F9DD67827CC8A28505EA73BC454760E7DF03A4992A1F333D85E3EB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.4MB
SHA256 48e98f710dcf301a59296a5a3dc3d0a2768c8c29f4c11392e77fcd1d0c0e99f7
MD5 6d826262bf3fddd4efa627954aeea25a
SHA1 6273173b6326f44d685f54a71a9c8c25fc90ea4b
SHA512 208d08bfd5d3d1aac40c52daa6a55fb4faf76f705e7b25cad17985ff2aa60e9fdf837dc7700acc108df25beb4fcb61d47f83677e6c3407602ddbb1003f0f772e
SSDEEP 24576:QXYJDwczAcUeA9n/TM4NZYeNm+9MhUwdOP9yXc8v2SUTD6Z0Y8ozJGoDq:5wcLA9n/TDbXNKd0OUTuZ0Y8ozJJq
TLSH
T16BC5122873E809F9DD5B813DCCA2C505DA73B85A4764E79F03A895251F233D84E3EB86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 58c2b797ef3dfbc13b0a5b15ccf4f3111d64538f2b1bd2f179754e78dfe4ccc5
MD5 8379e6a214c1d2fe3f58ed72a4062c15
SHA1 bd24af3d403a63d00ff0fbfe127af40fc4df527b
SHA512 785931eea0ff3af37ab51e0459097a1a71ed261ccfdf096e7a5b67927b70ec9bca0160c9e6d9f8a0810ba16aa6beb380abd28727295bf32a1e7da3fbb432a9a0
SSDEEP 24576:q0Le5ji0hmxYrMhUeA9n/TM4NZYeNm+9MhUwd:qPji0A24A9n/TDbXNKd
TLSH
T19D959E16F6748731D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2252ee0b9aba1bafc778f62f0c5aae1d01fa1423a8d9b6645d7418bb46638843
MD5 211fec7c5d315c1befd7fdefef44d1b2
SHA1 3edab86ba3ceefaa3be8f09f066acf46153e474a
SHA512 4e911e12d9ee1099e9cccca9830190a68a00702f4bb36adb8e7e213086c189b6540fb757b347b4b272446cb1f27433aa0ab78e4c614c9c4f427053a413f65038
SSDEEP 24576:na7/ezSC6vUyD/aqgrvWE6q8wyu/UeA9n/TM4NZYeNm+9MhUwd:q/ezSC6vUzPvxHjykA9n/TDbXNKd
TLSH
T198755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 072603a0e695d9bb387497a026b4c873382044b7c22a57622bec8cee4c2b238f
MD5 a85f56a0a41dfc595dc3c53103474191
SHA1 dafd43e86e668f86ecf8cf64ec269c6237e09f43
SHA512 a8d46baf48ffc68ed553945b5257cd0ac52c524fece78e6065967ee59361101fa0bc899a1e504ed6533c5725fe8f74df61deebf427cc68de842ef3a4c5948a75
SSDEEP 24576:rVbqPb88hv/l+64UeA9n/TM4NZYeNm+9MhUwd:rVO88hXl+JA9n/TDbXNKd
TLSH
T1F4559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 9a3163afb9a063a872782701f3ba1a7c8fabe2c541ba0231b4bbfba5ec02020a
MD5 04eb1900dcdd685b941843c4cb3b4642
SHA1 f0c9eb5d3a1b481ecb9cbb96897839eb3f734b4b
SHA512 bbbdcab456f27bbcc8b94de2fe6ec6551fe7f355e1b6bc71639a805fae89f5cc35e41467472b302c0ba758e6b818bdda574afa4e1fef11009ead2070d369f4d6
SSDEEP 12288:gHlBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2deZ:gHlUeA9n/TM4NZYeNm+9MhUwdk
TLSH
T18D6523824BFC08F1C78E0A7544A9BF0C8EA2FD4DE585879D4319762E5E385C6C96748F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 5e02ab0d2dac115353a555417a21574fca4abd8d8c8dbbdea216f65a546aa39b
MD5 d3af61e91a78b9edd4d0620aab6412a2
SHA1 afc0d1c77d5b90afeda44cc5e419dcdbd5ced01e
SHA512 a3514c14df2286e9afa67eb1942888aeb194a58e49256dbde1c341da9dc20a66a66c760122f7beacc3eac3570bfc095e9d6a5ae2602147cd9c6398974052871f
SSDEEP 12288:/eBNUbTVO86UABqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d+:/JIUAUeA9n/TM4NZYeNm+9MhUwd
TLSH
T10485CF7BAE38ECE2C27E4DB956918700D77278304B6293CBD165830EDE235E15E7AC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7b8c9af820a03f248ce5229a5a98275123fb48884a1cbb28d4acf66cfa793403
MD5 dd669c513b554521ffc0127f129f28d6
SHA1 e88ab2df853f4ef570117d5972eb758f3aced851
SHA512 a4a10af2fe3c923696783e6a9942d49b08bcc3808e4b3a000eeba26b4a9f0b0f84b722eb7af3a5f2f5446a1128cd7023ee2f5db4f107117673c816846cadd175
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THK:2QvGAdlCEL8c/yRNw5CIfb9s
TLSH
T18E267D656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 eb9c6bac6ec4e3d650952fde21edad54beb3243785112bb407d659db3e6edd75
MD5 4ab095925b4c1cb55b181e1de10d7012
SHA1 75fa1fd007faad58ed58e2f37adcb4fb1931d819
SHA512 c5b15634d41928c359c46552d9b7d0ff625d41062eef09369408a367b7b1f5dd7a18c8b892efc2b1e22cdf2c1f3cdcbbe5a92514af6f958f2b0c39f0481f0e10
SSDEEP 12288:XAwSfxL/2Dc3SDLLmt0LDQewsAjeBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9M:w7ewsAjeUeA9n/TM4NZYeNm+9MhUwdY
