68ac609692d47e3372f18d45c564135bdc0724d9a0a69b589e258e6c3eb96ea0

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 04:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
Size 1.9MB
Sample261102-fa11wszzav
SHA256 68ac609692d47e3372f18d45c564135bdc0724d9a0a69b589e258e6c3eb96ea0
MD5 e947eb9110d09151b4ef175010da637e
SHA1 62996305bbd5b0dbae48a434f273a34ad876efa5
SHA512 5d2a189ea7b32d074698ca29c9d1dec6e0337e7dfb51d9588f7a908d1ca7ef8fba5d1dff0b1ce591d1220024682066395b512690786602ea4e7597631c1cca0a
SSDEEP 24576:caFDd70iTWCZfhOB95Dr47iJ0nQZo2vI3:BDd79WC9hOlciSexvI
TLSH
T1C595E01037D08136F1B329768BBFD724942D78715FA886CFA388162E5E706E1EA3571B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe

Executes dropped EXE 23 IoCs

pid	Process
1848	alg.exe
4736	DiagnosticsHub.StandardCollector.Service.exe
4952	fxssvc.exe
4800	elevation_service.exe
3068	elevation_service.exe
972	maintenanceservice.exe
3152	OSE.EXE
1752	Reader_sl.exe
5112	msdtc.exe
3192	PerceptionSimulationService.exe
5060	perfhost.exe
1804	locator.exe
2468	SensorDataService.exe
808	snmptrap.exe
2188	spectrum.exe
4136	ssh-agent.exe
4292	TieringEngineService.exe
2548	AgentService.exe
620	vds.exe
3772	vssvc.exe
3412	wbengine.exe
1132	WmiApSrv.exe
468	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\14929f90c665fbf6.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d35a0f98846add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a127b097846add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8ec5e97846add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cdf28898846add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f771e497846add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000747d7398846add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2480	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
2480	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
2480	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
2480	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
2480	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
2480	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
2480	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
2480	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
2480	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
2480	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
4736	DiagnosticsHub.StandardCollector.Service.exe
4736	DiagnosticsHub.StandardCollector.Service.exe
4736	DiagnosticsHub.StandardCollector.Service.exe
4736	DiagnosticsHub.StandardCollector.Service.exe
4736	DiagnosticsHub.StandardCollector.Service.exe
4736	DiagnosticsHub.StandardCollector.Service.exe
4736	DiagnosticsHub.StandardCollector.Service.exe
4800	elevation_service.exe
4800	elevation_service.exe
4800	elevation_service.exe
4800	elevation_service.exe
4800	elevation_service.exe
4800	elevation_service.exe
4800	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2480	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
Token: SeAuditPrivilege	4952	fxssvc.exe
Token: SeDebugPrivilege	4736	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4800	elevation_service.exe
Token: SeRestorePrivilege	4292	TieringEngineService.exe
Token: SeManageVolumePrivilege	4292	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2548	AgentService.exe
Token: SeBackupPrivilege	3772	vssvc.exe
Token: SeRestorePrivilege	3772	vssvc.exe
Token: SeAuditPrivilege	3772	vssvc.exe
Token: SeBackupPrivilege	3412	wbengine.exe
Token: SeRestorePrivilege	3412	wbengine.exe
Token: SeSecurityPrivilege	3412	wbengine.exe
Token: 33	468	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	468	SearchIndexer.exe
Token: SeDebugPrivilege	4800	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4248	AdobeARM.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 4248	2480	2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe	90
PID 4248 wrote to memory of 1752	4248	AdobeARM.exe	106
PID 468 wrote to memory of 392	468	SearchIndexer.exe	128
PID 468 wrote to memory of 1756	468	SearchIndexer.exe	129

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_e947eb9110d09151b4ef175010da637e_elex_rhadamanthys_stop.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1752

