f8ff393b4f0f852003655de228f5103cef4970edd282c474d30517518ba17ab4

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
Size 3.1MB
Sample261012-sty2vsf15k
SHA256 f8ff393b4f0f852003655de228f5103cef4970edd282c474d30517518ba17ab4
MD5 97c4e12dbe4c67e23f98f5479a2a0c6d
SHA1 65d32ab6d9331e83dab6eccdcab51523095e83d4
SHA512 b28c1f95c3417f597b8d5b7524d9981f77a75fc0eabfa807fa496c2fc12f9ef57a27fbfe2392716abd4e1ba293447ec2e67a7c9960705830c2d438fb4ee34996
SSDEEP 49152:X5qMWA9n/TDbXNKddoOUTuZ0Y8ozJJgA9n/TDbXNKd:X5qYfb9sjUaZ0YfrFfb9s
TLSH
T10CE5120077E48036E2A324754ABDD71989ADBD756F2182CFA3C5262E9F306D1DA31B1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4112	elevation_service.exe
2648	elevation_service.exe
4716	OSE.EXE
4848	PerceptionSimulationService.exe
1932	perfhost.exe
2740	ReFsDedupSvc.exe
2908	SensorDataService.exe
5168	ssh-agent.exe
2700	AgentService.exe
3408	SearchIndexer.exe
5460	Reader_sl.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e3737c604b315ee3.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0001000000009344-72.dat	upx
behavioral2/files/0x000100000000994d-89.dat	upx
behavioral2/files/0x00010000000093d3-75.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107515\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Reader_sl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Reader_sl.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db77d5405e5add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000912530fd5d5add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000415afe405e5add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b0f180fd5d5add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ade989fe5d5add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a2acb3fc5d5add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f02338fe5d5add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Reader_sl.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4088	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
4088	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
4088	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
4088	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
4088	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
4088	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
4088	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
4088	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
4088	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
4088	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
4112	elevation_service.exe
4112	elevation_service.exe
4112	elevation_service.exe
4112	elevation_service.exe
4112	elevation_service.exe
4112	elevation_service.exe
4112	elevation_service.exe
2648	elevation_service.exe
2648	elevation_service.exe
2648	elevation_service.exe
2648	elevation_service.exe
2648	elevation_service.exe
2648	elevation_service.exe
2648	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4088	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
Token: SeTakeOwnershipPrivilege	4112	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	2700	AgentService.exe
Token: SeBackupPrivilege	2740	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2740	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2740	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2740	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2740	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2740	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2740	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2740	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2740	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2740	ReFsDedupSvc.exe
Token: 33	3408	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3408	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3408	SearchIndexer.exe
Token: SeDebugPrivilege	4112	elevation_service.exe
Token: SeDebugPrivilege	2648	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4388	AdobeARM.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 4388	4088	2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe	92
PID 3408 wrote to memory of 2944	3408	SearchIndexer.exe	103
PID 3408 wrote to memory of 1200	3408	SearchIndexer.exe	104
PID 3408 wrote to memory of 3440	3408	SearchIndexer.exe	105
PID 3408 wrote to memory of 1184	3408	SearchIndexer.exe	106
PID 4388 wrote to memory of 5460	4388	AdobeARM.exe	107
PID 3408 wrote to memory of 4220	3408	SearchIndexer.exe	109
PID 3408 wrote to memory of 3624	3408	SearchIndexer.exe	110
PID 3408 wrote to memory of 5824	3408	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_97c4e12dbe4c67e23f98f5479a2a0c6d_amadey_elex_rhadamanthys_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5460