TLSH
T1E185E031FE74D432C3BF0DB21B36D706586DB9204B511AC3E3A89E9E59302D26776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6bad823074ba9358c6558a1b67484cb16b40c1793c6ddfa8a185431f6498e8bf
MD5 b603488d48d4a9a2ea2dbec81d48ef01
SHA1 f9d8d9ce96aa78e29051f8ffd54823077e7b1938
SHA512 b57397478ffb2372f6e203fe1b9f1b3ca9035ccd7ece066ff292664dd223913de7cc53957ec8a85dc2395a94e8a36845c95dd1bab04a719ac8329f244da62f4d
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH99:WUEtQevvqc2W1cpV2EI32
TLSH
T15E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1ecd3eac08451eb44cfa774dbfaab22126d1f7b7bc6aa180f04b856e58d9f7b5
MD5 7a3de7d912b6c066cf630dfb321ab22d
SHA1 6ff004beab5549b49eea6c9bc04e9ff64c177f87
SHA512 6eb250bf9962b44276c5a739e8aa4af2d6628754ddc834753e74aa0ca56dbaa9ed5d9288831ec3cf0167e87cb7e9d38101fabbbb6905da0bb44dc68a5ea72632
SSDEEP 49152:OCbRquA/m2yL5zTfFiV+XenmE3/zoA9n/TDbXNKd:joquVjnmMfb9s
TLSH
T11ED58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 586931da54f12c3abaf8dd4863d8d4edcf554a4c8161c06b6876fe027d16abf8
MD5 7059c51f53389cc0e962e0cccce7fa1a
SHA1 e7a5753e83ca741d6c9a750ceb4599cda5097ff6
SHA512 3a3d774dac96fc4bcf389bbe032dbb62ffda7af20d7c96063213db3d6955a3c422071e63dbb935dc92967689fe767cf6e2ea33ed18a0a73a124ffbc1bde652db
SSDEEP 24576:sAhGLJIFoiwtA5l7S53rUeA9n/TM4NZYeNm+9MhUwd:sAMyFoiq5fA9n/TDbXNKd
TLSH
T191359D81EBF945D4F5B3AAB899B69570EA76BCAA5E31C20F1150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 726a2aa94ab4ab0c68afd54335c3b1985c847c622dd141cd95827b9ee0d6122a
MD5 9bc2c882aa39d0852d058d18d8cdac13
SHA1 815b6231a61cbcc7422be84eb6a09dbd8080dbaa
SHA512 7e5e00cfce755c9b5f6e35ad4f0d382fa81543f678c4b17c741c7d0bc8bb1482a1ab96dafc8bf00f08c59e7f8b2ad4ebe090a9e997e1699a07fb055908e48d2a
SSDEEP 12288:Mmw5HEjsChNzBFgl0WDm+CnBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dv:pwuSOWaUeA9n/TM4NZYeNm+9MhUwd
TLSH
T16285F14637E80CF9DA6742398597D635EBF2BC062A21C71F0760C65B5F37261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 d7832efb4e763152bcc3682588b5081b6bb833dd7c2c59e275b2533a82435723
MD5 73be57248b43a269f47ca731adf3744f
SHA1 036dd158038f14cbf243b914c864c84b90fb6dcf
SHA512 1e08721568bbd5fa257a44cecf9b33c0057933d62e8bc0cd6efce63170f6ba3b69b88d26e6fedbb24999489d4241277cf8413280111a9c3e353547518c1054a7
SSDEEP 12288:1jZ1IyuBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dy:BZuJUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1B275128627F814F5C397527DC8E56B08DBB27C5A637543CF0225526A1F32AC28E3A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 45c524852b0ccc2e7c893b3604a92ceb522e69945f12dbde6d2c831dbf4dc300
MD5 80e3b364a2df21c9424392a1b811c0f0
SHA1 5160d2ebe67014b1a81c416e583097cca9da3948
SHA512 80585d80a2936cfdb3e7991e0959f42837afd4111896251c8b5c942c5af742a7d01094e39a2629c23f3714dd469a17bbab15986940f0ecb593e4bd65d7b64b26
SSDEEP 49152:uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UG:dQRQyi36YOcPQLvw2gAf+PN3Hfb9s
TLSH
T105666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a096006456994f8a76e9b008fdce12078208287f4713997376889037458f2bb4
MD5 0162e0a0130089a49b631c3556d8b8c8
SHA1 2ac4dc02d09abb365772b47e46428d048f1ca3c1
SHA512 1350de253d679125d27e058932104ec6237bb4923fe865bfb14d44b5d5bc2f8ebb87d36a3d3312189545afa81617ad94a860eedadcb617e81646cefc9e017653
SSDEEP 49152:cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UG:zQRQyi36YOcPQLvw2gAf+PN3Hfb9s
TLSH
T106666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4d421f69cb6ad8e9809543135c89b04f8710637cfc381de0a95e28569cb1e7ff
MD5 3d0dfe35ba88bc46f26859a6ef757f3f
SHA1 d9c9e0bb603212897498bdf8ef63a3f6a3e35f09
SHA512 c8a1126d5abe86219b28d3fbd99f262e09034681bc4515f3e26bf05f7e8cf266fa5a4656880e9eba1dbb830f5d64043d5867434601005fca982f8aa31d32b8b9
SSDEEP 24576:mwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL05UeA9n/TM4NZYeq:w68Qg55nhheWu7PNU3/4A9n/TDbXNKd
