5a2609993f9a102c036258060d07fa47920ff5a6241d84de4a0b6d586b342e8a

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
11/05/2026, 10:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.4MB
Sample260511-m1rcpsbt3m
SHA256 5a2609993f9a102c036258060d07fa47920ff5a6241d84de4a0b6d586b342e8a
MD5 f815189ad861eba4fd21dafd43aa648d
SHA1 e94ee7e2cad858f7468c28f9be9b00ea4c9edd2c
SHA512 9f459911df807dde496627fc114323b5343837b3cb4d56af3f3102656f78b25ac039689ebe531975de9e6b26156f954a94993c15ac9cbbba268f243a3e2bcb31
SSDEEP 24576:MDF66je7AfYLH8AcevDN0FImbwQuq3Wia7gD:YFcAQgAT76sQuE
TLSH
T1F565022636D4D073D5B370350CE6E7B86AA9B8708F21838B3B801BBD5F35691C66875B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
884	alg.exe
4644	DiagnosticsHub.StandardCollector.Service.exe
4872	fxssvc.exe
3156	elevation_service.exe
4388	elevation_service.exe
3368	maintenanceservice.exe
4176	msdtc.exe
2524	OSE.EXE
5156	PerceptionSimulationService.exe
2892	perfhost.exe
1620	locator.exe
2720	SensorDataService.exe
1800	snmptrap.exe
2744	spectrum.exe
6096	ssh-agent.exe
5796	TieringEngineService.exe
5068	AgentService.exe
232	vds.exe
5600	vssvc.exe
3272	wbengine.exe
4900	WmiApSrv.exe
2728	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ab4013f6aa90c5f3.bin	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_186109\java.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\setup.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_186109\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d6ab46d834e1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e89914d834e1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d0c075d634e1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c4bf94d634e1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a981f6d634e1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050ce04d734e1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e50a9d734e1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e46840d734e1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe

Runs .reg file with regedit 1 IoCs

pid	Process
4636	regedit.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4644	DiagnosticsHub.StandardCollector.Service.exe
4644	DiagnosticsHub.StandardCollector.Service.exe
4644	DiagnosticsHub.StandardCollector.Service.exe
4644	DiagnosticsHub.StandardCollector.Service.exe
4644	DiagnosticsHub.StandardCollector.Service.exe
4644	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeAuditPrivilege	4872	fxssvc.exe
Token: SeRestorePrivilege	5796	TieringEngineService.exe
Token: SeManageVolumePrivilege	5796	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5068	AgentService.exe
Token: SeBackupPrivilege	5600	vssvc.exe
Token: SeRestorePrivilege	5600	vssvc.exe
Token: SeAuditPrivilege	5600	vssvc.exe
Token: SeBackupPrivilege	3272	wbengine.exe
Token: SeRestorePrivilege	3272	wbengine.exe
Token: SeSecurityPrivilege	3272	wbengine.exe
Token: 33	2728	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2728	SearchIndexer.exe
Token: SeDebugPrivilege	4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	4644	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 4636	4464	2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	79
PID 2728 wrote to memory of 1508	2728	SearchIndexer.exe	105
PID 2728 wrote to memory of 1240	2728	SearchIndexer.exe	106
PID 2728 wrote to memory of 4616	2728	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_f815189ad861eba4fd21dafd43aa648d_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\SysWOW64\regedit.exe
  C:\Windows\regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\config.reg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:4636