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2648

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4716

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4848

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1932

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2740

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2908

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5168

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2700

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2944
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1200
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3440
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3044 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1184
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4220
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3044 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3624
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RdrCEF.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Size 9.9MB
SHA256 e64d8c732233845027d99d3247d72cb95f97f8dcc9fe5a9c453c9b4ab735c6af
MD5 157773633e7892125d1748f5a00ed39f
SHA1 16ec23bf31ad8700248a7de45cf5a6ed13dd6aa3
SHA512 f8ae20a04674fe18760e69e7cfe5bd9a8d8fde5e57cf1f105eef57ae389efd5d7e4c32341d7ed7cba0a5b1b7c6d824c286122328a109b7102c16da7418e066a2
SSDEEP 98304:VrbT5DhEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTXfb9s:VdnfW/JLGMcblLheTj9
TLSH
T191A6AF1D7BE21036CD732176AF4FA104E739D007A215C6977ADC83981FB1AA152B6FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 3.0MB
SHA256 393128fb91ce28646045fd7292e52b256dd4e92286573b68e2a2c589b3544257
MD5 85b3291a020d196b88540e74bf832313
SHA1 c41dea96e0cee7c0280c97a1d47ea85e35cdf377
SHA512 58845dc141806871c78556a9d94267ab6e4daaf3785e6eb8de2f3ab44c1a786d49982f677e8f319b9176233bd7834804ab6763c342b03d1e90416c774aeb422b
SSDEEP 49152:/TfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJzA9n/TDbXNKd:/TfiG/nzU900fb9s
TLSH
T138E5E526A2C8C0EBD5642170CC59BBF900546D78DBA2CDD7BD447E16BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
Size 1.5MB
SHA256 b111c4a91c2500f285b7c5927e009696dcff2782893383e82428f069a643f4f5
MD5 31dc8798821362aa010e0c4943571a3b
SHA1 99a47cd98757312538b1c797595b4190c6313c70
SHA512 1e70795b6c6eaae43bb1bb42e4139e7c95c9b83261df6eb25e90d6a538281f06b563eb7f72eae705d9bfac68e4f818a5bc30082c3f159b9f2755de00302f8b41
SSDEEP 12288:bFttBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dOh:BttUeA9n/TM4NZYeNm+9MhUwdM
TLSH
T1806522432FA98FB2CA4506B504A96B2CD9BAFD28EF4557E74705362B4E3C1C28D3614F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
Size 1.5MB
SHA256 9928e48f6766b9e9d0a5e316df5f408b999489570f9739b3894e1e249249571e
MD5 83f2d25782febcdf2d5a8c4878b85761
SHA1 ae30176f363789822db3fdb1a39175ab7de17c78
SHA512 192ae2e729eb8f40be799ae9e6d41ae8ac6c255ffa08b791e83765d07fd1dbdca333d6b7f912037026299321711b3cc6fe8565df5839706eb0117aed54fa722b
SSDEEP 12288:i5ydBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dod:iyUeA9n/TM4NZYeNm+9MhUwdW
TLSH
T12A751211B6C549F2C7660172496ABB4E9418FD3C4B2285D7A3985B3E9E340C3CFB399B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.8MB
SHA256 483a60cb333048de7de9e669ffa2e311fdc9091a3c72cf14a7715920d1886ad5
MD5 a2c770f6377ae68530c2d9568331107f
SHA1 4cecbfc985424717879f690ee6a581ce63c4dcf0
SHA512 11a7937a1ef2b59a4623b68f66f065ad303e1944fb78267d20962c197575e1fd5ab4cd2940b90199f47f1201bf100358b5c556c69e8d3487288479bd8c99a524
SSDEEP 24576:RHTAbD+OmepUeA9n/TM4NZYeNm+9MhUwd8:ZTAGOme1A9n/TDbXNKd
TLSH
T16695E01037D0C035F1B329768ABFE728556DBD715F6882CFA388162E5E706E1AA3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b9b193e213365548aaa5df6fe467378e90a0c6896430960f23b4103f6c730272
MD5 8963e42135eb35efb9a6cdfdd06d045b
SHA1 06647067e5a30373beb5ee3223dbb9accc6e4f88
SHA512 e0ed768b2730c2bc6927838dc1ec116899e3a693d2ba96386f4786d55b79d889c5c7755fb8c517869a6704909081127de68602b7e3cb82b721a457eb41bd8ea8
SSDEEP 49152:eb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnMA9n/TDbXNKd:g3q6HjBwfb9s
TLSH
T139D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 f53fb8d0ea4ff8abf44c02b1bc5f108ab7eaa76989c4b28aefed40294855dd4a
MD5 b1f600f38efb1b47f777f10242d5a854
SHA1 babcc87e8c384e5729fe9cd2126073061e1083c3
SHA512 770d43fed0ba0214d31a08a06fe7e8c34b472b12c03adc2249deefb69984dcd92c6761a094e1b291ce68eb7be5fe8005c73288517fd55bc339e1df94c339b15e
SSDEEP 24576:JXYfDtczAqUeA9n/TM4NZYeNm+9MhUwd:stcNA9n/TDbXNKd
TLSH
T11B85012967E408F9DD67827CC8A28505EA73BC454760E7DF03A4992A1F333D85E3EB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 c5d0ccf31369e53383fc1646940f403b95107813a5a504e5ec4d4012151cbd8c
MD5 d2bf737e1ba62833c461b96be1f8ec3d
SHA1 22cea850aaee7566191b8520c593c8dc838ef892
SHA512 5a7fed4e7c31da4ada76c6883f15ff73b2b4cf686ab8aab9cf878d6581ec285fbcc265aa5389484b3b9e30f4d104ac42b58cef3c56e7d05f1b81f2fa3dc0036c
SSDEEP 24576:J0Le5ji0hmxYrMqUeA9n/TM4NZYeNm+9MhUwd:JPji0A21A9n/TDbXNKd
TLSH
T1C5959E16F6748731D073C0B9C5D2A68EED72308657308ACB4286D77C7E27AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1fef2b2921f29c33a25444eb3b595669fade6f21c9c13cd89789da691a57bbf1
MD5 9492f5701405f14548d48e229c36470a
SHA1 4df374b757814d1dd6f267ee18c39829289b0cff