TLSH
T128B55A33B2F600A9C44DE1769F4A972196D27C758FE0E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 586e2ac291137b068c50c9b92dcebde6d3bba329eb1160f7aa3257f803409797
MD5 db5097aa679555fdd7083a09bbc46c1f
SHA1 40589404985756dfebab0b5df8f6ed0a0f27ef6b
SHA512 cbaf82d514fd3ebda9c6b8b598223fb4d264eee073dd83910b5b86deb56e4d878fb6788af798383a51cf848c7140430d7eb32cda31855adabda335110b750cf4
SSDEEP 49152:p3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk998:4y5112gYy5azzVvL69nLKnhZKfb9s
TLSH
T191167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cbc527d6d22d80db9f393333e1cc768c8989da25b534449160f416fa589d41f7
MD5 bbe832bf6e5c9d36dc677e9f21eeab03
SHA1 f1ee62cd482b24695dbfb14498cc784455266bef
SHA512 ccee2c1642074c791dd3e97e8472cb64dc67c7343f45d7c4ff89693db8ae4254bfbe51c18022a82e9170931b3f68f75052d0100a789ec24f4e6bcd614f394457
SSDEEP 49152:cB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gluA9n/TDbXNKd:2u6JmVxd2dXfb9s
TLSH
T1F1D59D13F1D901E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 eebb08bf2b47bf0413d191baef26154555e787b712f8fe1f946f1e6d0db9e570
MD5 961ae4024676a22f5db5479626d76efe
SHA1 8e0e99650ccd01abaf97225c7c55e5bdea13fa8c
SHA512 5d9d36f1bedec39f95b252450666f4cdc980cd93ad785ded627d65cefa81d7c0ab1bc9a4dd76c15471f1ce18fc94eaf8669144544100a5cfc226a090cd7e2959
SSDEEP 49152:61hpsNoJpF1A6UU44CwH7R4xiA9n/TDbXNKd:6mifPbRMfb9s
TLSH
T177B5BE13F2D800E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 c923613db2656c8b88a1b409538c5543a0ba0e0c6f3f64b7479a7fda3bbdefe3
MD5 a8410e8496ffeda1caea1fffa070464a
SHA1 fe796bc2b384c03e0f853c6bbc0d4b8a5ddeb75a
SHA512 3ac28f0d2db706a51d21930036896c98ab03fa91d06c555ab0452edd97f1fac0961d3edec47702e32e9b0b69de32ff8186b57f534bcacd8401d9bc3c7347fb0e
SSDEEP 24576:QcP4mcvIjkGOxhKP2l71SNKbrh/8KBRUeA9n/TM4NZYeNm+9MhUwd:7P4m4IpOO67N8KDA9n/TDbXNKd
TLSH
T15365AE2DABDC0096D0BA917885658A09FAB1742E2F3286CB1160933D3F77EE54F35F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 0863a280771fb93d60ff7eeadbaa2c38ddd4f19b3f632b1f233041008fd3130b
MD5 3e26abb8cac2433ba22c7071f4799b3b
SHA1 ceec0a3343f024592463ed6279efa73e552914e4
SHA512 38f1037386c7aba6cb27a586399b6f2ed8b54a5bf09ba748e6940b568ac2c7794c16fd3e44156dbfaad4cab541b36b247465604de4e704b389c30d251faf7599
SSDEEP 12288:ozsfJBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dB:nJUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1FE75F04AD2A802E8C15E6279C7965A04F7637C2993E1D3CB43C0F53E1F356D09EEAA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 634B
SHA256 4f9b2f699943dc7a42321fde879d884202e9b3bd8391519cc69bd83d8d485aae
MD5 4600ea83e72c40d5b6d25248895c4d66
SHA1 666d119fa0398adce7093f434fc15437ca6913c5
SHA512 08c1e1315bd3be50f47cce09a7b9c36aa38572495cdcbaa1053f6cc14af921437f3972c25d2d5c8df70a5b2e239a62d4cec6b3039de5b99e43b173eab4cb0bc9
TLSH
T108F0F41726E40254F1B72F22EBF990B357377C96AD2994BCA0D8031E48E1A45D5B27B3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 802B
SHA256 6148b64887544ac318518e52b5113d8ef3a730eb0cb63972a66569225cf6a8f4
MD5 d7e314e80c22a55cca269fee3af0d3e6
SHA1 22415449093027fb1169e48a49d3b54bb6e1b7fd
SHA512 5b6ebc13ed8b9ce5ac2756450a56617677864c17490b957fa88b5d29bcfb8debd13e66afe85883c0750416939c110a2548aba3d868b231460b2af961c567b4b0
TLSH
T10201400336E40198B4B72F22EBF884B383273CE66D2AC47D90D8034E48E1A41D6727B3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
MD5 29f1b2d1b6f9290138596cf180847e53
SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
TLSH
T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 168B
SHA256 16954c35522e5383f9697753d67ea76bdbf8381c185eb890030f02da00d651b4
MD5 115a79686f7d4922ec36b6adce7d93fa
SHA1 fb961e1afb57b31c3303048b77cfee9ebfb3826c
SHA512 b7f157ff81aaafcf6ff6bd35b30aeed28aa2069b1723f690244f03166a28e5095482b36d134db93bf80e1317fe74f9c93ab8487be50919a656f5b49f6739c30f