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1848

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4792

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4800

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3068

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:972

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3152

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5112

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3192

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5060

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1804

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2468

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:808

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2188

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4088

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4292

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2548

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:620

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3772

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3412

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1132

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:468
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:392
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RdrCEF.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
Size 9.9MB
SHA256 f07ac4a069b73f51b385d545c487cecde356b234ce7371d76118bb706ceed996
MD5 1b49437be615c97e930c172c8e9eba89
SHA1 d531a584e997a0ea6c328723a630100a4fbb0668
SHA512 c20d723fa9ee3df544583b448a52a57aff10a2a9d781fcc88dd536130837905c6d268da514d2ed3cbb9e91c6d30d31daa1839fa3569da8cfb6ee7311db7701b3
SSDEEP 98304:KrbT54hEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTU8rSex:YonfW/JLGMcblLheT7ek
TLSH
T110A6BF1D7BE21036CD732176AF4FA104E739D007A215C6977ADC83981FB1AA152B6FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Size 3.0MB
SHA256 f609b003467940e181bc6ec134ec18b934988948a49d0f775a5210a4e3bdc885
MD5 7d383d7e7f5ab983c23fb67903175ba9
SHA1 3d6af8f5d061fdc01da00ac175e3db0772bea97c
SHA512 3ef3318baf968520181606569c30979fca7d50c0f1d4351c073e1442a3901518fbc9a95b2dca38d8a32851ee1ebed6e660ea3af44a35d23c6a547aaac6be9aba
SSDEEP 49152:ATfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJThOlciSexvI:ATfiG/nzU90P8rSex
TLSH
T1B7E5E526A2C8C0EBE5642170CC59BBF900546D78DBA2CDD7BD447E16BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
Size 1.5MB
SHA256 dced9ae0cd82c87787c7affbaee40fa0a8ccb026410c3124ce8086cf9bf11087
MD5 5b326dcfac3a328daac904b5e0fe4066
SHA1 920adc2f777dc70f7ff254521977a5904330caab
SHA512 cd8e65aa8a249a4151835015dabd4d1a2dc89d54b618fe1b43d353cca1cbeaa73d465764404944a2777f9d3cbe541ec53befc2c2764441e1f0bd52675dfccc48
SSDEEP 12288:oFYVXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:GYNfhOB95Dr47iJ0nQZo2vI3
TLSH
T1917523477FC99F63E272C6B51EAB4B66C0BD6D609F411B939B00622EDC784C1857A02F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
Size 1.6MB
SHA256 4b50bb745f933b3c66386358e71b17140948cc0ed090139c01ee8c66caf41a2c
MD5 0bcc7249847b5bddb4532a16545ba7db
SHA1 00a5e24172001a64f210f3e9846e305309bcc8f3
SHA512 fd7d3eed4c17171c59da1bd4ac33532c1ddccdbeccb160f28ff32c3047d0536bdd33e0f99deada763d4df2204bf8f45268fee3947bafb0f03b9c879c5576e006
SSDEEP 12288:75ClXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:7SfhOB95Dr47iJ0nQZo2vI3
TLSH
T10B751210B6C559B2E77242B25E6FAB4BC01CBD784B6149D3F3848B3DE9340D28BB6563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.9MB
SHA256 87be8fa6486aa52c352306bdb6af3158a2e7c5966fa989eb4ed4bf399e7c7b80
MD5 09247b6003318e2654b899500dc5f0c8
SHA1 e0e17c3f003a6b9f2a3dc9a8d0404c92e85e508c
SHA512 521949f50fcc24857b10ce0e6a4f5c55362eb26e795cc3fb2a1b282a82648615d5402820917f30f2fa632074152714d3462ecbd2b002e969bdc6a2c08ccc49ee
SSDEEP 24576:VATAbD+OmeRfhOB95Dr47iJ0nQZo2vI3:GTAGOmeFhOlciSexvI
TLSH
T1FB95E01037D0C136F1B329768BBF9724946D7CB15F6882CFA388166E5E706E0AA3571B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5a86e87c40b16f4df1428be777e123e8957e5db633289d29e36408a8aaad88bc
MD5 8bb8e3d16cae4c930396ef05c6ecb8c7
SHA1 0c45ccbf589f87ecbff8c3a96a9011a6db1f4661
SHA512 a4d229cbe9d8e363be38fa247a25506ec50ef1f769d3bee63a7c36ce0472a7dcb18f511a9daaa4a366bbce9e345a8965729e04db714cc6afa94b403a5690d72e
SSDEEP 49152:5b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnihOlciSexvI:P3q6sjBz8rSex
TLSH
T171D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 b5fb724e3d10fd672e9f9d3ae34ad6b33efcb7eac0b697c5a2e9177a86f0fb22
MD5 10538edcf4b9075701b28612cd17e31e
SHA1 f3862ca4e141490d4e47355e445c45908d7a710e
SHA512 f5bda786b8b104cd771b6253132be5d0fbcd8e76ef5fcf0b8e5dc1f29fcf69aedb1c51a0f5ae3dd95f8b505c0f31db04187a3ab05c13515c0d3aed9839029818
SSDEEP 12288:31XLsswWkxy2lRq2czA3XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:lXYfDtczAnfhOB95Dr47iJ0nQZo2vI3
TLSH
T17185F12877D409F9ED67827CCDA28502DA337C9547A0E78B03A096395F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 dbf611a3bd5c58f09ec942ae32d39d08e56a0e5badbfdb17f031aa816d7c64dd
MD5 c985b2bd37f7cdc5b4f19853690cc20c
SHA1 7c2d3602c6c0f97823d824034f2206b56178b34a
SHA512 89841ae4f81118ccb4d6e798830e8bffa3a958b22bd35f275acae77728b61c473bdab64216dc45fab12abb2cd8f30a997581341255a80301455f5e8c6638aa39