SHA512 f7a1f44a24262489cb1ee85df831f0b1b0c7f4e5012565a5c5fd0532db5b216d59afdf2b79fb277c35b66b9f994569f793c6c5ab7f61832ce6ccbfb1d6e96bca
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWE6q8wyuwUeA9n/TM4NZYeNm+9MhUwd:U/ezSC6vUzPvxHjy5A9n/TDbXNKd
TLSH
T1E7755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b43f1958fdc887d39f4fff5b321d7e68381f5742db4b072185fff09a887ffb15
MD5 b202679dead785a381815a7f8d6e086a
SHA1 e4660fbff43e41470065bda0d3ce8b99b073928e
SHA512 44a3d49f8b1b0c1ec81f2e6c1ecc2ab0c329024955d6d6e61271428f24781bb7e83a26aa718f4b126c9d5d74d160c5857aa3cf27ccb42d2f0758824220861395
SSDEEP 24576:HVbqPb88hv/l+6jUeA9n/TM4NZYeNm+9MhUwd:HVO88hXl+4A9n/TDbXNKd
TLSH
T10A559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 624985871811b95a885c27f3d8d75c9efb59bee8855fdc1e59b12fb67eca3971
MD5 75aa59606dd7352fdaa1d8842edddfdc
SHA1 f81ee73cc3020a968c7e993e81a234f9370cb679
SHA512 5ab430b2d3b829c14cc9d90633653b3e6e3a6410bfb00bc58ec90c8dbd46c72c79a8d7e30e922abd195e4e35bc15bfc104ab2dd050840697c52b73060a8d31cc
SSDEEP 12288:8HGBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2deZ:8HGUeA9n/TM4NZYeNm+9MhUwdk
TLSH
T1226523824FFC08F1C78E0A7544A9BF0C8EA2FD4DE685879D4319762E5E385C6C96648F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 dd19bcddfdb07b55b5c89917b59f149cbc57fdf517b0785578e2219ba318b01e
MD5 1450dcefe94cfa230f36f057b61fcabc
SHA1 017cea0c3afbb0bf2e1cfb7167d2269b50a3b615
SHA512 c5fed786baef9cab1ecbc4323b1990928b854548dbae8c400c2b17ae0fac3eecf10f91a5ffe230c9b58cad9d1361eb6a1d051462eb24a4f5bca93eb4529320d8
SSDEEP 12288:beBNUbTVO86UrBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dL:bJIUrUeA9n/TM4NZYeNm+9MhUwd
TLSH
T17B85CF7BAE38ECE2C27E4DB95A918700D77278304B5293CBD165830EDE235E15E7AC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f5a9d4601da865c4dba9bae563c3465a698c044285a8b8ec91a5a4b82b2bb0c0
MD5 6b0d9648c9204be01c6ccc7f6895802f
SHA1 998fd679014b9880645e849bc816990547ca99b6
SHA512 019f069704790b291bec6b0b00ac1e53331f574df8d5b6a85ce5536928a351eaa27abb338a671fbf9dbbcfb595adae7ef96a31c714348e038fff667dc1bf3950
SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THl:eQvGAdlCEL8c/yRNw5CDfb9s
TLSH
T1A0267D656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 5f53b5931949a5890bdf9e07a1d3877f0017521c583b78e86dc556274ec5770f
MD5 856692bbb5f9a8e23fe0835ea26a699f
SHA1 4e3a82b19c71127ea26a4a1d5174d6b1240f7461
SHA512 bd0be5dff77ea109393a8042d9010c4c727d33de856201404f2424101730a8690e1d946b1d435beba9e86be7e6bb9a869bf5a488f0cb8c6f14ce0ffd9efd232a
SSDEEP 12288:iAwSfxL/2Dc3SDLLmt0LDQewsAj5BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh93:n7ewsAj5UeA9n/TM4NZYeNm+9MhUwdL
TLSH
T1B685E031FE74D432C3BF0DB21B36D706586DB9204B511AC3E3A89E9E59302D26776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ce591d1b27d2bc6087bcc230bd743e862c7b8c597229bb536d83e34af21cda76
MD5 07c26612f38f781f0efbe0a192812ac9
SHA1 ae1acc3763627bc1fcbdb42cf57b0a677f4784c0
SHA512 34c02a3c3ee2512be5e0e99d9a6fb4d3019157130b1b3d455195d905deccdd0b5b460c5bd78b8dee699494d43c9836a8661c404fce17d7e0116a5962c1cf31d5
SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH89:NUEtQevvqc2W1cpV2EI32
TLSH
T1D2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8718e0c5faaa6a0825719852269cba49536ba726d287acf9d6a08eafcc228d13
MD5 1878bbae55609be2e7771bc04165a069
SHA1 b01b781d32ec1d4bb82284c19413bacf4e08244d
SHA512 e0bb411a6700401e93ad1e56c9811fe9c0ff73c7f1e08e64d39dc39430e40d57adf2cb416cb3b65c3349c0858b427159ce6b48c5a757784cd343fb3921675fca
SSDEEP 49152:NCbRquA/m2yL5zTfFiV+XenmE3/zlA9n/TDbXNKd:qoquVjnm/fb9s
TLSH
T129D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 70d735db0b5ebe5126266c204ddbc90b1713f0abcac8422d0ef570c91c1b6d9c
MD5 71e89a81b11026f5d2fcb4a7f14d83c9
SHA1 3b82cc7c7e57620baf742f67ae7de54793ec5809
SHA512 638d3d07736e156d193ac6cf432c820b7d042738d0b4e58d5da9312155db44610a30a5a8c6973ee3bd5b407857b1ed5b4fb87a397c3d4535f397e49243cd1de3
SSDEEP 24576:5AhGLJIFoiwtA5l7S53kUeA9n/TM4NZYeNm+9MhUwd:5AMyFoiq52A9n/TDbXNKd
TLSH
T1CE359D81EBF945D4F5B3AAB899B69570EA76BCAA5E31C20F1150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 fde790634e8a8cc5c7880bba315022a5da61af2bec432aac8484c2debd54b645
MD5 9dce3583295b8fb539984cccc3273330
SHA1 f0e8a702d4c2eaef26268d54f358e2e68ff56d1a
SHA512 921b9b49f9a0fd6c0eb9d29b9914b25bb8361eda1b83ca9d9aaad92e37fd81502a25aaf21c250a356246b18e56b54a66613b97e13046f3f11a6909acc7541b91
SSDEEP 12288:rmw5HEjsChNzBFgl0WDm+CQBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dP:qwuSOWdUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1D685F14637E80CF9DA6742398597D635EBF2BC062A25C71F0760C61B5F37261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 f3def675b0416ab1cd7697ab17e26a809d54aba7ff68eb906df36d189e26774d
MD5 abd59a9db40abe922676c13bb246b155
SHA1 494319d9244194ee891de83897db389897c858ef
SHA512 6ddaf9a9bbf2b9c7b4bf5e177cad9b919e03ce4be6fdd4352ec09b833473c4d8f92ec97fe9de2ba8be945ed51cec38a6a63b871068e382a59136502abe1833b3
SSDEEP 12288:QjZ1IyJBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dq:MZuyUeA9n/TM4NZYeNm+9MhUwd
TLSH
T18175128627F814F5C397527DC8E56B08DBB27C5A637543CF0225526A1F32AC28E3A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ca4cc0aac2bb7b100e2db773d0e6cdc4911a4a649d80f0989cd72dee5d7e43c4
MD5 f3bfc6490e0d965f074a616f2472f922
SHA1 fbf5006f983b04ea7d3a9bc4d15e3046c1c4d698