TLSH
T130C080C9091FD02F07E503C0150A5F5010611173C35945F5B2547707707C9110B57C58
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp5114.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp5114.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp6980.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp6980.tmp
Size 3KB
SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
MD5 ec946860cff4f4a6d325a8de7d6254d2
SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
TLSH
T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWow64\perfhost.exe
Size 1.1MB
SHA256 59d6d1eac23cb19248019f0589913d767eeb444267e1a4ba4f91bfd9d1bdb056
MD5 2f00bd75ab45d463a125ce2b5cce4d64
SHA1 87bbe05146a15d51a3ccac47e3299d98658d3a07
SHA512 edcdce7ad581239f56dc4dff274d85c87a6c616f9fe58a1c96c6fbc24ccce4ac2d768b59b596390d7393043fe836bc4b75673d901e098d6f2fccde1ec7a3b55a
SSDEEP 24576:eZUeA9n/TM4NZYeNm+9MhUwdsUeA9n/TM4NZYeNm+9MhUwdx:elA9n/TDbXNKduA9n/TDbXNKd
TLSH
T1FC4523824BFC0DF5C78E1B7540A9BB0C9D52BE4EFB4583DE8609722A5A385C6CD2644F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 8de3452cbe9c972fb0989a823e9a652bd7e72dedb4937e4796b5436fd116750a
MD5 1f09fbc7e652f4c403504ed7a3115243
SHA1 196321dee0bc2e5c5ae62dc4e6961e9fcae61332
SHA512 faa5ada674339ff0fb40246a15375ed04918f4e755f0f44a55eda0f97aecb63720b9da9f333293efae5590b8bfba9022366db5c9b12b479010e7622fa0777226
SSDEEP 49152:Ja0h2GEkuAe73q3pp46zwwQHA9n/TDbXNKd:Ja0hNYG4JwFfb9s
TLSH
T1A485AE1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 63b369ac6d496d27d58234f8bf083fc99c59cbb45eb54618740c7752678a73fb
MD5 271b0145a52c127751e7354bddd5774e
SHA1 335e9c32c5006f1981da80613559dcef2107d484
SHA512 d63a396ebdb45496126a1456c262f632865244ccf5b00b4536b844bed43b4e96e41a94fe21c42c93c927d1487a8ed2833927f0275b992188844aeda77fa59a70
SSDEEP 24576:WhbHjP5P9yXc8v2SUTD6Z0Y8ozJGoDtUeA9n/TM4NZYeNm+9MhUwd:WhbHjfOUTuZ0Y8ozJJpA9n/TDbXNKd
TLSH
T1F565236E27FC01F9E265913D99818249C772BC2A273283EF43D5823D5F36AE44D35E86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 f6420e3da1983dffe737c9864f4d95fa1f8117ad1f99e99d3b13b15f0db1308d
MD5 2143dffafd016b347ac86062d61fc9b1
SHA1 41fc5f100213267ac87b932b45d5e1671ba232a2
SHA512 9d1f344d4fc9b6e7472b1eab8eaa2692f645a667c976db166984849a4362e75f33e7bbec23400dfc820d7d93fe05c4b67c339a1b1727725696a3bbfdf1bc42e5
SSDEEP 24576:t3YgnJcRTk4yti+R5dpR/pUeA9n/TM4NZYeNm+9MhUwd:tIgnaTk46ppR/1A9n/TDbXNKd
TLSH
T1BD45AF2DF2B910B9C8AAD136450147B5FB71782D1F209ACB0174C538AF1AEE89E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 c7eef167049e16c6e4179f7da9a8951393557fa95e1089d6197671685e818484
MD5 071c75d92f39a20754e4f6d508cabd48
SHA1 083000296a1bd0a8b0871ac808bc820f9b5049d9
SHA512 3832949a7208c3128469e5adff8c471101fbf46c218706b3970bab7e99c44294fcc0566296cb60fd9837ce07bdb8051e7175a5156289eaa029f01b9ebe9bd63d
SSDEEP 12288:nFBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2da:nFUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1506523820BFC0CF5C74A1BB940A6BB0C9D51BE4EB75643DB4219722A5B385D7CE3648E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 4d3b908492a1df221a00701393e66e486c7fa26dc8175b6129d3d4c6d5412588
MD5 aa1db151d28b80efd37176bf8ef1b96f
SHA1 9e42d2603df11968c986b185f0e0942f535ca151
SHA512 29677e3c380e9af0b113f2c62592dba4f2d09c431ed9b465a2c529c306e7946e6596d5d8c9dfabfaa29548845fddfc14429df504dff40e41dbf4d0fa9ae39937
SSDEEP 12288:MObrA4LWOsvAYFT0BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d8:xfL3UT0UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1E0950245E7E400F9D96B813CC8B29A16D672B85D1364E7DF03A84B651F237E28E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 d9ba6b708e0dd4163a76b598050d238c36144922d577fe3d7d176c2e30aa0569
MD5 0e4785fdc5a9b9892f1a9ceb5cf86ec5
SHA1 28c07818874a54805c9b7bc6a9794e8a8d401dd5