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:884

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4644

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3244

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4872

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3156

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4388

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3368

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4176

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2524

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5156

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2892

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1620

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2720

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1800

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2744

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5096

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5796

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5068

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:232

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5600

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3272

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4900

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1508
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2940 2936 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1240
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2968 2964 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
Size 2.3MB
SHA256 4b1e52530b038d7e6fdfe0849114571e632d53eaca8c2907aab8d601faac2a94
MD5 bf23b293a70c3d68a299a04a119b2a8e
SHA1 79f5f2cc5f61e38a8d5c12560efe2d6d6baf4587
SHA512 974f7a5f67c7bd47f2c674acc459a7340585d85f46b6fa9f9750f96622103b1c6e205e9031d6236fb54d85b2cbd010a14f64711a70710b70d069e393da1d4796
SSDEEP 49152:Q0X4/T3qDRmcQsqAU7BYYkGnAQgAT76sQuE:v4uDRQD0qGsQr
TLSH
T127B59D03F2D940E8D06ED178C756953AEA727C890B34A6EF0790B2952E77EE45B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 cb140ce0a090b334f4a1f70fcffbc63fc524cebe906b2de7b239a12e439c980f
MD5 bbef3335f7e83ef3dd533cdc491d16be
SHA1 f8a0a0342c15c188fc90c988ff5c3c2db5b58c4f
SHA512 dcc0add1b35ed90270a4e1b50c2e59bd25d2b6a8fc8db9736a4b4c36b0f4be1ef0aede6eda28aceea8adcce57004a820cb869a8316a72b90e8443345ffe71c1e
SSDEEP 24576:SXYfDtczAtAfYLH8AcevDN0FImbwQuq3Wia7gD:5tc2AQgAT76sQuE
TLSH
T16075F12963D408F9EC67813DCCB28515E673B8A54360E7DB03A49A6A1F332D85E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 210f25312e206ba045d1c0ae0539d26d33c94fcdd4e73cbcd6c8c273d968da7e
MD5 7cd5d3c2957867843b9b3abb22c53eff
SHA1 de022004b8f05fbb41ae022965532bba9767eae3
SHA512 c70e2f1b052f5b49292e0dbdcf9b457cb0397ec9bcb1d4c8fe2fb5870289bcd716c1412c3db5672571957d68c951dfd8922569bdc80bf3a048f8c4ae5b5bbeae
SSDEEP 24576:10Le5ji0hmxhrMAAfYLH8AcevDN0FImbwQuq3Wia7gD:1Pji0Az/AQgAT76sQuE
TLSH
T1FE85AE16F6788335D073C0B9C5D2A69EE971308657308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 818ee4fd6c615407f7b7171217bf1f4ffab53bd708cb62ca2c9d903ba0d0011a
MD5 8ed61d65ba37676ac9fdd972b795683f
SHA1 738ca321b9be1532059bec3bca9dcaa2ecdbae78
SHA512 0d943395927dbe4bcfb001f65ac769565a9725802de485899181680ce8b0b331f41f96f3fa0b2f9b1b9ed405bad917449c7de2e8887014ca4063984ad542cff9
SSDEEP 24576:+a7/ezSC6vUyD/aqgrvWj6q8wyuGAfYLH8AcevDN0FImbwQuq3Wia7gD:5/ezSC6vUzPv+HjyTAQgAT76sQuE
TLSH
T139755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 274adda4fb7d89e0e4accff1b8ed8e47d44e5c2efd4d91e6e644b57b5c235c2e
MD5 f658798236a41019f210c3ccb01ae08a
SHA1 1b9d821291c8bad74661827e02302296d8c5f6ca
SHA512 8affa0f73b1ea23ed6249afb71978c1ea3d0e63d57084edc41d726511b84517bc8af53d5d4e5bfa7961cc7daa1875109cb1496270e9479b66c86727370ea7ad9
SSDEEP 24576:8VbqPb88hv/l+BZAfYLH8AcevDN0FImbwQuq3Wia7gD:8VO88hXl+fAQgAT76sQuE
TLSH
T1D7559E66F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 aaf7d9312a031bb5a953d3c4c582ae4da7973c7dbad6fc67dbe8551b60da3cd5
MD5 60edde4ac92ecce9bf119c85324a46ec
SHA1 07fed396cf5641324437c87ba3166177de7793fa
SHA512 8985cc7d3c468dec28655b26ae6baa649af05ae434d317a6af12aba8237e9831e392c94f164d92afacee2cc16c807c81072e26d5442afdf9764e2a95f5f0e85c