SHA512 9419e46c7d9255e0a216979864aee3b25ab899b34e744ddbfaed2323eae09772d5ca8e4232bf9524009edff0cebcfa1eaf32e90d3d802551352971e1c359b2c0
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Up:TQRQyi36YOcPQLvw2gAf+PN3Yfb9s
TLSH
T133666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 eceb65795d910b09fc1adb2310a73f8db455ec77eea62c082eecd771596c39dd
MD5 800a79a58bce5ba0f8b3d2e29bc8b88f
SHA1 f2716d488d9e4aec74348b960e2acd0eb38f398c
SHA512 c67f1d577b6aef7bfc7d43f77295dd92e47486b39b27a731b0601e9496c860cc35e8d621465af6a3644ad48480604116b15d5a9ff597a9e623fa06ab34cd36b8
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Up:YQRQyi36YOcPQLvw2gAf+PN3Yfb9s
TLSH
T1E9666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 945236e6773794b8394cf8ad1f8c705e62f0bd0dc1f306bbbc1b3df1e1ab30d5
MD5 1b4b44fe099a60117d6eeb1725378ebf
SHA1 b9d9cf592d55ef8ccab714f0af68c188c83ee1ce
SHA512 02502d320a85614e7ca2a6d2d3428bc9ac70fa6bdaf8506f71f79df97d0589e8cf17f9e1e87ebeb88393638963172b1898b88d418ab0046ed6d3c6bae3a03c67
SSDEEP 24576:ZwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0iUeA9n/TM4NZYeq:F68Qg55nhheWu7PNU3/1A9n/TDbXNKd
TLSH
T10AB55A33B2F600A9C44DE1769F4A972196D27C758FE0E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 952b51e90efcfa49f72ea47ca1cec529652ec024a34eee3e6c9a6569b791f2ac
MD5 ff3b0c11892b4d3011c2831fab5b3c1b
SHA1 aa39793b80f02d8650836286c2ad58db18cbe184
SHA512 5245468c138c702ddd0ffcb97d4c4878e7346513d786fa9f1f8846f1e729b4d8314380a04421e71cfa852734c51b124698fb63bb021c03671d645c0867eb5a75
SSDEEP 49152:R3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99H:wy5112gYy5azzVvL69nLKnhZVfb9s
TLSH
T1BA167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d48a6e8a5b653ed60b811987d99766167f64c4485160b3cf74d4476fd6816ff7
MD5 fd17f9ed3c55433e83337dbfef49adb5
SHA1 b312a63e16fe6d91f5ee4849fb04f87d18a0ea33
SHA512 d114dd537ee155494eed55484471c52de03080f77e72e3edeebf1119e3d2a4b6bd4378f4634c161fb28ce5a38a90dd1ec772462524fdebbb70b0770a137cf081
SSDEEP 49152:qB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glPA9n/TDbXNKd:4u6JmVxd2dMfb9s
TLSH
T172D59D13F1D901E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f9d700cff404d02849a38a3a2b8dad4c68ea3c76f4ba1e0b68c80f41207c373c
MD5 6cc4c320755bb73a8008f7af29acdc66
SHA1 e464d8ecbdcf2256fc881fd3cda50174965cf0d2
SHA512 7dc3e9c970d0c0e1b6b166b18c9740f3041f8330c70fb801680d082be34a6e5c0e6a7bd68b10d4538d8db9fe8157675a03d9a3a70b6f703b616f6057f602fb7f
SSDEEP 49152:Z1hpsNoJpF1A6UU44CwH7R4xPA9n/TDbXNKd:ZmifPbR/fb9s
TLSH
T18FB5BE13F2D800E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 83ca18e815ba6bc5489e2a349bc292ebf8fed0bb3bbe84979c7d11f9f9670bf1
MD5 da156a126a1ed76d10170874a3ac7575
SHA1 b1356e9ff6d0beeda9ea1fa2393458aa60a3a02b
SHA512 17825c580606582dcfab29aa4cb2591159ab3dd3d633f35ce5531fd037238659fdea2f0be207068d82c3fad8f1a39f524cc0e1afa172bb88d8f2e7804b1737ed
SSDEEP 49152:xSuZQIY0Be2KRRVtOnks6NMHqsA9n/TDbXNKd:f5dKTi61Zfb9s
TLSH
T11CC5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 29cf26b8a242f6e0e2b2425e2666442df8e881aa2513cc189fa69174b9d80498
MD5 8e79807f1bf025825c588279957ff995
SHA1 1d62063d9b1f4de9a3bde99031a6583cb14844c8
SHA512 6a921c787fe0611dd87dcca957cfc7e74df79bf80b8eb1c58fb5aaa5a28cce3c5be5b2bda8bba79a3a455bbafefb4ea2f42f90f73408f1d5d5da97088b1d7612
SSDEEP 49152:/htSn8EApI0figngiDn0AP5wrA9n/TDbXNKd:uX2iyphLfb9s
TLSH
T1C695BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 f692a7073c10185355295dcd95d7737c6a26bd492d700653b1d4544038b62db8
MD5 f3042b2e856d64c69300511b71837134
SHA1 31cf640f2eacef7a5c0c437ceca70517ddfd78a3
SHA512 aca9f7e5baa7079c7ecf5734a8e4067edec6d71dc7b6471cc6e6a1fbbbfb994ede56d365b2dfa50e0e00b10c72a44fc077cb6e5190bd0bba8f665a462d6efae2
SSDEEP 12288:XOBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2df:XOUeA9n/TM4NZYeNm+9MhUwd
TLSH
T13D6523824FFC09F5C74A0AB584A67B0CCD92BD4FF685439E471D722A5B345C6CA264CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 a541502b04e87137a9ffc076ea7c87c10e4ae485a216eabfbda9cced6549fcf8
MD5 97b573890b0cba2e18d437a7c9a9f06a
SHA1 eb59a946dda97ebd36fce068e04dde56aa442e24
SHA512 24b4b62893ee3c3ab6b2905c973ac10d3e2f5b69bd5c7a7772308341ef822622e1e643d3369f64a1098574992c8471e5153d43f02a967cd3c85362283050023a
SSDEEP 12288:31BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dn:31UeA9n/TM4NZYeNm+9MhUwd
TLSH
T12E6523824FFC09F5C74A06B585A67B0CCD92BE4FF685439E470D712A5B345C6CA168CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 241032ff18098d87ada3d2764102e8cd7d1b6e77cfe2211b9b66181fc3501e24
MD5 9a93c3b4c86b3c5705b4535ff1900be2
SHA1 2384e1d696dfbb93a878d81a1ba9fae000ad4156
SHA512 0ef97c863bc4e88fda2009364c32c9334cdcec250ef934770dec0d47d8c63989606f9692fc8d84b13b46aac5582d82b7666bd88ac7a27ac36ec95440b6513a43
SSDEEP 12288:5TBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dn:5TUeA9n/TM4NZYeNm+9MhUwd
TLSH
T18F6523824FFC09F5C7490AB581A67B0CCDA2BD4FF68543AE470E712A5B345C6CA664CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 465722f13e6a095d97ccde7453c9d5e64cbdfe31ae42ad57291fb121d712eabe
MD5 cd1a3e3ddbe343159993c6c501cab8fb
SHA1 5d4dad8f9a65316d34324801b54c995aac148b0c
SHA512 41368244fdc710b23c90e1255433fbf83157532324e4c14e47d2501518ba8ee830c656bfd11bf6e0635eca18227b1301cb5d7e34c2d8dd87c0737d6007fceb09