SHA512 ab50a9e57258ee474e0779223384c9c6cc850b17de3b96214a6fa17d402f6843daf8b55201754dbba9cc3f8d16b50326dce52272942b82888916b95a602e331a
SSDEEP 12288:apFtfOQBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dY:qOQUeA9n/TM4NZYeNm+9MhUwd
TLSH
T16375121A37EC00F5C26A623D8592930CD772BC6A571253EF0290917E5F37FE89C3AA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 746406c4c552e5267ad381530f845dba1b642fbea2f0ff673f4ed2fb77ddb6e6
MD5 8cf70e7b8fbe4946b18ac2d00e347dff
SHA1 8a90a33de70e45d2f16290f5530a318800607ed8
SHA512 3b9eb1590fb08fdbec6f7ad38ae9c4bcaf77db92c7e4fa4a22be720513d377378c49379dc72464d41b4ea790a17c63d9dd5641941d67924950fafc59690105fd
SSDEEP 24576:e7NM9YmZqmWMUkPjZM48Mv6bEhsZUeA9n/TM4NZYeNm+9MhUwd:e7cBWMpPjN8DbEhMA9n/TDbXNKd
TLSH
T136659E2E6BEC81E5C577D13DC9A28205F6B2B8651B318ACF1152833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 649599fcef35a2f139ced990f1f991d54f0b975da4d83789f6230fbd15ef6114
MD5 6edf221d461981196a223df2069f369e
SHA1 9522d0819cbaf31df3d3b3a25e2baf535a7d1f79
SHA512 d5a55b95f060af7e2f6afffbf167ee292ae1dc02610059bc111c698a94325b05a97c86da83de3fdcff7badba298ec5eb8e423986d04cdebc60a24bfddaf8e3dd
SSDEEP 24576:pW6BApg2YuyuNDYTabvcRvNYf8km1XUeA9n/TM4NZYeNm+9MhUwd:pF2YuHNETovcvNYf8kmFA9n/TDbXNKd
TLSH
T152858E2927ED80A4E0BBD27D45B7D246FAB2B8551B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 2.5MB
SHA256 2ff2d8ddc2243c9ea20418bb7598fb3b92f8a60aee016b56a0551480682a5c3a
MD5 d6d4c7667f455f3b59050c12a4acf473
SHA1 f056c6f4dde28f8e86611040c75f32f77571b7dc
SHA512 d5986ef358aeba636c5a7d40df826ef9e70a5d37e61f647dc5e66ef601649769d3f795795ac4abe4731a8729edc33c4820cc7da70ed16fff13f1c781f20af93f
SSDEEP 49152:pF2YuHNETovyvNYf8kmFA9n/TDbXNKd5OUTuZ0Y8ozJJq:c63Cf8kjfb9skUaZ0Yfrq
TLSH
T107C5BF2927EC80A4E0BBD27D45F6D246FAB2B8551B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 a47bdd7c36e63765d90cab5709c14dbff835b8648ad76f0891212dd940905b17
MD5 c7356344521e558049aed0f29473ecde
SHA1 e64b5e9327341c807e24adffd7d46c72c87b2573
SHA512 77efa76eef94d61183dd709486055bc8368e9531793c6e92ed095e9c9e4343129a808646749b5039f3003cbfaeb40ec0fac533065129d316365eaca73bdb8a7e
SSDEEP 24576:JAFs06+Omlf3NXEbTo8UeA9n/TM4NZYeNm+9MhUwd:OFs060lVXunA9n/TDbXNKd
TLSH
T1BC65BF2F62EC00D5D07ED17D8997C91AF6B1786707215ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 960890459dc3ddf3e5a4f633f214875dd6cf63890666f0022da5bee624741129
MD5 c7119db62e3e4aafc6c33a0615ab11a2
SHA1 0f4ff51f38ae178d763b3000bf3ad8c0d8e37584
SHA512 25f1d09669be05cb8024763766a5519bbf3cdd9e5b478e857a3b9374f5e4f963b2da8812b08090b58ed0515f4a781517a69d7016300c8483379ce58f4c689b07
SSDEEP 24576:xJnJ5D3WLjUeA9n/TM4NZYeNm+9MhUwd:xJnJ5DGLnA9n/TDbXNKd
TLSH
T10785D02DD2A810F8D4B7C274819A2B45FF72386D2F226ACB1474D5353F22EE09979F49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 5236652fbce524da9fde19171d4c5608428ffe75cba210fd48739fc32669d341
MD5 0bcd526afdecc5f0815a52b713ac3b0c
SHA1 9e30288c952905c6ce2fe38575f82417ca2b319e
SHA512 e85cb947059027c178981c67b71eb47181eebca3ed02b0c1ce5ea6bc50a9831047699754b94f00bc4ca82d8fba61367ceb0f7c5dac4f5b0b0799243fbb161e8c
SSDEEP 49152:Yo06DIKdwc+eQnSt65aVJA9n/TDbXNKd:FAfb9s
TLSH
T149956C06B7EA5294E9B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 850KB
SHA256 d15ca807a9468b5bd31690812d23f2cdc8c6a587b346354f11a7bf4a33d00226
MD5 f6435499e47c5d035d7e70caccce7a2e
SHA1 eb01dfdd53f6955708bd5d46e392933a52d1dfa0
SHA512 f28c551577bf702b3b775b30d5bca33d96655693142eefbfb42f4bb2fa2aac264c63d40059d61ad66abfa832c61c38fbe92008e2a8c6efdb56d68a7bd8f2f7f7
SSDEEP 12288:KEP3RikuPqc5XxSdXctZ5Z09hD+60po+nTC2/lfguoZ0ID98bUzWmRrSskHo1Fq:piFP9yXc8v2SUTD6Z0Y8ozJGoDq
TLSH
T18005126D77AC60F9E129903D99818285C3B2F0752B326BEF53E5C23D4F236E91D39A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 b9a84120134a01aa066df85a981b87e736723454bc75df49657621c6925cc6c9
MD5 640f3ad964a57a446b7e87f4c3c23159