SSDEEP 12288:NGsAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:NGsAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1645523578A4C30EAFEBBD1369CBBA5B963D1BCB88245979A00463BCA793D408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 57faff3a5870f1bc0ac7b79c413ee6fea58573d49f96607e4a0d91d1cd0915bf
MD5 1017aa165e7e7ca3bc7a80bcb18c17cd
SHA1 92f982f517b09c8ae452727ab737eb0d2e1d5aab
SHA512 4915b338e72cdc6b6d79f1e5b745e998c0913ae3919a173bf5d40e571943c48114bef691468e58517dfb5bb92559ede1172801503142b33e1e812ae770564620
SSDEEP 24576:rJIUhAfYLH8AcevDN0FImbwQuq3Wia7gD:rJIUhAQgAT76sQuE
TLSH
T1E675DF3BEE28FCD2C67E8D795A918600D7B278704B52A3CBD165830EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1560558ef82f91fc977f439320838aa24b14c4bd759819aed013eaa728a07ec3
MD5 10d817a70924225ffd57e5062c77f883
SHA1 b19556db40cf1196424bc7edf0e97fe1ec7fcda8
SHA512 7324187ed2fe0e9a367c1f6f8972ed69f86f285a767041db04a0c49623f6cc825c1213b7fb1b30aaf3952468aa7a7573b400c8c3dd6050fc8cd97bd174961dd0
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH6:nQvGAdlCEL8c/WRNw5CPqGsQr
TLSH
T147266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 88254b31cfe39ea5ad8291b9d42b4d8129fe5e3e1fb6ead94ac2099a8bfdf15e
MD5 882af52d78c108fcd053d522211a2320
SHA1 29054cc0fb3549040c4bdcbce55d9c31dcc15151
SHA512 5556dcb919c325e7b3cf271f81e0055c743e9203b9fb67989509f65662a7c14adc3d4b30338388880703c439a466d7d2e44fc8f51f46a05efed1a132b3164f54
SSDEEP 24576:dfewsAjPAfYLH8AcevDN0FImbwQuq3Wia7gD:hljPAQgAT76sQuE
TLSH
T13575E031FE74E036C6BF0DB21B36C716146CB9604B511AC3E3A85E9E59342D263B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 715c611d8a7a810e8256783c168b219c9221f603b8ed5ec096c3670180415eda
MD5 1a5fff42e7911dde7cb88aa85199eca5
SHA1 657500764d335f40bf1f766d018fef846360958c
SHA512 ed92df6390090c21a0d6704a05308438e8b4002be0773f6ecc6b5cd18d69321a1cb03333fa600bc73f9c15e7baa8913d4c3c52cd7f44c68c7236995d5ccf3c31
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHmj:MUEtQevvqc2W1cpV20I32
TLSH
T1C3474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 57f02f515866fd236516fda42be482b18f78ebd1ef6014399418eef1168e48f5
MD5 dea7c8900d2f2f20240a6270e6d81f26
SHA1 fbd604d585137f9704464af1930d5c664b78f83b
SHA512 908531cd34f816fe994ebf007171f9c0304ffe988d25cc7993bc26c6f2585ebe5fe9bbf0de421519412221a09a4e41ae4e1a6c497a8f47e928e2360458a694fa
SSDEEP 49152:gCbRquA/m2yL5zLfFiV+XenmE3/zvAQgAT76sQuE:poq2VjnmjqGsQr
TLSH
T152D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a015c1cf54252deceb45d424a5b6d51c1f6a65d7e2f8e8effe2dfc7a9e2a6c46
MD5 50664053b5e5fb922bc9da8de60d10bc
SHA1 573f50584499b167d7f5360244fbcf5174901861
SHA512 be6024d465ec4f4831d3c1a60975998461f18f607e70b13af992c12acac5160946b36a16288f253959cbc00078e5388eb8606f45e6d23158322837eb3dd21111
SSDEEP 24576:LAhGL6IFoiwtA5l7S53qAfYLH8AcevDN0FImbwQuq3Wia7gD:LAM5Foiq5aAQgAT76sQuE
TLSH
T108359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D20F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 112260608baf84c4ebfac6623166dedbfbefe28870721ad21aaf1f6a947e94c7
MD5 5cc99988e42dd9c44ead6007340f8894
SHA1 4447778be9dd7ebe2e9a9eb2a6ea517771cdb0aa
SHA512 49c127775872dbacd027afb024cada06b845e848a142f243de68157f288fe968fed6cfa588c6e2a77a8282bfbb70a2bd68a49cd583160752fd1e5ab81e697ea9
SSDEEP 24576:awuROWzAfYLH8AcevDN0FImbwQuq3Wia7gD:awSOuAQgAT76sQuE
TLSH
T1E965F14A76A81CF9E9A781398597C136F7F2BC152A21D71F0360C75B6F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 644da59833fc02c585a3723b410aa9998f9b2eaea0c92021890e2b1e24254f3a
MD5 24037919fcdf0b47e1ab278dbede3b24
SHA1 531e579d7d484d6c780966408401d1fe713cfc84
SHA512 a6c3b6503bc119476de0ec7a7c2307010b2a6860667996b9026899354945ebecc72bd04f03eaf608b3b2a371dada64824e908eb9a1fa4693cfb0bd6bb3c6a494
SSDEEP 24576:DZuIAfYLH8AcevDN0FImbwQuq3Wia7gD:rAQgAT76sQuE
TLSH
T11855125B239830FAE5A7C139CCF25659E3B278A6532283CF0115079A2F37AC59D79B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
Size 6.6MB
SHA256 fe8d0803458f21ffb7b4428c85290dcc3296665c8505eebe75e2042573e2052e
MD5 a904e3984c7c52ece38555fccdf1881c
SHA1 cae07073267d06acaabf004a36fe5049f15fd7b3
SHA512 5a879b79f51310c0e3ebca3b3e694f264d703ec95892049d1da3409544241ed0df0b9968d904e6a1e058966d5f0e4ca7716e770284156935a9969b9d746cbc6e