SSDEEP 12288:VVEBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dn:UUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1FB6522821BBC04F5C74A9679C4A6A708DAB2BD8EF76283DF4705351A1F302C5DD35A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 23eb69a9d2b085c9cd66c21d5324e9f7907d3edd31faeed96699fa64e05fafc6
MD5 9ef97325c490ba317d9974504cb7bebc
SHA1 3076111e5d2dbbfe3a2212cc3b1833998a63e5a9
SHA512 97af3e726e4679ebe27dd868e6ce7a9888d25163f1c922cf4e5ca83e7c7c45491db96f12f15e766850c5c0684f393cc204b4766ea04b02d689e8f30bd53505e2
SSDEEP 12288:fcBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dM:fcUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1256523824FFC09F5C7490AB584A67B0CCDA2BD4FF685439E470E712A5B385C6CA664CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 767045ab0320ffcbc74d57071efb48a7fb7fb5a40e49713ddf8a6ca5a5f7b231
MD5 2728b71f6bda51335948d2eae4e1af50
SHA1 5c46973a1810354d33f66034fd6566ebe6b48466
SHA512 b211afde009f324de71e73867cc3cb3889d7a6150964fd6a91ba1f78f1d6cd44e1d9ce0571fcf9f7127e42678fe34dec509ad1d4942841394e8e04ae4eff0170
SSDEEP 12288:aBBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dt:aBUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1946523824FFC09F6C74A06B585A57B0CCDA2BE4FF68543AE470D712A5B346C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 30ab71662786d7f2aa44f21a23fbf2a93d278a4d44bf8e355709d9e428031ab4
MD5 9b8c576767887f78fd8df104bdfa1f5a
SHA1 b0d7d1170bc93fa1c181f53689e64f4a3fc892bf
SHA512 78e2150fa8016578262f80f45814d18da8bdd4c00bc2cb24fbd6f63c4fd05313e6dde09d20576b73c85ba8c6081a97d9156ef6af582194337e8bf34acbfe3874
SSDEEP 12288:mNBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dV:mNUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1976523824FFC09F5C74A06B585A57B0CCD92BE4FF685839E470D712A6B385C6CA168CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 b0e89aca4db9391382e8c69ae652f394a84df683641f280dd658e22e85c5cd2c
MD5 10efbacdd67a0ff4a82881f468dcbbc1
SHA1 7c231a3929726e37066ec0a1779dad4e530f3651
SHA512 33754dd471dc6b12b1415da94fe7508b93e14f2fce789d84f52b31a8e0cf0b3176978c87f337a3fbd6c173a5fff38f5dda765f07aaa6e7de18f71d814e2a0f18
SSDEEP 24576:uZMEzFVSOVUeA9n/TM4NZYeNm+9MhUwd:uZMEzfdA9n/TDbXNKd
TLSH
T1EE850295B3A00CF4DD67423EC8659A05D6B2BC1A5760C75F03A8362B5F333A14D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 93ba5e32f4ae9b59d0801857cf4135d242f16f274313bb90d08fbc3011ded2eb
MD5 05f94467a94024b148f21191d2563601
SHA1 92650eb004f6cad782ffe8bf69427ffb8ffc41f1
SHA512 af15e9cac942cc9d066ee1727018bc78a7be964bf56eec691d939254ea9352067c6041fb21ace0c624ea5eeae621375859d94404f7f136e05a50074029001cb3
SSDEEP 12288:qCBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dN:qCUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1D56523824FFC09F5C74A06B581A57B0CCDA2BD4FF685439E471E712A5B385C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 6dd1474ff6256276fa25b47771ce7ad913f0cc6c02ff5d8d0cd02a180c231e98
MD5 fe13f4b4519ed94fe6705468947da2cf
SHA1 dd7e669412c2d3620640bf11750e2d61029d00a3
SHA512 4b2e50ec56be937637dcb007b1c3c2cc1825367d4b07a23fd4e0a6bcf5031cd2bfe9de5f58f633cef08cf6fb54b24a63efbb1aec3aa7d28d8df9a1a5512c8ad1
SSDEEP 12288:sWBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dN:sWUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1FA6523824FFC09F5C74A06B581A57B0CCDA1BE4FF686439E471D722A6B385C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 faac0a3073dacd51b71a793e81f717de11150b3ba4f61257692ee577bb51495c
MD5 a3438f309d8f9a9070d970a27a2531d6
SHA1 8411e04e978ff68b24475158d27d1582541b3b52
SHA512 e22f525d0fe81b7222026784e76cb3ff239e698419d91394e7f864f5699945cc777229bc449e724c3b58198517a9a0afa87238f877f5841c82d310ddc3f0552d
SSDEEP 12288:RyPz5L8JBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d/:AzyJUeA9n/TM4NZYeNm+9MhUwd
TLSH
T11E75024777B420F9C2664239C8A21B05F772BC3A57608BAF036417362F376D19E3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 a92d369b60418526af71372f40603bb66f603839ae973a64218791c61621af36
MD5 8b378a0e1061a072ac076fee7b2e2318
SHA1 d8ee03ede1ae91daeda0c45e63e00d79d160f3ac
SHA512 688f00cf3647a47a17949e460a9a654fb87db269230e42bbf524655125ea1caf55ff63d2890cd54e21ddabdc707d6ebea75b60d405376b8cdf11ff3cf0f7f255
SSDEEP 12288:5CBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dx:5CUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1276523824FFC09F5C74A06B585A57B0CCDA2BD4FF685439E470E722A5B385C6CA264CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 473c9cf116321cf19c09ce2a6f202545c641758c8ce2671c09c79ba6acf3e918
MD5 37dd17648ab61a88c1439042d9933d7a
SHA1 7bc4e62299a15515667df7ee6a4f31a2657452a2
SHA512 d2c11e3b7fdc827079e4b639cf42814314a69cebaf78e3ff405375df25eb92afbb02b2e01c2f2f2fe226e5f428b0ae0ead9ff2d4f865651246741ef4e359d35a
SSDEEP 12288:/CBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dF:/CUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1DF6523824BFC09F5C74A06B585A57B0CCDA2BD4FF685439E470E712A6F385C6CA264CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 b3f144352603c0a7a1416a016a0641c23d5bc2810cc545b923daa23e4e422c84
MD5 aee8069ce59ddf2d5fb7b44ed2f9543c
SHA1 e971d24367830bc4ba933203e518e53eb82e5def
SHA512 0b045a8e0e10fb8547daac66f0bb32ad2d3cc0d45f8ef2e1c3e6cc5d2ccf5c9a66747b5362329b26c683f910b81648467cc160622cae3e337e25174ecdf1c478