SHA1 986a090cc9f52539cc3a668f2dcff3ae792f2742
SHA512 bea24a009826f38459250912ff27a2a265fcc25da90f71125f9fa4960c2c438b0972df00f1552cd3ae5ac0552679f06087ca50d4fcab3bd34ad480045e2b2316
SSDEEP 24576:dtFP9yXc8v2SUTD6Z0Y8ozJGoDtUeA9n/TM4NZYeNm+9MhUwd:dtrOUTuZ0Y8ozJJpA9n/TDbXNKd
TLSH
T12C65239D37EC00F9C21A503D99D1C248C3A2F46A6B2257EF43E5D23E4F326E95D39986
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 675f1d1e352a7fe8999615b63b84a0448325e0daf4700a7da43e14991fe129cb
MD5 14831006c206095b7dcc38118e879dfe
SHA1 522e728bb6cc91cba9b6e21c9e86a75de74680cf
SHA512 5d602e0a96e6828cda8c39cf48e0e1835569147b79461aa48162a83398addcea95639adf7b0c5f99a0b082931215fadd672a912f5dfa0a971e3d3bce9c2d0bbc
SSDEEP 12288:JjkyCBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dn:JIyCUeA9n/TM4NZYeNm+9MhUwd
TLSH
T18C75124553EC44E4C7AA067889B393488E71FC25AB2183EF4180F63E6F36BD59D35B4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 6a621573bbf8ad478685f9d0a633655b32bc68610f4f6be9bf91181e524c06d2
MD5 3c8e678bb1dff8f4a762821f4ce83dbf
SHA1 b30425c36933f1c3b5ec67f989e4ff98afe23fbf
SHA512 d8034dcae90de0801766c0bc902ac6664501180e4accebd4e7ec1ea4333576153396478ff7acabcb34ad40adaa6893d2be2b673ec16bd185812c80ceb29e2dd5
SSDEEP 12288:CrwBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dh:ewUeA9n/TM4NZYeNm+9MhUwd
TLSH
T17D6523850BFC08F5CB4A06B941657B08C961BD2EB75553FF0299B23A9F345C6C936C8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 9993dafe6af6652f040d2ba7ce260cb5c50b54415181650cba873e5b0244b4f7
MD5 00f3ceed938f5a764e85bdeb4ca176e7
SHA1 522ccbb26fee1858fd24b00067905d76f6694d81
SHA512 265b32bc9db7d3319656c02d4511b75fd5b0f3c497b013353b52211e4e7f4b0b7118cbbdfdcf4b622fd90aadfcaac3d0ec71f817906aed0ebfea4cc6676170f5
SSDEEP 24576:mQ9MxZKdcz97w3BUeA9n/TM4NZYeNm+9MhUwd:mVKXNA9n/TDbXNKd
TLSH
T1DB558C2DABF9099AE177D27594A250C3A673B4311B31C6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 10c0cb018d048a1508b079f0a8cb43185ebaa6f38ebf152c9ccdf93fd7263f68
MD5 732e99fdbe3cbf3e4fee7b046a77869c
SHA1 51a805aaea338ff60188aefe96f5a01cdc9c6400
SHA512 6a11078ab6f027b848cc20c444b33b78ae9e9ba321744ceb05f89fbf6abda6f21f1f28dad7c33a717f75324a251e75b9eecf5f73f941284be26c918e22a3ce89
SSDEEP 12288:NyoKo2hRple9peBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d1:NyocbApeUeA9n/TM4NZYeNm+9MhUwd
TLSH
T13385E00FBBAD40E2D166813C89858704EBB3B4346B6253DB5691C33D4F27AE9BD34B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 bd8bd1292c7d505c898c4d3b648788dba470e0ab32e106d7cecb475e9b8936cc
MD5 302eecbb4d7a915b299b9db4702f969f
SHA1 f416bded834d93ca2890ca48906cfb1d08495bb7
SHA512 97549d5e040416bf81d91795877c031bf7fe6285c2cabdad75361ed2fb0f563767acd93752f412c398bd23a5a7fc1b21e46f7745f961c082561c15ada7d44ad8
SSDEEP 49152:dWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKIA9n/TDbXNKd:90zuNIxfb9s
TLSH
T1E3A57B3DA2BC00A8D9AAC375C5451366EA71742E3F2055DB01B0C57CBF2AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 ce5b69c148e01264a56bd44c61b52ff71fd2a531ae7402ae07e1a83d54fdae87
MD5 56d52f98e4f657c9ca8e4d9d4a812dd5
SHA1 25fa14cca7cdbe49073c16556a2079e57fde1908
SHA512 8282c69fb3ac5188f2237765b2fefe95a15e4ee9c42de16ad4f860ab3f6d9f8acf6cbb11c59f205ece7b4d70127039da9719cb80d3ae817d0e9f43185836dba9
SSDEEP 24576:61QT7EcpfxR+N5AWAz3ooiYhjMqbKP9yXc8v2SUTD6Z0Y8ozJGoDq:HTDxR+N5YzTTjMZOUTuZ0Y8ozJJq
TLSH
T13475B02EA7F805E9E1BE85799A23C512FA727421033193CF42A0C17E1F679D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 157633d7118e824be17b53233429f10f5f849c83a5843053eba754813b762ec7
MD5 6c4bfd72356aeb91ae073f3e928a02fa
SHA1 86ae0cc41e56b2262fb47f92b8c02603aa664457
SHA512 990387764de8905b928e6cde05398bf26366e96e8e13ff0d651d27405aa96aa6cf661a0929ce802e318fc94fdb0dc14813126aba055e8e2e9e402a3420d7afb6
SSDEEP 49152:+TDxR+N5YzTpjMZOUTuZ0Y8ozJJpA9n/TDbXNKd:Gu5EUaZ0YfrCfb9s
TLSH