SSDEEP 49152:STEoba3y9bVILkmvguhO4NOP5PlcQKvfjBbPZi7H4mYwrjDDSNdihLuZykH8mYxx:Kut4LcLBbPk7H8SUY/P5h9rqGsQr
TLSH
T10E667D53F3B500A8E05ED9B4CF3D56229B757C4A87B092EF269436E11A72DC47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\setup.exe
Size 6.6MB
SHA256 707ed754350633920dc99f4e5351f6acec5cbab4c85bcdcaef56a900ab3059f0
MD5 b55acff996bd1b3e671ab69f4efc56d1
SHA1 dcd8a7b0dbdfbf86cb890f3d8562ab9b44ee7216
SHA512 3f1ff936e0a2af254224a4f49542b6c2ff5ac6084fc31a9153f3d4677ab207b5d20a037cdfcbcf93cf4844023ea5b7f340f101913712bdcf121c74d8a8930a27
SSDEEP 49152:+TEoba3y9bVILkmvguhO4NOP5PlcQKvfjBbPZi7H4mYwrjDDSNdihLuZykH8mYxx:uut4LcLBbPk7H8SUY/P5h9rqGsQr
TLSH
T131667D53F3B500A8E05ED9B4CF3D56229B757C4A87B092EF269436E11A72DC47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 ad5b9537fd07c999d5f6a88f678aa865ad1a9de4108b43aaef252463ca073e00
MD5 62dfe31165b9e20d8ca50419286738be
SHA1 4f32d5d2257afe5cd2280f1a051a11719cd76e4f
SHA512 dc7c8ac59122f027abd6f4d00b5fea7a754bc19057c8557c7b01572d6807dd9631e7cdc49fe6ac402a6d9eea176b55226fbc1d90fad2f14e603389145dff9785
SSDEEP 24576:NXHhwegnv8593atGFEtMUeRQt5iMaJgv4W2E4PshAfYLH8AcevDN0FImbwQuq3WC:NXenvGq2EtMUtLuXW2KAQgAT76sQuE
TLSH
T1F795483672F700A9C45EA0769F66473196D27CB1CFE0D3DB8141720A1FB29D47A3AA1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevated_tracing_service.exe
Size 3.3MB
SHA256 2b5650950d4cad8129c0f71378beba884525837ebd9e262c2974205e000c28c1
MD5 bdb72e5068ea65bc9f16aa7683391bad
SHA1 1eb0e7ae1ab4a18d5cf52fd7db1bde4f6605a180
SHA512 d3800250af5aa105a19937b4cece3393b65d10db1ba4634dfda8e971b93a65b288352f43af60b5a9b63ac0390a0db9bfd3b7161f90155058a9a7be4e81ed8c79
SSDEEP 49152:cFKbxUEEhQ9gsfxp6MZEtEYVnNKkNmHNNlCX0cXz6GfpksGLP3/NzAQgAT76sQuE:QKKsnZEBSkNmHNNIhj6MpkJYqGsQr
TLSH
T10DF57B13F29900E8E05DD1B8CB4A9632EAA2BC850B3576DF0650B7562F7BED45B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
Size 2.3MB
SHA256 429f42ac49e7a30ad971fb72455a7ff237e23d17490cf2a5a5cfe678959e7dc8
MD5 f04e3265a17fc91b700c941b1492c033
SHA1 4f2e78fbabbccbefa99cb5140d2281a8b2e8b600
SHA512 a5e481fc558d053532f0198f240b528a00d94e75274e175458072338ecd192297d4348f8bb0d00e407994d6b5fe917c70d5d2ec0361dd2f7a7ed5c9bd46f8040
SSDEEP 49152:D1xWevYkaNRxiCmSGAeA4msvxQtghSpONAQgAT76sQuE:1HPSGC7qGsQr
TLSH
T157B5AD07F2C941E8D06AD574C74A9236EA62BC890B24B6DF0790B2562F77EE45B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\notification_helper.exe
Size 1.9MB
SHA256 5b6c0a4f3caa8587f517f800373b9f3b8662ae7fc7d3a8566753b6b1ec0b87ee
MD5 d1cbdd8950d7790a7d375d0190f4036a
SHA1 0b269515bc1f71d166b311eb142d929f6b1c28ec
SHA512 699b98324e86ac3e81eaac41d17993ba81403c8bd645e6b2430c319f4920ed72828c000341a287b77e1e9f297d5d79c5e9adccb2eba4e98c2dbefab9ea14040f
SSDEEP 49152:IvAl59A9GJzXc0I65XPhvpAQgAT76sQuE:LzBI6lIqGsQr
TLSH
T11795CE03B29940E8D06ED178C7568636EAB27C420B34A6DF0698B7592E7BFD45F3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\os_update_handler.exe
Size 2.1MB
SHA256 153da31441563ef5189597d20b63cdd1c7a14ec1b40d2b185e0a5cd19ff104bd
MD5 8115ec7d4637f640a2def66def43b0ca
SHA1 e60f43dba0ace9e3441eb1f84468f9fe9a836cce
SHA512 3d22ea6dc12b3a7d213bfdd562f255d55c67e66502faaf36334bbd422e306c8963cdc4e07be77440edc001988ad7b616e607e689292ff4fd286e8ee5061f558b
SSDEEP 49152:AXZNoU5kqRZvvE9lDKGWfMhIAQgAT76sQuE:wFZ09lhWGqGsQr
TLSH
T1D3A5AE17B2D940E8E0AED274CB668532E9B27C510B38A6DF0390B2591E7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 45b4ce61e988937210f87bcba9ce7cc869bf6e2c3229ac4b275167facd02ffb7
MD5 acaf349fc1ea1210f504b6282223405a
SHA1 fdc56db8996f3b893c66a46eeb44da5564d06edd
SHA512 22e94f3e08914dbb0b6ce2f7a27b68fe179190d2167456a1b4e4ad33a8076ab29422f0766a8b99450b1803bee016ee28fbaa87806ffa7f54f32a5b1073b31be5
SSDEEP 24576:f09xwCr/8dMJlrNs4ff/TdskLV+gvnZlaAfYLH8AcevDN0FImbwQuq3Wia7gD:f0FrFp3n/T26V+gaAQgAT76sQuE
TLSH
T12E75C017B69900E8D06AD174CB668132EAB27C550B24AADF0790F3592F7BEE45F3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 09a64c384696e9d07c291c7a9bbe880c9a15fd7dfaa434513cedbc83784b372a
MD5 f7123903a697b9ec19633a9f8d25306e
SHA1 f865626058374ece3eafebf42f4d88c889fdd506
SHA512 b312abe3aba8e6af16b9d8085c5ae8d915db30a74b88878ad12e2f7e25c127f77e966e0cfb8f158625c3d9d0c228004ea3150651913e839027d5d0368b649abd