SSDEEP 12288:zyPz5L8JBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dv:+zyJUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1CC75024777B420F9C2664239C8A21B05F772BC3A57608BAF036417362F376D19E3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 baa4e8cce41f1faee9f95f131a1fba01bbe81b496d1ffca40f654132d25993ea
MD5 2e5ceb8f584b242f1fdd9fc8ddc7c926
SHA1 e4ef708d1ac6ddb6e1387d44081d264e04293d4b
SHA512 dac14db480d776356ed81d28621e925bce970f7a818903ba2d3bc97159e091adf7e4842da1d8cd4b4f5624bd2e623ffcc23220530f9e9a61b57858ed4e85d866
SSDEEP 24576:rfwv+k9RX6wkyAImUeA9n/TM4NZYeNm+9MhUwd:zMnYIQA9n/TDbXNKd
TLSH
T11695CF29EBDC04E5E1B7923C89B7460AF6B178591B31C2CF025A536E0E37ED49E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9e3c3cd3d8a8e3e8b9527389864c20761e2a5b5fbe2d48730a0b6178b6ed4949
MD5 c161ef553005b65c575747ff7a361ccd
SHA1 0a9fed29a0305006c02cc85c337f104071cd5600
SHA512 c2bdaea0cfd1e703da20cede1f98960a30093e57248d7b47377059bb67a3956caae51f2a23e7be78a8799736291531d331a51126ee8c55b36de30d6ff32b1b5f
SSDEEP 49152:BYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0LA9n/TDbXNKd:pySzP4fb9s
TLSH
T1F1066C56A1A801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 71e26305239fd79b48830c2509ada650a5caadbc7fbe812a5f8bb06a56857411
MD5 2730de8d3b6f49f5e5b33a4ea3df8e9a
SHA1 b1645b5284d3e07e746932219319a9ccc79eb0a2
SHA512 75766479d55a022df4acfe312fb6fd929db080f8b9d0de80cd547fee68170b0b1e45a33143c0916412f713fd15ae265adb8734408aa6818bc9053d3ef0cf3765
SSDEEP 24576:P47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYlUeA9n/TM4NZYeNm+9MhUwd:P47JUQj1irIhCnDHUPfF/bA9n/TDbXNs
TLSH
T12665AE1EA3EC01E5D1BA927885154A1AEA71782E5F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 c6c58b0f6fa3778e68445ef1e5e1669145b60146af0a59b482a7a12dc98ef251
MD5 8ef3004d2c039af0d2e25675d8f9fb0a
SHA1 cd33071b4a6541aba528838c2e7e34ff0382af03
SHA512 21e91bfccf874886f1230dc63af1e2b0520b8ae47f2aec47fced17023407d9baa91c4577a6cde163c54eaeb8771d8afa17d85ff1c67b2f7a0572fe09d1eaa0fa
SSDEEP 12288:izsfyBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d2:NyUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1C575F04AD2A802E8C15E6279C7965A04F7637C2993E1D3CB43C0F53E1F356D09EEAA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 634B
SHA256 4f9b2f699943dc7a42321fde879d884202e9b3bd8391519cc69bd83d8d485aae
MD5 4600ea83e72c40d5b6d25248895c4d66
SHA1 666d119fa0398adce7093f434fc15437ca6913c5
SHA512 08c1e1315bd3be50f47cce09a7b9c36aa38572495cdcbaa1053f6cc14af921437f3972c25d2d5c8df70a5b2e239a62d4cec6b3039de5b99e43b173eab4cb0bc9
TLSH
T108F0F41726E40254F1B72F22EBF990B357377C96AD2994BCA0D8031E48E1A45D5B27B3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
MD5 29f1b2d1b6f9290138596cf180847e53
SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
TLSH
T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
MD5 SHA1 SHA512 TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 a55e2af5d605653077223a094e147a032e6ba15e3408a78610014dca3d81080e
MD5 2fe933ac5a6c6918d0c5b209ed3f816b
SHA1 1f68bb8ea0e6e8e94d8f4349a12760b1a556b41e
SHA512 dff917664ba7e2c003a341e938c3b224131f11679b49f7a7187b32fb682d6adf4e249a4c68f017f8554dfc357b85840fd973ea6dad8d7dd997d4a6c6a2b7ac25
SSDEEP 12288:87UNZK0U3fGGV0hUGKGMRwq1ROZXA9q+pZ/H/pfzeQ7fQI:87kZjUPQh5mRF1RAXA9q+pNH/pfze2o
TLSH
T1B44517017626DB4FC6A940361E76D6CCAB707D05EE046F0373C9873FD476A59BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 9f1c643a36e0b9ae8a5ecb8f1e24d381c1858d5e53adefa67dcd6502764edcf2
MD5 2ff4df07412921babfe67405617be7e9
SHA1 b721d9938304cae2d3c99e95a7e81d489335031d
SHA512 20dcec08a7dcfb65a9f11e7a5febddd12fc38581d21f96f7535dd61ef38973ef86f5b897b73a6a75d98f367a7d30ac7d5f11cdf70c313deb31b87b3e2cabd125
SSDEEP 3:OlH/lxocTl74/J2ZVIyOl3yjIl/lllo3mCllltGlslslslslslsl6N/9l:KUA74J2EyKOIXymCtEEEEEEE
TLSH
T1FD81928087192BA4EA66E8358D1E03A85312E009E488EBBB620850918C8869A8C02B6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 82e2b9e640459cf4c222d448326811e062002600f126d9cb3efb0cc20447e776
MD5 ca88753afae89e4ccd9d0f506c86fc79
SHA1 7ff11c9e3f478e1fecfd2931d3db0ad359b31284
SHA512 9274cfed9742d198832abafeb04afb703bf0a62c96e69e223f7984b8a3f9204f50948e396374cf766d015c0d369740c2768a92115195fd05350240379aa9d2ae
SSDEEP 12288:Dh4HFd9zI80qIiIFttZbrvqu9R+T7hwaWa18n2JcDiGXqBnLxRQU8jcxFs6Bbcs:V4tPI9brv1IPOHuc+G6V1mtIEYIs
TLSH
T137551A00A5B7E71FC87E9037073286CDBB786C06B7453F057345893D98669AEB6E22D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 168B
SHA256 0c0e8f4151e6e9141c40d3bfe2373bd7b4f5775c6db93ef4a87cb92b7f3fb73e
MD5 3c75106b2b5081c664e5d9a89dcea9b1
SHA1 723c2ae3f2c302bc4f23dad194d2f297098e2c6b
SHA512 93aa921ad799f6f5a297d9efbc038f5cb3ba258e45f278e19e36b0d6c164d0b055950ef5143bbdf3c0a0a4045a44161502ff4a1a320959bd78dd6bb8f23d34be
TLSH
T165C080C90D1FD02F07E503C115095F5020651172C75946F4B2507746B03C5110B6BC58
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp5CEB.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp5CEB.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp773C.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp773C.tmp
Size 3KB
SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
MD5 ec946860cff4f4a6d325a8de7d6254d2
SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
TLSH
T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
MD5 SHA1 SHA512 TLSH