SSDEEP 24576:K0Le5ji0hmxxrMOfhOB95Dr47iJ0nQZo2vI3:KPji0AjFhOlciSexvI
TLSH
T1BAA5AE15F6788731D073C0B9C5D2A68AED72308657308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2f961af22d5351145777038d95878141551550f0aa49fe82d687de4b9e2c53f0
MD5 bd8f6968060df4b029370baf662397d7
SHA1 af5d18d80d1e1ebe5efd27ac95c4fa7b201bc376
SHA512 62ce7a94ee279864e673739a575b6f34964530d064b0ffc6866b86124af31561189b40a29040fac805e1296a3173e17d99cc4c1f5355d3d8a17202af0f64fa3f
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWn6q8wyu0fhOB95Dr47iJ0nQZo2vI3://ezSC6vUzPveHjyhhOlciSexvI
TLSH
T12E755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f993e15be0f0fdc776106c9cd8ac733a234c3363a771a6970df5802e5b8b0c7c
MD5 fd7f955404bbbd085410971745eaf633
SHA1 ce973e9675d78dc1bc8df3f80bc350c7d2286e04
SHA512 f9727abdb43f4b05f0e07d87da5dc0cfa50a6b3c567f99a1b0b70207f3260413956535ff26762802bfaeb6138b5d31f1a9f691bd2af5a39709114d146348951a
SSDEEP 24576:tVbqPb88hv/l+YrfhOB95Dr47iJ0nQZo2vI3:tVO88hXl+shOlciSexvI
TLSH
T1A1559E65F5B48331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C3E676D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 12ded23c771f733e4e4e97bef80440af6a45bfdba3830dbfd676667ac607b138
MD5 009c3846365e3d3130162ed5362eb9f8
SHA1 9ef839b66150127366bf75c9e5865c3a839be1a5
SHA512 eac00b0114920b366a48f43aacd41fc0296c73d41410fc9bdb320c938892c0cf95d8361f5f8a4150da7a6caf695fe61b10f84bf8b1f47ae01bfc0086e4f6311c
SSDEEP 12288:aLMXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:aLCfhOB95Dr47iJ0nQZo2vI3
TLSH
T1E97523889FCC5DA2F3B7C7B97FAB8B03C8693DA494C11E539D00B26DE535455C2AA027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 0c7571bfb36de5122abdb967d6339021b7f589504d3842c21a7ecf57970defbb
MD5 fb774ad9f4269cefe74b477b127b541b
SHA1 1c11c81581503a73cc42f10402b347a0ae448a4e
SHA512 4838e8e5c9365c1f3f997b648474125671c566cce0bc4dc417ba0106c5fad7598f16deb7467204497a454a515b3a08219da29075542a1862f5af306f04be5abe
SSDEEP 12288:NeBNUbTVO86UrXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:NJIUzfhOB95Dr47iJ0nQZo2vI3
TLSH
T10985CF6BEE28FCE2C27A8DB85B918700D77278704B5193CBD164C20EDE235E55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 35c0941073b6c21cb288e1af81192e2eebd6b939de80d7414c1392a6fecda722
MD5 eaf7bbece05bba1f4873e1bc229335cb
SHA1 a13b3c583ce3a4ea470c9466aaf4889ceea41cab
SHA512 c740af72a897e6e17e162a29a22317a8e3053b3749618e1a294e34156874e88bd3d1e3a89361961bbb337b07b875caa95da0bd55c62b5abd6e83c372a061cfbe
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THd:BQvGAdlCEL8c/DRNw5CU8rSex
TLSH
T15F266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 7bb820505f543ef8b90c8713b736465b3decdf8f3fe0600f5c7ed63315e9f0fe
MD5 80d829ee840f0886ecbfc6420157d03d
SHA1 dad424f30fba1c7a880949c4437e4e75f0fa1e98
SHA512 ac4ec59b6745c254ced2ca8067df16d378b7c587d56b331327d0d14dc0e64aaddcf02c7d948c611be8b7b479cd12bcb98c3fc2d863a01d7863dc8a8fd9b1ccca
SSDEEP 12288:mAwSfxL/2Dc3RDLLmt0LDQewsAjBXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9k:70ewsAjhfhOB95Dr47iJ0nQZo2vI3
TLSH
T17A95E030FE74E436C3BB0DB61B36C706587D7D604B911AC3E3A89A9D99301D2637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a4a7b508dcc4bfa6018cb3299e5ab48c532363d87beee2a0526845767a4e27dc
MD5 de9a9a302458f1a25c03c19c52f53f4c
SHA1 2272b9c1588dfc35d006688621af6d6dcda154ff
SHA512 15e8cad3a9de3bebe8f893c882accc64980f28f45981a3da99d172a49cd62e53edbc6801f59a87ea786783824c506fd33a0ed722efeee27bfa43db59f15bf1c0
SSDEEP 196608:4UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH6ek:4UEtQevvqc2W1cpV2tI323k
TLSH
T119474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f401db9aec1defc488f752acc61babaca4ed032f360e473403267d24c554406f
MD5 5fb9768587d963134578832208c4aadb
SHA1 16962df58c5c9491e36f9f5ff05b600e7dce4d03
SHA512 add0f40cd1ea0fa1ddb33bb187aa97171926419be2b18458993b1298d27bea90935ef41373e3098583df47af3fb0e371b2bf572828b75b34eed270c00ef9c05a
SSDEEP 49152:yCbRquA/m2yL5zLfFiV+XenmE3/z1hOlciSexvI:Xoq2VjnmQ8rSex
TLSH
T1F6D58E0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f900febb7a6dd9ee1870e7baa945dd41b26c6e486c8a3bb98f1f029a6c123847
MD5 e9263c6b72e54419b710c33d7265c645
SHA1 ab5d438846279d49d623ceaee3165af38ba21a4c
SHA512 dacaf4ab7d38f8a109c1ab5b46f797484db2d01be1691a39d92d201ef119128f947c8febd64e805becb414e1e7da003f504f3118cdc3a0e90a0fefdecdfcca2a
SSDEEP 24576:NAhGL3IFoiwtA5l7S53gfhOB95Dr47iJ0nQZo2vI3:NAMUFoiq5ghOlciSexvI
TLSH
T11B359D80EBF955D4F5B3AAB899B68171EA76BCA95E31C20F2150D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 dfd18d9d330f489a55add8f55f114ce89d720c6776dd8b7b1bf5d65d456b2d38
MD5 6fca0cd9f16131abd7489a5fe39d94a7
SHA1 ea3166c653f66dbc84409d7fcff5b3c6a3dbe85e
SHA512 a37d5d6387d0f97a8fc7a0c04eeb06909773f640e9d389ee9b830827db83eaae7cdf7612703716ac4f62c86e8a9543daf088181a6e71da092c7ce922b43a932b
SSDEEP 12288:Nmw5HEjsChNVBFgl0WDm+CWXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvi:owu4OW9fhOB95Dr47iJ0nQZo2vI3
TLSH
T1FE85F14577E81CF9E6B782388A97C532E7B27C112A21CB1F1760C65B6F33261AD2D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 94d673f87ca4686cdeafffd581557e384d464a39f8bc469771ddbddd54f2ee95
MD5 ffe6db53310fa74bc75a918b52639167
SHA1 39f01b44f394174252aebacaf4d6006ab7275c3f
SHA512 f3325fc19505c51318665d0c6ae994633f06e810356f5fc0220571a6ec0deb877163df7fc7318df37859761d5d68a9065b3d16d9095e42f589838d664dc26cd3