SSDEEP 12288:VUAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:VUAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T10F55235B594C70EFFCBAD1368CB7A1B9A3C07CBD9346939A110A278A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 95a3b9a1cc7d219941a2d837bc181d2fd393fcd76b7076f2da5db7682fb47fd7
MD5 a7e0c67a859cc2f2eda672dc9b3014f0
SHA1 4e1030fff681edc070ca714470fa65095dd7a966
SHA512 3288f9f887d28eb273010f32ed62f9a4628a2c6d95dd53907881fd85f1af7fe299ac5fb6d413dd6f4b228fdded1ba47b14f219372fc4229a9e01cec7ebd02c4e
SSDEEP 12288:4LAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:4LAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19F552357594C34EFFCBAD1368CB791B8A3D07CBE9346939A110E2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 9507d148b85f2aa1aeb89c930f4f8f189acd27a1983c630bb74954fc8368267a
MD5 fba8c3a7d735bf7e58dabff0524bed63
SHA1 b5938dd1bb019446f808137e4ca9949000d18ee7
SHA512 b3595a4343db431f49d0e9e5a490f65d1a44c9d5a52ee15254feffadc0714e99e46d6d58c4689cab1c255bc1cb35ca709a5604c3f18f6a21f683d2be12d085a0
SSDEEP 12288:IJAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:IJAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15455235B594C30EFFCBAD1368C7791B8A3D07CBE9346939A150A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 669294b05c53cec51e444dde65799aebc2d1b19087f867a96b6d822b2afcd277
MD5 f0f74da946266ffeebfae87a85d8c4b2
SHA1 17f9dd30202a781664f6e27209e1b478f1300f25
SHA512 704035ef13d01f74a221aef7b8d465a07ef42c42b3746ef0ec197a2f20d595b27e14c64c4ecd541c59cb1f68ff9ebbba9a30a9d2ae19cbd2312a3a147cb4064b
SSDEEP 12288:FVKAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:KAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1D9552357165C20DAFCBBD135CCB791B9E3E1BCB9931293DF46011A8A2E3A248D1B4E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 17e4fc63b0137d035fd006c439e31e146809aa426c809edfff4f7506aef4a017
MD5 3579c17ce2de0b037771e8140f0a2017
SHA1 51fadaa2988ad1de7720de60d6ca3a240c68a1f4
SHA512 ea92b156ed2f14bcdcc30acddcabf5cb95aa5cb582aea69786f6db82d63d21182f3fb9c88f04a50dbab7e521242dcc1306d9a37d23989ce6948a6a76bcb05e22
SSDEEP 12288:riAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:riAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T144552357594C30EFFCAAD1368CB791F8A3D07CBE9346939A110E2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 30b089e17e66878984caef58f2bdabf1a986a5b545010e733ecec65697e0511a
MD5 7e9aad1daa918716444329ede77561e1
SHA1 2c941909eb60b3cda9ce301a92eaf3b8eab248ae
SHA512 79f5cdf16903ee6620546fe7d5b91ec8ca7a3d446e32a12adb2c760ebaabc45da47940111f9bfcef616429fd12700bbdada6022bf642dc3cf91396dd51863fc6
SSDEEP 12288:T3AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:T3AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1D8552357594C30EFFCBAD1368DB791F8A3C07CBE9346939A110A2A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0f045e8f759923752b8e3fce0a7c7c18eef8d60cbfc2175827c42146b2142ca9
MD5 c17e65afffc415012ae6a9b99a7c9cf8
SHA1 f3636ab925f5eeed890ac49bfe38877fe407d33f
SHA512 5ae6decd305695e2122075e7170ace3cabdf24b43474dcd09e71383d3a7fb83e8dd4c83c98c8c5ef58bf13cb30c5e60287b4f382c7c02de94f1b93433c4febd0
SSDEEP 12288:UjAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:UjAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T18F55235B594C34EFFCBBC1368D7791B8A3C07CBE9346939A110A2A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 e96a27705e3a9633e524275bd1e1ef5bc31642e65c52c3680fdf9efce82dbc46
MD5 c4d9a8785457384ece98f2fe80239738
SHA1 8b86e79ba1e0a6d013142500fda05625b5390554
SHA512 b00a7157fd7036ef05561378f77c38a2884a720c15747b8cfb18e7c4b5fc5388fecd02dbf43473fd36f8224bef269f5b60e6b37ac2808a5a423fe6049cb2242a
SSDEEP 24576:PZM3zFVSOrAfYLH8AcevDN0FImbwQuq3Wia7gD:PZM3zfHAQgAT76sQuE
TLSH
T1C3750195B39018F8EC67813ECC668916D2B27C6A0760C65F03A4366B6F373A15C3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 7e69df63e744ce6a12f3f5693231301a35b6fc7a5581734b070dafa61d331d7a
MD5 4d7070dde03b36a83d6e00b1e7253527
SHA1 ae30db85a901a7354c2c14537c54c491254630c9
SHA512 0a8c2640f308261108c6acfcfacec3772d5519f800aae50e5a56e26c18d6c4f259cc9a15a94cd08d243f57f41e5b7358fc6fe0ff40f88739108d0f50c441cd96