T1B2A5E12EA7F805E9D1BE85799A23C506EA727821133193CF43A0C17E1F279D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 848KB
SHA256 22f53d02b25f3f2de428085bed0a00ab900faef6f139a0508e61683ad5f9f4fa
MD5 af9dbb912e3c467fdbec9cbffd9fa3ff
SHA1 909a26f0f5940ce455a24d3518fde1fd73662053
SHA512 b58192615b82749aeeb9c31ad3cfb4e617a6f56fdd260249417fe3ca03ef923ac9b51eee4c3c643906ae3fb1c61d7f644985b14d2de165da44d3fcdeb9d61ef2
SSDEEP 12288:ghbHjfXwuPqc5XxSdXctZ5Z09hD+60po+nTC2/lfguoZ0ID98bUzWmRrSskHo1Fq:ghbHjP5P9yXc8v2SUTD6Z0Y8ozJGoDq
TLSH
T15B05127E22EC11E9F175903D99828186C372B426173297EF63D5C2795F23BE84D35E82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 f8a01128abe08df2189a5bc1178d0382f9486b88b63dd4f594ce1b8ab82b135b
MD5 50a1d9d7149ec66be4d8e9488d5f0393
SHA1 d537be21ac0b2cb3c16216613cd4225458e878ee
SHA512 3205269acef78f0bb9b21f223af1068632d66abebfe03ff566fb000d26adc83c04884852123992ff30f243fedd14f8b56a965aa6fb720704c0fb3bc09bc0b4c9
SSDEEP 24576:fTMdOz0FFS+kmSLLUeA9n/TM4NZYeNm+9MhUwd:90K+kmSLPA9n/TDbXNKd
TLSH
T1F385F17E63AD04F5E57BC27CD6438A06EA723866032166DB0690C1793F6BFD4793AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84bffe81227ba850.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\84bffe81227ba850.bin
Size 12KB
SHA256 22fdeececc67c8f7d7ba0f0154784841a68a1c4939d4d29931af0afd310047f9
MD5 1e7ab445925ea81925b2a75c1b72ceb6
SHA1 d98d63e077a2675b3126747cb2671279efd43c6d
SHA512 80974a4718c81d71ff6e033676ec8bd772b2bd6c817b41320efd088870cd16127be410e85b27b94a89d64990bd3bed928e9cac615b8ad4549ba50c70aa6ff932
SSDEEP 384:J8XLjagrETIJJHZ+KPRw1TZc0iE+QcKrAiVfKXXip2:J8bjaYeIx+gw1TZc3E+QcKciVfeu2
TLSH
T14342B0EBF3D602D9708FC2C6B9E07448120873F89216A3AD7B34135691D5BD39B5055A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 c2800125a1970e89c2fd3fa8f4a47e673dcb280bccbb30ced7c13f1528bbba5c
MD5 cf3dfefb14002f181f51baf4f15150c8
SHA1 f04f2dcd4f093d70bf13aabb590a855068114b7d
SHA512 eb6aad4f796b5c10e8bebf099ea24541bad75c8af0824787d60d50332c19a7282c52cc760f8db502d372721561cd6ceeae697ac3da11dc2592836b6c7e562f6c
SSDEEP 12288:34pcBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dw:YcUeA9n/TM4NZYeNm+9MhUwd
TLSH
T18975220A17FC24E4D66652788A765308CA71FC2A232157FF12D4E63E4F36AC5C939B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 2.2MB
SHA256 7346e0a88f6f6acd267c89872004720a7156001ba7663bb162126bab4d8952c5
MD5 898183d55b5c7435703e5f28a0379ea2
SHA1 b1429faa7afe6c49cc6f88d9a84dad1b68a18797
SHA512 f79457bd9c16e1150431ffc301648362deb690186b255f9f4288dea1cb046316e2793365a4b75d2987ba858f3fc752e25f36dfcf0c1b9ae447629d49dc671c55
SSDEEP 24576:rcUeA9n/TM4NZYeNm+9MhUwdFP9yXc8v2SUTD6Z0Y8ozJGoDq:reA9n/TDbXNKdrOUTuZ0Y8ozJJq
TLSH
T14EB5234923FC00F9D255453D9EA2824885A1BC2A73364BFF13E8D53A5F327D9C935A8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/208-955-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/208-915-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/620-284-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/620-555-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/620-290-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/620-293-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/1348-243-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1348-247-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1348-559-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1348-367-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1348-237-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1348-557-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1392-233-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/1392-232-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/1392-354-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/1392-226-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/1972-343-0x0000000000400000-0x0000000000524000-memory.dmp