SSDEEP 12288:MeZ1IyRXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:VZuWfhOB95Dr47iJ0nQZo2vI3
TLSH
T11C75128927D825F6E2B3827C9EE64A02C7763C65677143CF5A10826D6F339D58E39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 caf98c66f7ab5a18d8f56aa03666abe6eb42cab5876f0fd405e330efaea75f7f
MD5 89c298f6fb53f69deee97219cdb793a5
SHA1 2370984d4eae88ef2157152e618b81c9243d9118
SHA512 932f9d8338d591c654b34760e293f8b15d99c9ac88019aad5b4679113e6b224175d8d1a4677d479b17ba06756297eb97a2fb5760c6dabc3f05394ecd50858e62
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uh:nQRQyi36YOcPbLvw2gAf+PN338rSex
TLSH
T17A667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2d70674368a82d182fe1101370761a8e8881b18907dce4097ee15a4ecfc13c75
MD5 882e1e18d7ab5022e0aacaf13b3f83b5
SHA1 414373020c2b5db15ec3ff5f8111f9aac843cb81
SHA512 2ba350cd5fcf0cad3d9586fd11479df74498b2a13cc25fadf766bc81204a01af9ec4eed6130d0c86eaf7628a72cce645240e01dada6f9927f7af51b4a1ab3694
SSDEEP 49152:uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uh:dQRQyi36YOcPbLvw2gAf+PN338rSex
TLSH
T1B7667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 daf2cc57695ad29541b0a4e121bd8d892f2982312a7bdf496e93b33a8dcd4bcd
MD5 9fad984a3e31856c66906b3d8b27747b
SHA1 6366c9f5b4d1f9bfa80aac1820c38ee95f4cae89
SHA512 a1b6526303dc627a67c892f8b7d41b45a5bcafc362267eae6fcdbb179576004fffee26a6fee05f2b4e628ef7cfbb5ee8e4564f7f5b9b8caf2c6d4701c3216750
SSDEEP 24576:fwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0GfhOB95Dr47iJ03:H68Qg55nhceWu7PNU3/FhOlciSexvI
TLSH
T19EB55A33B2F600A9C45DE1769F4A872196D17C758FE0E3DB8501721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a4bf11e051a71ccecfc751254971423cccb0c1cd38ea697daaac723794b9074c
MD5 e66a9eda4d1ea1fe21c747d4e874559d
SHA1 73f6a9b22e413f75db8e4f0372395d21ba84fc6a
SHA512 69267261be849b417846add2f8669753d35d23316d11283949e10672ee6a9cd0c187c9adf55af8558ec5aa360d018493b5695e83362a682b8ec8c3efc6606018
SSDEEP 49152:D3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99P:Wy5112gYy5azzVvt69nLKnhZu8rSex
TLSH
T1C8167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3309307f8038f5aa0890ca7c9498c2ddb46742015c1942abde8291462b7f9e99
MD5 76e94c89018a66f345f96add59acdd5c
SHA1 2c95ca9936f0a6a79825da9e627a7f795e64def6
SHA512 7096be32e82f62c7ac1887d4a2db97fd62217f381c97cca7202febd36f7be5d0ac029e2f63f7ec6d874dcfa5179a6695560102c878fb07691ac8c54fbc47150f
SSDEEP 49152:eB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glPhOlciSexvI:Mu6Jmdxd2dP8rSex
TLSH
T1DAD5AD13F1DA01E8D06ED478974A9233E962BC490B34B6DF0A9073562E77EE4AB3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d26adaba9c9358696889e49b9f45d42b30349737fae5c4522f75fe2497e8541c
MD5 93ee91f0f604f976b6fd54823a9dbfe9
SHA1 6f2dd651ed73bdfb996dd64eedeab3282f53679a
SHA512 b5faa699ade8534445cf7ea537b983ccb62b1c497de0976626989deefccb188f3d7c61bd51e4ca03f141e2853fac4d46e431a752fe5f449cd01181460f190cdb
SSDEEP 49152:R1hpsNoJpF1A63U44CwH7R4xbhOlciSexvI:RmifPWRQ8rSex
TLSH
T1BBB5BE13F2D801E8D06ED17887569232EA62BC450B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c46ca59a2301d19b0f2b7181f544429243cb0af28932046e47c969ca45b73ed7
MD5 63e4c4a43f676646bac1dd2ad2d26001
SHA1 cd0e2a50130f4d332f13b6c18b6171ea9cf444d3
SHA512 ad809946846e029c7728f5bbb5d3623dee732160fc898b63808e0c2d2a8be31433e8fef440d3cc97bcde6ded8a8378101720dc4b55578e4c40af4898422bfe7e
SSDEEP 49152:dSuZQIY0Be2KcRVtOnks6NMHqyhOlciSexvI:z5dKii61y8rSex
TLSH
T121C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0806295a03be0c10ba6c918a8b65a6186b43b7e6fcb0f06586be6421ebf5dba3
MD5 f631ddd67fa557b27495b52ab0dd195d
SHA1 eb403785257dd9fed2d09a0d7c475b3234e5b08b
SHA512 8bacca6a56538eb2d05e9594c1798967e577602e0717bb20094520867c984c23d173a91560d4015e0818530ce4f49e8df3426f170b7f9feab7df4db19ed6c4a9
SSDEEP 49152:2htSn8EApI0fig3giDn0AP5wfhOlciSexvI:XX2imph88rSex
TLSH
T14295BE13F2D901E8D06ED178C7468632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 97e25bf9c79f95489394bd6bfacfb51e75071199238da52377782986cd3f0e07
MD5 67fa5373161c45f8c1d105cad8cb5368
SHA1 0fbf5c8dd10dd0759e5bb4c63b7ff95bc5685d72
SHA512 b56e6f8a194771b3ce2f6cef72245421119f3ceec8692acd361964df02e41a2870fae74c2d3486323d8f1c461090eecf9b4d09a317b3cef52d5adde3f5fb2ac9
SSDEEP 12288:1EXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:1qfhOB95Dr47iJ0nQZo2vI3
TLSH
T1C8752388AECD5DA7F373C7F96F9B4B03C85D3D98A4C10653AE00A22DF63545582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 8ada2b30734452ca3241da481a52bdf48d434f5ec5cc81d9afb62241414260d4
MD5 552e7e163ed30b1b78d5ded3a92d3759
SHA1 2b9dc6c062c65ec7fe5bbf19afdd30a936cca7d9
SHA512 bb49daeb415d8423080b8fd765d945b6adcf0f0b8803c7c453c49d8174d2ac5ccd89b33680a37ad06ce6e249b0624080bdbd46e9b1d6fd018ff6b386c7d05dfd
SSDEEP 12288:RtXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:R1fhOB95Dr47iJ0nQZo2vI3
TLSH
T1557523886ECD5DA7F373C7F96F9B8B02C85D3D99A4C10A53AE00E12DF635855826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 e927b0f2f8f57040c094468ecc32b23c85135be1b8ac9a6fefa540c472fad3b3
MD5 613c2a57417045eb0637c2c624969ce0
SHA1 23dc8db0e8da8bbd5c2dccc0da034d54fc38dfcf
SHA512 0b451023b95b69c5b0a8e5632f14c0b11550ff732a4d6fd57b223963eea55be34dae0a81cb5ef0c94f914f795085c9d39abe06aa79f983f21f33cdcc24f1bd39
SSDEEP 12288:5jXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:5bfhOB95Dr47iJ0nQZo2vI3