SSDEEP 12288:tYAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:tYAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15C55235B594C30EFFCBAC1368D7751B8A3C07CBE9346939A150E2A8A7A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4130e245f5d4710187b9f221ef9298e7914d5cf9aadad77784863e042ff2f50a
MD5 4bd8ea7b6b94be661f5647727c07edb7
SHA1 0b6fe6f70fd2cb54f60554ec71f905b43323b018
SHA512 fd87dcdaa3862abaf82e28751431eb62d791f42869aeb9d3f02182e5004053c599d6b0094839ba872c4e8488513fb9d3de7711b3be3458ff608daf2cbf6a2fc8
SSDEEP 12288:q8AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:q8AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1D355235B594C34EFFCBAC1368D7791B8A3C07CBE9346939A110A2B8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 6f1a1911f60f738f761be88ebd808ddfd425b400f087c7a7d16fc07a94a28764
MD5 92a0b3e8686acbf9b1ae29d7dffadf29
SHA1 34589b604c647130d2b5ca95c13979e19bddcd37
SHA512 4f0e62b96f4c33614244289286aaa0b81afc12d6b2ab6345a3e55a62d1093faac4ffd74f33988b8324ab73d833157c2147444a6764e157945c59fadc9701b875
SSDEEP 24576:6zyfAfYLH8AcevDN0FImbwQuq3Wia7gD:6OAQgAT76sQuE
TLSH
T14065014763A530F9E577C239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 99bcc9072497b4d95f0fe4dcdbc0359a252681c180d63af4c4a937451d9374cb
MD5 525d8bb1735164eb3725afd39986cd00
SHA1 082f2ef32a7f579a356357ccab2c6c59afd2f0aa
SHA512 d922055db2a7d86aa9c4131627f9967ed19aca3c55360fd962717e2f7e931a300f51d8a24f87dc1525f5f0f3a8f29ad16389393f25b730c030417456c807627b
SSDEEP 12288:eYAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:eYAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19655235B594C30EFFCBAC1368D7791B8A3C47CBE9346939A110E2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f10d8c7588cd011bd803b120d6265b505db398832cc76d88e0489558eb9b145c
MD5 70b7de8f5dcdbc52f64dd11dab8687ed
SHA1 c050e336a403c923ce992bc55371b0a9a7d1f74a
SHA512 d4b05f0631558715b4bc7b6bef3e36be602f9d46ad44b776cbd29fa28f0315fe330b611ef216f8d34b5f5971a5e12af3c15b226115119f0bb8d7e73e883dd494
SSDEEP 12288:/YAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:/YAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1B455235B594C30EFFCBAC1368D7791B8A3C47CBE9346939A150E2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 725812d6ebb70a6085450a339f98f0a629ec167843ea1ebbe31b619e5a672e76
MD5 abdef9adc226afd2a6558f6c40371c3f
SHA1 ff42963f7ceb333819e4c8d14cc35ea0fdb40b01
SHA512 4e000a9ba83449a96f86907a2fd008bfaf4a066e0d41afbfc214a885290e7eee67f89ca9b33ffe21a434eabf4282549560249bca189723061b353e94cf41fd6c
SSDEEP 24576:0CUApvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAFAfYLH8AcevDN0FImbwQuq3D:0CUAPTY+8Wg2lIL8lrIUJLWwiAQgAT7o
TLSH
T13365BE1EA3DC089AD4BBC1358A518A16EB72782E1B22D6CF1160C37D2F27ED95E35F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 2366c89cd394eb2fa22f5c43a327a0bc6c66de77458d05fb41ef574046812efc
MD5 615feb48ff678c22a0bcfa5c09026569
SHA1 75e8e3adbb29ab423226c5bc84fea3a215712e18
SHA512 9179be9afa2773bff7010563b6cb779f8a41c2d27e90523e66117d76f80821855efa6a34c68678c1595670b7b5c40001e96c7694e57666f06b9f2e7274d8fb2e
SSDEEP 12288:IpsfIAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:pIAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15465011AD29811E9D46EA135CB664650F3737C6983E1D3CB12C0F67E2F3A6809DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 1cf5731be60c842954cbad5eccf44a5904713acd8b8e7443fb50b401b24568be
MD5 b13d2e7e6753f30f612474fb53319a0d
SHA1 4e116d9a503551400618391572812b696f4e3b55
SHA512 1217e16e2db66f98e66afb1cd8933582b16e5082748794a1efd4cdc3df3b21d552f2ca9a6ba9f7734789d3b8de8ccfe2e4c943848fb5ed2313c6d19cbf36b33b
SSDEEP 12288:lpAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:lpAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T121552357864C74DAFCBBD231487B91386399BCBC870592DB640A27CA793D8C8D9F4E24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 bbca35b6eb0de65d360508869241b66917640076372bac274255cad86bbca962
MD5 6e60b0366bcfa9800ec5584a34c85a75
SHA1 c850262b433b1eda9a190b3c1c9e25ab2e1bc79d
SHA512 906d37c7ded1858fce57456fd0d2e1eebda10c4d217671407b219fcafaf2df21a8cb40b36fb147e005bbb142a6d6b2dea4cafc9718cd796b4fa599948e7fb07e
SSDEEP 24576:X8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCvAfYLH8AcevDN0FImbwQuq3Wia7gD:MRZwQCyiHiQEaaPnMgAQgAT76sQuE