Submit Download

e3737c604b315ee3.bin

Path C:\Users\Admin\AppData\Roaming\e3737c604b315ee3.bin
Size 12KB
SHA256 e700eb69bb57f1a9addbc93875abb62a279a75671be4564f14ec9a5089638867
MD5 c64be1b1cf993ab85b34831c41d00943
SHA1 b2e215f3d66638a5a6f7765dcd66f7b89e5f38d7
SHA512 6b7a639943e48a3d38ac3ac68c2f9ba99981dcc01acd6fe7a6c33f113b3801bc5f5b2cbd8d53a8c4fd2e0121ae85e192f7dcd0f213de400cb5fb6d1f45766b7d
SSDEEP 384:UIaTPaBnoo9wnX+UvPuuN5CYSybRPebID9:baTyBoacfvPBN5FSMPeb2
TLSH
T1EE42C0EBDC1E2DA71124C71A50E357BDD6126C67180E3209F62F74886DB08F2587177B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 5352d6a3629e099e2b31a8b1dbb223f5701386c1105895999fd902ed0edb982b
MD5 5fe094856a57e02a599f17f06887aeeb
SHA1 9213daae89bdd579196f3f8e6150c6642beec5a0
SHA512 22d048c85c4b834203b0b70c98f44811d89f02f8c1a4fd1b393a02586ffe41fdc2fe0f83156f5e83f20573e286cdefe93c43ac4458a30da1d738b83198c7d0d3
SSDEEP 12288:qO7KBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d2d:NKUeA9n/TM4NZYeNm+9MhUwdw
TLSH
T11B6523824BFC0CF5C75E16B440AAB7089E56FD5DEB4083DF8209722A5A345C6CE7658F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 722abb594cb87a1093b5f09976ef768355ada8160d7418821b9dc5e10e48fd51
MD5 3c33f6b9f49b1025a4e89f9ae53fda59
SHA1 10e3800def2f88b8d5ba9d95ecee104190e2e9f0
SHA512 44fae68b783bfe2f1d22f1f9e58feb1db231d06eb6c58546ca6a1ed44617c0a3cbb882b6392348339c5ac1d31df660f15ed6e9aa4317bc6a8e461670ecf0682a
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bYwUeA9n/TM4NZYeNm+9MhUwd:Kgb4mBIBhGFhA9n/TDbXNKd
TLSH
T13D65AE1E22EC02F5E1F9D2B88DAA4417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 0b70b130e542da20ed65baa311f38976fccb0a9756a619123812bb1019d7ba7f
MD5 60fc3695b21e29912545a2b7c3c0eb3d
SHA1 50a4e3fece84e307d65840b2c96a90fc638f7de8
SHA512 f38f6285a01365bd3ebf2694c60e2cf1a5c89229397509a3412cc0c070951b4eb0ba19fc43a6ee9e8008c0af6e0b23794d78369eec6855117ecc3d5e61817984
SSDEEP 12288:oJGhGuPqc5XxSdXctZ5Z09hD+60po+nTC2/lfguoZ0ID98bUzWmRrSskHo1Fq:4GhDP9yXc8v2SUTD6Z0Y8ozJGoDq
TLSH
T17505236D71F812F8D539843DACE181E274A23062673659FF83E8C179AB117F46639CCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 38c036bf5c8aa0f705009481aef1e65e02a5ed478dbe05878de4939db5d93748
MD5 22ff04c73e1f37d9be3f559f20c5e194
SHA1 e4ebaba19d4c64aaeadd15aedc3ea80bac92bab9
SHA512 7938e5b2c1fc849cf9bc1670e0f9b264dcf0364616db67ac980852a50cb4b28b8103439cb30802788147e746cc48978b70dacaaf10ea3678eac3ec3dfb23e6f3
SSDEEP 24576:gG88u8FpJqH1hzria7/mVUeA9n/TM4NZYeNm+9MhUwd:z7ZFPqVoa7/KA9n/TDbXNKd
TLSH
T15D95016567E401F0C47BD13889864663F6B2B8251364EBDF07AC8B561F23AE54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 0913bc2a734d249135747eee3050ddaa87fa4e89dd9480d18719afe3060fed72
MD5 72091693d17c01ffc9b390d2d760aae8
SHA1 41b8bb19925395eaa6ff90a49009a5976348b5ad
SHA512 8930ec77ae240f6718b905491b214561944dc7a452bd032ea88c9f312303f871a812fb33339979178688fd8665da8bf16f842af1f59810c51e1e87dd777a2212
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjNA9n/TDbXNKd:5G05lO43bdfb9s
TLSH
T101D5C06A62EC01F9D1BBD17CD9C6460BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6dc5c5f5cde3cad2edf25bc1fe7250b8affc7a776999dbc5138d60449e5008e3
MD5 6b8e1ff523c9a7b8f97db1b7f1468a19
SHA1 80a40dbec37adffe0bd705b865ea7985eb815d6f
SHA512 971377cf069872ac414876f847a917b6411dbd79a76da7a927b0f7c5dfc37f61323d415b291b3a2f755aa736d0e6aa92bcdba98fa5170fccf53a4b8498c5f783
SSDEEP 24576:Cfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnXUeA9n/TM4NZYeNm+9MhUwd:Ka5POZ3+Jt2pasx2+m1A9n/TDbXNKd
TLSH
T14265AF5EA7FC01D5D5B9D17DC583860AE5B1342653319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 efa4e0bb6ba6b27546703dcc4d05e0b84486d0b7277fa14896148eab0795bdb5
MD5 47b1d0ed1e9c73e657989f65eb2fae0b
SHA1 ce2a2a4a07bfc16a2a40138a7e66f4b569e7b919
SHA512 b79090b2c259830691bdb3b1457f8dc23ad359bdb43abac4c670885bd57a1fa9ecf521bd5a989f0557a2ed863babfa535497ac648422d8eba30a7ce507eb117d
SSDEEP 24576:FNcwHdjbyQ4nLC18lb/EOjowL7Fk9UeA9n/TM4NZYeNm+9MhUwd:FNc/zEOVHFqA9n/TDbXNKd
TLSH
T168858C1623E901E4E5BBE1BE89779646FA717869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 46a30195099e4081fd201d9d0fc93883c8a4e3f709a9935166f6e7d51f411eef
MD5 729f6470b5cdaa814df69455b850fdd6
SHA1 5fa6a7b61c3e318d390961bec6e67848cc9a7698
SHA512 ecf0dca5201ea3abd5ec1dde222c2ea048fc346c31ecaa3db711812c6cfb62ae8c11168775b4cc7472387c0385d75ace077e051337333ade3c05bec724e4994b
SSDEEP 12288:K1H3k7j5ZI7ehuPqc5XxSdXctZ5Z09hD+60po+nTC2/lfguoZ0ID98bUzWmRrSs0:r7DIysP9yXc8v2SUTD6Z0Y8ozJGoDq
TLSH
T1A225025C33B901F9D16B903EDA834142D1B2B071972259DF47E8C5B95FA3ED8B938E82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 ec86bcfc7fe0e3f2ee37d08ce0fdff1210bf9b871b0db67caf06596267b65fb1
MD5 e2a480cc40460066a6e3e515139e5ac9
SHA1 6b1a0a1d4eeeffb5809a2f567344ae965654f20e
SHA512 950a6c24e648449aafce392d466e2ba77c9ebeb8d52abc86a217d59744ddd5f879485d91abe8c7744840d76fff5475dcf0b9fce481859ca9bfdc37c8d71bf49f
SSDEEP 24576:+TkNvNnaFeYhJNtmZBmYdP9yXc8v2SUTD6Z0Y8ozJGoDq:+TMwBtOmYjOUTuZ0Y8ozJJq
TLSH