TLSH
T1F1752388AECD5DA7F373C7F96F9B4B03C85D3D98A4C10A53AD00A12DF53585982AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 15b479d64b1416c5ae04a0d18bfa4a7cbb0f64eaa590225f8d3dbb770f393199
MD5 1aa42842bbbb319a8ca27230932d3674
SHA1 859d8b8fba7ddad9f39dac30405c3f3d6f0098de
SHA512 5511ae977e2e16bff03dd6765b44ac6660eaca25cadb6dbbbdd012433c2fa6cfa61966949e3ea72f6345ce93868d5fbca752f04431a06cb4a638af2ca08eb1a5
SSDEEP 12288:UV6XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:vfhOB95Dr47iJ0nQZo2vI3
TLSH
T17C7523446FDC19D3F3B3C3B89FAB8702C4793DE4A6610B9B9E00512DAE316948679627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 b073e998bfdde96960a432201419e9915981b34b70a6a97fd3f37e6961666c07
MD5 b39a0061be35d9fce049c6d6572bc97e
SHA1 f56bb566d965fd0775fc439cd4f52747ef516460
SHA512 9efa28870dcd33393a8bf7e793da4a6449df4cc92eeba5ec0093c08972207ca4f97d405c2fb6c4f5f1d27a0c28977b922288b52bc7a77ecbe316b5a7ea3d6a3b
SSDEEP 12288:iCXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:i4fhOB95Dr47iJ0nQZo2vI3
TLSH
T160752388AECD5DA7F377C7F96F9B4B03C85D3D98A4C10A53AD00A12CFA35459826E067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 e5a54fb120c841d1a3a637831a7ddad69065dda13f88bd99624fb0a2bb7143eb
MD5 3cdf38ff23861c7538b9ec5c19da9f2e
SHA1 51e5895dcc64983f8e86cfd5d2459fe85cdf89e4
SHA512 b740acd725ba6d919c0f27bd3c92cc0fdce36f21330b942f567291ae9fe2781d3cca7a16e7329db6122b8bbb83b5642e16a8dcc288b9ca6c60791850e27ddab5
SSDEEP 12288:YZXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:YJfhOB95Dr47iJ0nQZo2vI3
TLSH
T1A1752388AECD5DA7F377C7F96F9B4B02C85D3DA8A4C10653AE00E12DF63545582AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 4b23c7ac29e59e44ef16ced49e3c3deba911cba5bea2f2c62e9415581cfc4007
MD5 f62dd0697cfc58dba12e37b389ab5b4d
SHA1 3bbcb7c7194665392b05c49db2c6cc9d3ca1ec49
SHA512 a493181c022ba0ed1c5e432eeeb0c6175b204e20dbf546da11d97934a9a0bff7b6108db12f3e0e068bc32a73f5347832e698d12eefedf75353c46526c88d8452
SSDEEP 12288:k1XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:ktfhOB95Dr47iJ0nQZo2vI3
TLSH
T1F2752388AECD5DA7F377C7F96F9B8B02C85D3D98A4C10653AE00E12DF635455826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 78e8b9762dba70f8161480e7ae5e13273f9c09be6d7eaf89d46a213593358314
MD5 20d41928394d3ab66ab543a55a5a4d97
SHA1 0611b71a60c3532c259000b3bbd7a04e197dc6a7
SHA512 1d66b6b4cb17d4f59332fa5f7ccbed09a6c797a177240561c7120e4af3d28f79ec3f61e6f34982ec2743428a8e417e507bdc9d7b1436bca9db66ae910166ce7a
SSDEEP 12288:FiZwbVzzFEoS2cPvyNXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:IZMRzFVSOVfhOB95Dr47iJ0nQZo2vI3
TLSH
T188850294B3941CF5ED73827ECD568A06D6B23C5907A0C61F17A4322A5F333A14D3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 a04be07d9fae02bb3dbd073933277d8cb511d4424584897cd9b68938249d2821
MD5 c9294bfa5e6682cf13ffc26875a005ce
SHA1 69529baa99a1542c4323962a75c79efd64054ab8
SHA512 7cce5378b855053d5ff1cf451005fd5b912de3e11d49142e4ba77ce16b676229e323d38477d58a0db999f48d6dbcc3b2de1fd23bddfa05fdda9d9332630d0960
SSDEEP 12288:vIXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:vmfhOB95Dr47iJ0nQZo2vI3
TLSH
T182752388AECD5DA7F377C7F96F9B4B02C85D3D98A4C10A53AD00A12DF635859826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 b06119bc9109424f59090b2e382959601866b5611a2bbf8e822474703538c047
MD5 bed046dc404679c7f9145cd776992ec5
SHA1 956bcb692d9bf55f4c7ab6ee13253822f1a118c3
SHA512 3c7bef00338bf4c38516558a5f3e528faf586ad80070a22a9d899eaee9aa417185cb7a3ab31451c7fa6d24b59dd333c6ff70edcb1b88dc7a01151d3cfec3c3cf
SSDEEP 12288:ycXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:ySfhOB95Dr47iJ0nQZo2vI3
TLSH
T19C7523886ECD5DA7F373C7F96F9B4B02C85D3E99A4C10653AD00E22DF635455826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 f3153f37bafd66fa6e08e13f8b4638df9525914a0ecedca0cee46ccb07ce91e1
MD5 fbe4b3e8c54b56e2cfa188457de5f3db
SHA1 0ade0068ee1469ac172ce60b934bad811bb37fc6
SHA512 d0d7f186a6ca08efbe08e121a4247efbb01d071573d761851c3dab952eae597228f8966c6a9fe5d8d76c286a5891b5e54d1b496671dba47a8d49c9049246a1e3
SSDEEP 12288:YyPz5L8RXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:5zyxfhOB95Dr47iJ0nQZo2vI3
TLSH
T12385024777A530F9E27782788DA30A02E7763C7547608AAF5750437A6F336909E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 d7ba5cec38fb309268204227ea5139d06d89ee42c4d98cc18473eb67ff47f704
MD5 45f3ac3a0e6c1e9623d1581b090593e2
SHA1 00851b47de31c6136e1b51f124a346a93d7e1efd
SHA512 3888ffafd4ac2d342d3215f09aefd53e4831fcd67e2660d5fef7f7b0bcbf4c05acd3b8bf45a9add04f49f492ec384884deb0fb666a496f43db35096dba03470d
SSDEEP 12288:nIXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:nmfhOB95Dr47iJ0nQZo2vI3
TLSH
T159752388AECD5DA7F373C7F96F9B4B02C85D3DD9A4C10A53AD00A12DF635859826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 ea40fe76fd38b3d6c1fdcbda23ba7727a805d325ada0934a276a4d3f6aaa8b81
MD5 9b5c1bf554c6253d653fbd2cd8a8c0ff
SHA1 6a99a94bee5b2d13375d52f36f3b74296c8481b2
SHA512 176cf4f72af4993e6cd11e07afb35ddac586754e877e6fef98b30115c666ccb0c81da54b256fad896fb26e10826a7d7ecc68488dd0ff33c82a7ce8ee9fe5119d
SSDEEP 12288:fbsf4XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:yWfhOB95Dr47iJ0nQZo2vI3
TLSH
T1FE750149D29802E9D16E92B9CB568A01F7373C6483E1D3CB57C0F53E1F366909EEA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 178B