TLSH
T1BE85BF1E62DC46A5E0BAD278CDA74407E6B27816473197CF0191C27D2F37EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 b01af0de17afd2c22c806a96cb967ed14783562c99110958cadefc95167412ad
MD5 294bb9b880775880302e42c8f174d9f8
SHA1 9f3df974ec062e8ed253d1cf5bef8a531234f032
SHA512 b79110a7d4a9a9eb92cd175b8483cb176122db159817b08e6b42cc91f516155946d11c3e387fbd4411dbdf84fadf0b14bd7bc56290dbdfa6e1c2dd76a4ebe770
SSDEEP 24576:DbxA1UG5AfYLH8AcevDN0FImbwQuq3Wia7gD:DbxA1UUAQgAT76sQuE
TLSH
T10155122F569C24E5F5BAE13988A28119D371BC2A531193EF108183BE1F3BEE89C75F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 44a2f209ce5b931585d716b4a955329811eed56a22176554f3f8dbdb0e3930ab
MD5 4e57fc8ba071aea0ef5d44d1d16e1e7a
SHA1 e33a000eab4d30d940bb10d8ea34cedf4c00d95c
SHA512 aae1cbfdd5bf2c730bf193dece9c6b8b31432fe154f35664e13d0fed2fe77466bfe0549702e7926baa4898b04ad4f00117bab9b6c252fa391f83eee68a5d25ad
SSDEEP 24576:UjsmP0yHaqrVqHra44KDzMsrnaAfYLH8AcevDN0FImbwQuq3Wia7gD:UjRP0yHfVqzlAsrnaAQgAT76sQuE
TLSH
T18B45BF2EF2B910F9D8AAD136454107B5BB71782D1F209ACB0170C634AF1AEE89F35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 7e1dbdf482a219b0817b9f6d2cc4e60f5acdbf0f99970d4f80ccca716daacd3f
MD5 a76c2871c7bfcad7522fbbd9cd5e5f49
SHA1 2fc9028a8844012afdfdf3ab271ea5bdf4ab1a5b
SHA512 f164331c457f54324ba305e2e2fa2cdda030020faf4af93381c28438bd2fc10763b26c379d0fbbb4f0c00636437abe75d064a897447dec131df81030eb5a70b6
SSDEEP 12288:wXAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:wXAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13C55235B564C74EEFCBAD136887791B863C07DBC834693DB100A3A8A7A3E499D1F4D60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 097978f4bfac36d951de570fe51d5f612cad73e4536a2dfa74b56883861db750
MD5 aa157b630c15068f24ee2e814f01a92c
SHA1 39e5ac131033abb9f8a835d1af3ad120e52379cd
SHA512 631d12e34d83bada5787aba13b581860e0abe1ea80629e7a5ded39867fea5f925da3ffe848f6875714ef164d3e0084cdf8b2facb7c38eb8c67c0718b2e3c6871
SSDEEP 24576:uALBUTtAfYLH8AcevDN0FImbwQuq3Wia7gD:uALBUhAQgAT76sQuE
TLSH
T10875F155E79410F9E87BD13CC9B28526E2B2B86D0354E7DF03A84B551F236E58E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 fa7d1b5abed393868e77f8f4a412a28226f27ff5fe8815d041c9cdf36d256861
MD5 da26fd3124aa7db8822d43dd64c53ca4
SHA1 b309255935d28f907a5f2f2c683c0342105e52e3
SHA512 c47362ea93807ed6405750bc8beeb69cb1a12bbb9f0f287faba98b0526f548dff5e802e5d2c6d4bf05d4b70219e67925e76e3b09de92b7cf438c5e4da004116d
SSDEEP 24576:1fYNHeAfYLH8AcevDN0FImbwQuq3Wia7gD:1fYteAQgAT76sQuE
TLSH
T1A465F12F52AC18E5E57BD13D8AD38219F2727866131193CF05A0837A1F27EE8BD39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4d5b03a7a5650f3adf79dc87eda04dc4c0db1d9accb6d81994b12bb7b92872c8
MD5 e6b077014f950f21e7d5fe37f8436ae8
SHA1 e17be7c9a5f27c968d42051c65b1cc6505c09959
SHA512 22460f76a652d26a039f74f51e61ad1dcd466e991d0b2dfa8510cebc17cc7e2dd659ab8465974d3cdc00e636a51db6b592bb58ff705f21609d00d356dd1410dc
SSDEEP 24576:fnXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKg:fnXoJJYH84VVS6AmETJas+cHBjSSKHPQ
TLSH
T10165BF6EA2BC04E8D5BBD13DC5C34506F5B178661321C6CF026182BA7F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a02a33f0a9ddd1cb847e13ffb9e5870f87dee8429c112e2a0265095691f356c4
MD5 b08a9d5d754e3d1fc537ef514705d2d9
SHA1 b90e59a603e1a9b426099dc4bd810aeb5437a340
SHA512 bf32fc8ed28d5021078d0e6b1c162ad1c93e7515434a9b383c08095e782c8effcfa79df5957bf337c9989cb9777f1a73633924e4a7fbfc57a06093821004a336
SSDEEP 24576:2v7Xbxd9Tuycf8M/TYlSuxwr2PCMAfYLH8AcevDN0FImbwQuq3Wia7gD:2DLL9TuJ0M/TYW2P3AQgAT76sQuE
TLSH
T1CC858D5EA3EC42D8E4BBD6BD85B79046FAB2B855173081CF0251856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 ba29a2f35f090f9cc2e4f112182fbd4fee0d8912e58cee3ebfc6b539e1c6ed7a
MD5 0ba847a464871aaa103f0b581637a44d
SHA1 a7658ae3d6eb104cd4257700df422a9361beed38
SHA512 a226665e6d6e6a33a70d661ba29fd76320a8a19b63b94844d9576ea4ac0f2d2daa4a1732563f5799ba7e9203e4d0e055f1da601acb710316fd2feb8ede7a2c60
SSDEEP 24576:aegJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10wtAfYLH8AcevDN0FImbwQuq3Wia7gD:angOJOmPOHktAQgAT76sQuE
TLSH
T10655BF3FA7BC15D5E07EC13D8A978916F6B1782603255ACF0160827E5F2BEE46E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 ad98b8980e71cb661b467ca9b537442e85b9c5ccedd26a6901d8bb111c38ffb6