T12875BF6EB6F806E4D1FAC675CD238512E6727461173292CF9390C13E0E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 343f99b1689a98efc7e4a7a0bbcc6a2b1302577dc35c7941b7418986cf3e03e6
MD5 a73d5466fd650ba4f4b82cc3f67d495a
SHA1 c3a67298ab67d5b8a0a35a4a134c09f9047448d3
SHA512 bd65ce2dd6800a63464106c10aa27c92853bc86f831b12b9a06f015dc42426a940927399a440ecbd96ceb793b96f195424378b219154c362af5eb0dd0c208899
SSDEEP 12288:xHvUrBFrEjwaQRBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dn:xPUr+NQRUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1E385E11F26EC08E5E67AA17D8586870DE772B8561312D2CF0290817E4F37ED8AD3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 27519c192b9b769534fd0f0733572967e6ee7da9ec09a83c3be12dea94c46187
MD5 1e368c77d4081a8c870f527f0f3d6259
SHA1 88cf0daee6f5f4b8c4488c72525b20fdc68f2e8a
SHA512 184418ec372e46ce5d55df52de4c6df7422e76520c455b9640cb08609438865d3046e7cd40149bceadc42c670ca86874ceb195a3b0a0baa0eff220f83192831b
SSDEEP 24576:ID3FHshBIYQgAuUeA9n/TM4NZYeNm+9MhUwd:IDVHeBIAAYA9n/TDbXNKd
TLSH
T14D95E17EE7AC04E4D57BD1BCC6638A06E77138AD032256DB0294917A1F2BEE46D39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1932-189-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1932-413-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2648-246-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2648-70-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2648-56-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2648-57-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2648-50-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2700-237-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2700-244-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2700-231-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2700-239-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2700-230-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2740-414-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2740-192-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2740-614-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2740-616-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2740-199-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2740-193-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2908-415-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2908-204-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2908-419-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2908-417-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2908-205-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2908-211-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3408-420-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3408-248-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3408-247-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3408-254-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4088-0-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/4088-8-0x0000000000ED0000-0x0000000000F55000-memory.dmp

Download

memory/4088-21-0x0000000003580000-0x00000000035E7000-memory.dmp

Download

memory/4088-26-0x0000000003B20000-0x0000000003B87000-memory.dmp

Download

memory/4088-33-0x0000000003B20000-0x0000000003B87000-memory.dmp

Download

memory/4088-7-0x0000000000ED0000-0x0000000000F55000-memory.dmp

Download

memory/4088-2-0x0000000000ED0000-0x0000000000F55000-memory.dmp

Download

memory/4088-1-0x0000000002750000-0x0000000002899000-memory.dmp

Download

memory/4088-49-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/4088-164-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/4088-14-0x0000000003580000-0x00000000035E7000-memory.dmp

Download

memory/4112-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4112-229-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4112-36-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4112-37-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4716-166-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4716-167-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4716-385-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4716-173-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4848-179-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4848-185-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4848-177-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/4848-409-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5168-218-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5168-216-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/5168-224-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5168-416-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/5460-617-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/5460-560-0x0000000002210000-0x0000000002277000-memory.dmp

Download

memory/5460-559-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/5460-624-0x0000000000400000-0x000000000057C000-memory.dmp

Download

memory/5460-565-0x0000000002210000-0x0000000002277000-memory.dmp

Download