SHA256 3306ef7f0f9f1d2d793cf1f886d2697448e88bc01e6ffaace80718f61d7f8c82
MD5 9298417342cc150d11e4e51b86fd4611
SHA1 3ce6e7da21e90455000af257df788fdccb95c478
SHA512 0e840f9883b5178183b2df81807fa0a35e8b5a16202dbce8c6139e8e00a08ee5ed9fee50bdfc3f3c524e53f294fb138744d57177588d6558f4aa3a99777755a9
TLSH
T19BC01222021E50590729008925AB3EA014A2AAB08B624AF972B8FF06A120823081B81C
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp85B5.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp85B5.tmp
Size 3KB
SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
MD5 bbb796dd2b53f7fb7ce855bb39535e2f
SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
TLSH
T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp9C7C.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp9C7C.tmp
Size 3KB
SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
MD5 ec946860cff4f4a6d325a8de7d6254d2
SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
TLSH
T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 ba007d1686ff7d91de9584278a96e934c216a6ada37da54721052527a71a3649
MD5 5dfa9ea68fc9deb72feba899d6689f62
SHA1 78769d25e699ee6673bcfe20efbc7e34d5bac224
SHA512 411e22e825335b03385c3e2ceae29b83a1b8516c3c961b99d9698c3724459f03597307560b48c2f7df9224a6efab242089a20931d5782f22126f37e9bb02d93a
SSDEEP 12288:kvXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:kvfhOB95Dr47iJ0nQZo2vI3
TLSH
T16B752348ABCC5D57F3B7C7F42F5B8B12C41E3EA89A804983ED00A26CF535895C67A11B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 e581ff040745db1324121d4c0801c4c10b425515dbaba1ec39d93ac1fba23e8e
MD5 895661f6e8cf2ac1d585e3fe56b0021d
SHA1 dd2221ca9035b4692105ad4602c381c8cadf35af
SHA512 c073fb345465f64e48fa88b6956be7b3f032aa4e7d873001de0b9053cb4effc26e00c8516b11cd1df9f3034d2914a418889699918d45a027b8f7600ad3a442fc
SSDEEP 49152:ra0h2GEkuAe73q3pp46zwwQdhOlciSexvI:ra0hNYG4JwI8rSex
TLSH
T16885AF1D67EC82B5D0BAD278C9A6854BE6B2B4260B3156CF1150853D3F37DE84E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 cde6b878e21fa8bc63b54c1043dd8f942feafef8d4c99d59192211e82884b4ce
MD5 895c2cdf72290d92dea30c89ec17877a
SHA1 41e1d4e2004a27c9614721ad78dd6af634b02051
SHA512 fb2cfd668c916e84216649434019db8e524afa3f837afc2379f6c65cb81048f2803c83a677569e9526865d4b871813c0e66e77c5340ceb0e137f221170c618ff
SSDEEP 12288:9hbHjfXsXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:9hbHjPifhOB95Dr47iJ0nQZo2vI3
TLSH
T1867512AD2BEC24DAF272D2BC9A968606C3317C64171153EF2680827D9F37DE44D39A53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 9427f8aff7b57c979f158b3bf28cf99db921f553501eb8f5872d725654305189
MD5 ec2a716b21c23ee84fdda535c619d821
SHA1 fe2ef6cb255e08c6c937de4f31281493b08d618c
SHA512 f669d36cc11779dede4c044f7c245c425cbe21cb42a36a437fd6df5e32fd361f3a737ee98e703ae95d6ad10b422020e91c4777ff3e438be620762ff598c258bf
SSDEEP 24576:73YgnJcRTk4yti+R5dBR/KfhOB95Dr47iJ0nQZo2vI3:7IgnaTk46pBR/mhOlciSexvI
TLSH
T13745BF2DF2B910B9D4A6D236450147B5FB71782D1F209ACB0170C538AF1AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 1c3ee4fa2b67596c83e429f90ea88830df03906cd767f52ebc261dad05e46bc3
MD5 3da16b0a38d632ae7f345df99246a330
SHA1 41628f9774959ecaaf2b93e069e7d9b91332f652
SHA512 8f687d6201b7c377145a2fca477c33b8a1eacbf2133dba298caba18913e86ca5e03036b7f60ddffe8a4dee25ede497f7394806013c8f4af6f74674571f61e516
SSDEEP 12288:uLXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97x:uTfhOB95Dr47iJ0nQZo2vI3
TLSH
T1DC7523886BCC5D97E377C7F96F9B8B02C4193E9457910AD3AC00E26DF6358DA827A017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 2d84708d73509bdbba9b0151aa384ceb731a19be70885b7884cff3dceae9231c
MD5 574b6ac27ed288f22090a63228f70710
SHA1 e85cc15aab1f5d544c5a4f75594762e095cf0ec1
SHA512 ac9041ce5f8cbae3874523b63a1c0d888760cda7a0be8de9e40a3a9b820d9da5f8618e1082ff5eb98912c860b79dc969f416fd2cdc34e6f91b849c2b79d30664
SSDEEP 12288:tObfA4LWOsvAYFTwXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:KbL3UT+fhOB95Dr47iJ0nQZo2vI3
TLSH
T1CF95F144F7D804F9E977C27CC9A78A12D672789D0360E7DB07688A691F236E18E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 c038e913303adb5b2e712c428fff5643723b8babe22418ec0fe715e31bc1aa6c
MD5 faae3cf2f48ee87035a6f2c26af30c12
SHA1 6d0401f8f2df3a5f01d9853e80fc75ee4c8b2cc6
SHA512 9484fa3232b4d93fff8ec522c59bf2578d73cae214fdb90c581bc4bfbc0552aec327b7e8e322113c0b303eeeb82644ad9985d27a72c3d2a7e323acd4509b5354
SSDEEP 12288:QpFtIO8XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:rOyfhOB95Dr47iJ0nQZo2vI3
TLSH
T1BC75011937DC14E5E276D27C8A97830AC3717CA5075217EF4680817E9F73EE89C3AA62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6a4c85f9c78cb9dedf6df7497c4d81ad3cafd2cbf901dd0ed954b71dc5bf2096
MD5 d032dd288d005dff5b6f4c648ee81c5c
SHA1 c8da55ad582a02f8a6b92cd46ee3fc3ab85f5c6e
SHA512 766f6924fdd0ba75f360da6c263d6d4cb060227e8e9f06fe049f56f50df29961a18a67d56ed18ac0605dce9dd24be3e103805f0a6ff8cfe8871a6963d91990ba
SSDEEP 24576:G7NM9YqZqmWMUkPjZM48Mv6bEhs/fhOB95Dr47iJ0nQZo2vI3:G7cBWMpPjN8DbEhshOlciSexvI
TLSH
T13065AE2E6BEC81E5D577D13DC9A28206F6B2B4611B318ACB1152833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 36675a7795750a0eb2cb6ab1e4c5f8bc1e8b0ad0efc3713b3544cec12ffe80b7
MD5 7a49febf5759539024a328ef17d59e30
SHA1 bf8a8ed848c163da2ca7eba17629382b5cfdb60c
SHA512 2249b330a1bf6a92ca15417b7ac9a5824bdd73a45dc0a0e608089ca7f022334cfab3122a5b404cb788d82860c7b17a8cf87310b9437f2a11df0670aba394e8b5