Download

memory/1972-223-0x0000000000400000-0x0000000000524000-memory.dmp

Download

memory/2240-269-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2240-527-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2240-267-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2472-104-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2472-102-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2472-304-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2472-96-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2980-90-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2980-292-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/2980-92-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/2980-84-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3016-281-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/3016-279-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3016-553-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/3016-273-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3484-222-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3484-51-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3484-42-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3484-50-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3880-908-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/4268-296-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4268-307-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4268-302-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4268-309-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4268-305-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4576-319-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/4576-110-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4576-118-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/4576-116-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4932-256-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4932-489-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4932-258-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4944-352-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4944-355-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/4944-567-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/4944-346-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/5032-7-0x0000000002410000-0x0000000002559000-memory.dmp

Download

memory/5032-65-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/5032-1-0x0000000002680000-0x0000000002705000-memory.dmp

Download

memory/5032-14-0x0000000003110000-0x0000000003177000-memory.dmp

Download

memory/5032-29-0x00000000037A0000-0x0000000003807000-memory.dmp

Download

memory/5032-28-0x0000000003110000-0x0000000003177000-memory.dmp

Download

memory/5032-21-0x00000000037A0000-0x0000000003807000-memory.dmp

Download

memory/5032-130-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/5032-0-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/5032-8-0x0000000002680000-0x0000000002705000-memory.dmp

Download

memory/5132-317-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5132-556-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5132-311-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5132-320-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5264-340-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5264-344-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5264-561-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5388-323-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5388-560-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5388-331-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5388-329-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5404-64-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5404-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5404-246-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5404-63-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5636-82-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5636-68-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/5636-76-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5636-80-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/5636-77-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/5860-565-0x000000000D5B0000-0x000000000D5B8000-memory.dmp

Download

memory/5860-494-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/5860-359-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5860-365-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5860-375-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/5860-391-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/5860-368-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5860-568-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5876-866-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/5876-815-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/5876-860-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/6056-578-0x00000209E4940000-0x00000209E4950000-memory.dmp

Download

memory/6056-571-0x00000209E4940000-0x00000209E4950000-memory.dmp

Download

memory/6056-591-0x00000209E4940000-0x00000209E4950000-memory.dmp

Download

memory/6056-588-0x00000209E4940000-0x00000209E4950000-memory.dmp

Download

memory/6056-590-0x00000209E4940000-0x00000209E4950000-memory.dmp

Download

memory/6056-589-0x00000209E4940000-0x00000209E4950000-memory.dmp

Download

memory/6056-587-0x00000209E4940000-0x00000209E4950000-memory.dmp

Download

memory/6056-586-0x00000209E4940000-0x00000209E4950000-memory.dmp

Download

memory/6056-585-0x00000209E4940000-0x00000209E4950000-memory.dmp

Download

memory/6056-575-0x00000209E4940000-0x00000209E4950000-memory.dmp

Download

memory/6056-576-0x00000209E4940000-0x00000209E4950000-memory.dmp

Download

memory/6056-577-0x00000209E4940000-0x00000209E4950000-memory.dmp

Download

memory/6056-592-0x00000209E4940000-0x00000209E4950000-memory.dmp

Download

memory/6056-569-0x00000209E4940000-0x00000209E4950000-memory.dmp

Download

memory/6056-580-0x00000209E4940000-0x00000209E4950000-memory.dmp

Download

memory/6056-584-0x00000209E4940000-0x00000209E4950000-memory.dmp

Download

memory/6056-582-0x00000209E4940000-0x00000209E4950000-memory.dmp

Download

memory/6056-581-0x00000209E4940000-0x00000209E4950000-memory.dmp

Download

memory/6056-583-0x00000209E4940000-0x00000209E4950000-memory.dmp

Download

memory/6056-572-0x00000209E4940000-0x00000209E4950000-memory.dmp

Download

memory/6056-573-0x00000209E4940000-0x00000209E4950000-memory.dmp

Download

memory/6056-574-0x00000209E4940000-0x00000209E4950000-memory.dmp

Download

memory/6056-579-0x00000209E4940000-0x00000209E4950000-memory.dmp

Download

memory/6056-570-0x00000209E4940000-0x00000209E4950000-memory.dmp

Download

memory/6064-869-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/6064-956-0x0000000140000000-0x0000000140167000-memory.dmp

Download