SSDEEP 24576:2W6BApg2YuyuNDYTabvcdvNYf8km1FfhOB95Dr47iJ0nQZo2vI3:2F2YuHNETovAvNYf8kmHhOlciSexvI
TLSH
T1F1858E6927ED80A4E0BBD2BD45B7D246FAB2B8511B3056CF0255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 ee3c35aa5ef8f177b2df36dbdca3e823b063716e1c3e75afdaece9c3ff4091d7
MD5 66560c78dd8dcce8bee48ada2371c118
SHA1 d1e4b53941e7c31f157c23f092f86fba768d7166
SHA512 51c4286bb5d8796d43ca11740629b1938d425d1c7297e431d7e14a9038ecf298808764581dc517530c9523f778ce135fdbe05f77882352cc7a0f88c2148762cf
SSDEEP 24576:sAFs06+OmlfkNXEbTomfhOB95Dr47iJ0nQZo2vI3:BFs060lwXu9hOlciSexvI
TLSH
T18E65AF2F66EC00D5D07ED17D8A97C91AF6B1746307215ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 2c9497086e8f45a7004bd95b39663e3403a2dfb4c06f88f4e160661a37a3ec01
MD5 f0e14de638f97391636b8b8975ef3b1f
SHA1 e9a03a469278ea909d2b2aea386be39add8c4e89
SHA512 e655a9805081976ac710d51771f8db38749c9426031056330287f3f1daa1e8dd94ce491ebb4f64d65f81b99b110e9781ca2e9933085c3916e07158065f6cfc4a
SSDEEP 12288:5CJnJ5D3VkrDzxfXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:QJnJ5D3WXZfhOB95Dr47iJ0nQZo2vI3
TLSH
T16095D02CD2A810F8D0B7C3B4825A1B46FE72387D2F226AC72864D5357F12EE09979F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 5250a1f411c56bb8e01d61cf23eff86d0148eca2e6f20c0f627c9c153a86d7c7
MD5 dd6f41bf5c60654f6cf951e27df00fcb
SHA1 a1934ef9cb04ef652c8584e05e97d4897aa5ef58
SHA512 6dd4dbc34480d2dc258224f2d1d6b8c7df49cd75dfa695eb8352ae357475c19726a3e7946d9b773b0bbb1b1d2ae3fda965a7bfb62b72cdb8a6555695e3b309b1
SSDEEP 24576:vEPghm6/7IIXdwcXrif7qQncjlP65i3VuEfhOB95Dr47iJ0nQZo2vI3:Ig06DIKdwc+eQnSt65aVzhOlciSexvI
TLSH
T113956C05BBEA5294E8B3CAB1CA6295169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 95b76684ad51d921fc1c61f7fae7fad32470fc8242a2534849bda7c1ddd72414
MD5 0c241a58ddd7b383a3a769b0ffe9a986
SHA1 91e1174e0000d6bfddafe828e89cfc5d7c7c185b
SHA512 f4524fe22c5cd5b9f422ebb18050073040d404cbbf2fc75b38efc2b9e8f63be9f80c6891e9c10e174202ac4110de3d39dec848b7a813758fafc7ca1482645b22
SSDEEP 12288:EEP3RnHXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:/n3fhOB95Dr47iJ0nQZo2vI3
TLSH
T11175125C2BDC70E6E236D27D9A928601C372B474275227EF5680C23D8F339E95E3DA12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 67d465764a4b014ab9fbcc2fd707521006b81aeb6461986e6679b9bef9303fd2
MD5 c803fe30bb2ec7b9b040fe0e0ff68240
SHA1 5741d9c27a855fce42d087d7fb5ad973d2a591ce
SHA512 f9861bd8d0238161156c3368b9a06dfbf1ec28b42af4f6b60588956565baab7d287367a76881e7b4df8349dce71f8cb9c2275d3efcd5ed7e3c6b9634951a2d33
SSDEEP 12288:9jkyuXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:9Iy8fhOB95Dr47iJ0nQZo2vI3
TLSH
T14085124867CC64D5E3B687789EA78241C9393C309B1157DFA480F23EAF32AD49939B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 c4ceb0b4ee5ed292304166af73f320a208260ff41271ad0b3e000b31fdd486f5
MD5 94806b8851e8f1b75b26a31e0bf60c03
SHA1 6b6a6b294f835e7493dff1570cc1c7593054da23
SHA512 3628d55f09e37ae97c907880c869c6e748adecd66427be68d8131f7d48d0cfb61f363c4c123c2ad5dcfc590f2f049301addf47484fb4cd887c67725f14d0c29d
SSDEEP 12288:9ysXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:cifhOB95Dr47iJ0nQZo2vI3
TLSH
T1E875234C6BDC69A6F373C7F86F6B4B02C4693DB4578119E76840E23CEA328D5827A417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 5f0a03c9d002eb47503b52c909b49470165e3aa164b82e3a20724964b1b50f4a
MD5 3c4870ad41bff4638a1e4898473a4928
SHA1 3035e69908861c83531c8dc58c71f9b321926e5a
SHA512 04b9efc3ac5328de932bd91718e363cb126ac11cf2e88b12ebe5b6dbaa1b8dce0198f3cb35a0a93d5936ace656d6d34e836bd1fb38ac7a6c80aec5e9e525c1ba
SSDEEP 24576:KQ9MxZKdcz9dw3nfhOB95Dr47iJ0nQZo2vI3:KVKZfhOlciSexvI
TLSH
T1E8558D2DABE9099AE177D27595A250C3A633B4301B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 82ac72452624743f9a1ced2b5e588ab143f6732c00be6229da1d01e13b8581fb
MD5 954878cf50c5911bfd036a2bdd7b2982
SHA1 fba8605458a5b2e2f55d373c3456d4d84f258ced
SHA512 e62a24e916eae34feafe3010d64244a031f55ef6f011467bac26b4e69bb50fa41e7caa8241775316310c8672db19da1afb42a43c49a1740800317e22b050ab5c
SSDEEP 12288:SyoKo2JRple9pqXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:SyocDApwfhOB95Dr47iJ0nQZo2vI3
TLSH
T1C785E00FBBAD40A2E176C23C89868745E77374705B6257CB6581C33D8E279E9BD38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 a281963962d8d550799d90dd09afaed2d0c35f7b6b61838a69569c6e6b2bd569
MD5 18596f68f02cedf96daa64eced2c8802
SHA1 b22dfe79dfeffafe3495f0b20858b9330eae9688
SHA512 7349faba93e076cc3fd8c1e0547f22b7f7e6edf96cbc7695ff619bb2ee05eae92b95b31077cc99810245ff662dd0b382c5d64a3cd315e453bda6c83a6b107c8f
SSDEEP 49152:bWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKAhOlciSexvI:L0zuNIK8rSex
TLSH
T179A57B3DA2EC00A9D9AAC375C5461366EA71742E3F2055DB01B0C57CBF2AEF19A38F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f1f3b23ebeebbe40acf01f672f6dbd8f8dfd99a472c8f73bfd40ad6f8ccd752b
MD5 d890a851c2dac6db8279151aac6b2520
SHA1 6969dfce807b322ee6f1cbcf9828f77c3fd533eb
SHA512 54c2428236afce5b21f2db2903f0d4182bcd00db62eea21965a4c1cf9c7ab7f06d3a7c8500c68aebd3d832c3697ffdd96cdd33370a87dddb0c98fcccc413509e
SSDEEP 24576:I1QT7EcpfxR+N5AWAz3ooiYujMqb3fhOB95Dr47iJ0nQZo2vI3:1TDxR+N5YzT4jMohOlciSexvI
TLSH
T12955B02EA7F815E9D1BEC6799B23C502FA727821033193CB4260C17E1E679D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/468-671-0x000000000CD80000-0x000000000CD88000-memory.dmp

Download

memory/468-598-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/468-606-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/468-638-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/468-622-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/468-677-0x000000000D690000-0x000000000D698000-memory.dmp

Download

memory/468-676-0x000000000D690000-0x000000000D698000-memory.dmp

Download

memory/468-869-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/620-824-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/620-581-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/808-547-0x0000000140000000-0x0000000140275000-memory.dmp

Download

memory/808-644-0x0000000140000000-0x0000000140275000-memory.dmp

Download

memory/972-168-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/972-151-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/972-165-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/972-145-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/972-153-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/1132-593-0x0000000140000000-0x00000001402A5000-memory.dmp

Download

memory/1132-868-0x0000000140000000-0x00000001402A5000-memory.dmp

Download

memory/1752-507-0x0000000000400000-0x000000000067B000-memory.dmp

Download

memory/1752-456-0x0000000000400000-0x000000000067B000-memory.dmp

Download

memory/1752-503-0x0000000000400000-0x000000000067B000-memory.dmp

Download

memory/1756-678-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-700-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-714-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-707-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-715-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-685-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-686-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-716-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-687-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-688-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-712-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-709-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-699-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-691-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-705-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-689-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-694-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-695-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-696-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-697-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-698-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-706-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-684-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-692-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-693-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-690-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-681-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-701-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-682-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-683-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-680-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-679-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-713-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-703-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-702-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-704-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-711-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-710-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1756-708-0x000001D4AA1E0000-0x000001D4AA1F0000-memory.dmp

Download

memory/1804-540-0x0000000140000000-0x0000000140274000-memory.dmp

Download

memory/1804-592-0x0000000140000000-0x0000000140274000-memory.dmp

Download

memory/1848-12-0x0000000140000000-0x0000000140289000-memory.dmp

Download

memory/1848-318-0x0000000140000000-0x0000000140289000-memory.dmp

Download

memory/2188-667-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2188-556-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2188-557-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/2188-550-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/2468-543-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2468-597-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2468-674-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2480-8-0x0000000002440000-0x00000000024A7000-memory.dmp

Download

memory/2480-0-0x0000000000400000-0x00000000006D9000-memory.dmp

Download

memory/2480-34-0x0000000000400000-0x00000000006D9000-memory.dmp

Download

memory/2480-1-0x0000000002440000-0x00000000024A7000-memory.dmp

Download

memory/2548-577-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2548-576-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3068-123-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3068-117-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3068-320-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3068-143-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3152-321-0x0000000140000000-0x00000001402AE000-memory.dmp

Download

memory/3152-157-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/3152-167-0x0000000140000000-0x00000001402AE000-memory.dmp

Download

memory/3152-163-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/3192-524-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/3192-584-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/3192-522-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3192-516-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3412-867-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3412-590-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3772-863-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3772-585-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4136-673-0x0000000140000000-0x00000001402E1000-memory.dmp

Download

memory/4136-570-0x0000000140000000-0x00000001402E1000-memory.dmp

Download

memory/4136-562-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4136-568-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4292-573-0x0000000140000000-0x00000001402C1000-memory.dmp

Download

memory/4292-726-0x0000000140000000-0x00000001402C1000-memory.dmp

Download

memory/4736-24-0x0000000140000000-0x0000000140288000-memory.dmp

Download

memory/4736-25-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4736-16-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4800-319-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4800-59-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4800-70-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4800-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4952-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4952-173-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5060-530-0x0000000000880000-0x00000000008E7000-memory.dmp

Download

memory/5060-589-0x0000000000400000-0x0000000000676000-memory.dmp

Download

memory/5060-537-0x0000000000400000-0x0000000000676000-memory.dmp

Download

memory/5060-535-0x0000000000880000-0x00000000008E7000-memory.dmp

Download

memory/5112-580-0x0000000140000000-0x0000000140298000-memory.dmp

Download

memory/5112-512-0x0000000140000000-0x0000000140298000-memory.dmp

Download