MD5 a11d81b329f4fc42bdfd80c5af86edd0
SHA1 1c591785ec00b285699a366f8db3463ff0e74686
SHA512 57b7bfe175601cd1716b79ebc9f60301233b501cdb38c41bd5d8dc874a89e0d7f665d2838aacf6df6f7ffc00d6806a67ca17f0483898e55d21eae6586842dfe8
SSDEEP 24576:TLJnJiTk3R3waE4JrO3AfYLH8AcevDN0FImbwQuq3Wia7gD:TLJnJK8R304lKAQgAT76sQuE
TLSH
T11975D02DD2A810E8E4B7C2B4815A1766FF71347C2B2169CB19B4D5353F22FD0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 0f55b6ebebe2cffdde175d3c650d47afe8a2738cd34f2041bbd2aaa8adddef99
MD5 f58494404956bf569077ca2dc955515f
SHA1 37c07797bba565c3ace2da3ed5d700d0bfa897a6
SHA512 570095619f02fe8e804a0dc9d7394093e227801a66625696d37b4ad5d0a4885e7e0b7cd47b3771a0518aedc5a58d5a7a7d92cc1e949827c032f338dba76f435e
SSDEEP 49152:L9GqCzDScAZmlvTcFg8Ph6jAQgAT76sQuE:P3qGsQr
TLSH
T152955C05F7EB5298E8B3CAF1C96694159B327C509B34F7EF0A80CA6A1E32BD1D534B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 f5f8d647c2fa27dbf466a55ccc230c75aa5342acc9976813fe7e8637874eddc9
MD5 21b8e015d687481dc4d7cdac35b3bb44
SHA1 8907473dc1fe1c71f0441777f740f1f2efb1e1ca
SHA512 1d08762c6c45305148861b34a033ac591b2083cdb09999c2980675bc6e607f853bc4acffc4a393d23fbd2afe09e4a0e8c46ad363c4b03b6e3d93dc0f5ca8e494
SSDEEP 24576:ZlYJeXm5jUuE9AfYLH8AcevDN0FImbwQuq3Wia7gD:ZlYJeXmRUuE9AQgAT76sQuE
TLSH
T13955125E269C30E9E57ED03988B24568E3B1B4B5530263FF01D0C2BA5F3B9E56E78E50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 4cf782609ba67b4228e35282f2e49022a6eee4fb3de5c83ab900e37604c86eed
MD5 9e9e86aec4dff95158ba40c7df73836f
SHA1 acd101467182454046eed5f2c9463994559414a8
SHA512 fec4bb6022f37b850938e66e1f5a20a3b648733c9d9e7a7b57e994b3a539ed82f90617680d53b58275fb0a6affeb0d90177bb64f46da8c5de9014e369771367d
SSDEEP 24576:8Vty6AfYLH8AcevDN0FImbwQuq3Wia7gD:8Vt7AQgAT76sQuE
TLSH
T1B5651206639860E9F9BA8538CDB381B49B75BC748B0193DF1091B73F6E3A6D4A570F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 5e60b37e6a01c9245014a5d96420d9abdd5e55291604bc174c90a25bc1618d71
MD5 45e04699f4f55b8f03d326a068a16d30
SHA1 bcd46d076ae48071b42417f1bf7e55deff75aee8
SHA512 025ab268403689dcad3a72b99304fd29002e9a1c5c8bef54523557ede517474868c78ed809d3970c8decc2cbdc63c13c219f8dc6141ab2425ae99f1dcc553213
SSDEEP 12288:GPtAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:CtAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15555235F065C30EEFC7AD135887755B8A3E17CB89301A2EF1085A6BAAE3E485D1F4D24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 b71663c5423a983dfccaf7f2d5da498a72db557d57139bc0807ac0ef012531e1
MD5 d1a9c3bb80f3f100798c0554baa62408
SHA1 e285c83e8255add86b90691d61a6ddb4a045d079
SHA512 3c4f6ec4e9de1926c16bb5619c2aef5040e3a099a20a0bd0d3c9fa5f0cb254027ebdbf351f74244c1b1d7bebc4666d3153f6dcc898e167084880669e8e2a5fc8
SSDEEP 24576:RC+TyQIu93VAumZr7jmoAfYLH8AcevDN0FImbwQuq3Wia7gD:R/TfIq+YoAQgAT76sQuE
TLSH
T14D558D1DA7E91DCAE276C675C8A34493E633B872137186CF2044C17D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 3cc9e6cc17397c5d0b1ad89ba4353d52f5b2106b7e6ede9cb5c42afdea0ba630
MD5 3529339aac76ab097078946eb945fb75
SHA1 83f1cbd4540764a49671ab59e8ab6666534356ac
SHA512 a99afa3b464500e6f813af80e526d34693c9ec30f863c70cdc4ec8041538b6b0a4abc9f7edccdea28d4399c3332e2d5677c8296b9682344a988b16c71fc8a6c2
SSDEEP 24576:KLQikZRAfYLH8AcevDN0FImbwQuq3Wia7gD:gQikPAQgAT76sQuE
TLSH
T16265F00FB2AE10A6E4ABC13C88964166F6B37474430263DF0290C77A5B7B5E9BD78F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 7fb9c3e0dac8bc3eda17c779a28cb313d485858ceb0e5e1132accaaed6dfad3c
MD5 43940d18333bbe0c4a2ed497c0b6f184
SHA1 ec89ae062a0f21778c8eb25abd2d8bad273fbb65
SHA512 01c21d3d5100404e576e59082b000c21b087347fb8a3c315b6c761f0ae1e5bf39026a3d189a3248c77358a485b012d077cf9928090523cafe3e8e5282e5f4370
SSDEEP 49152:7pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP6AQgAT76s+:QpC7b4+80GTkAqGsQr
TLSH
T113A57C3DE2B810ADD8AAC375C5461665EE71382E3F2055DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d3252b9c55d0f7ee9415186c1e27d304dd2e60394d4693e8b274d2e17826c9b8
MD5 4df797dc4de5b713dc57c417910d794d
SHA1 15dd7230a513aee4db04306e3a7d836ff333852f
SHA512 9d17ab27ef7539b2c0e7d5e600d5c7b394afd3aad12aafc945c9a6981b21b7f5f414501060e258034a5e0ea5550f320751b36c7ad1245ba28d17cc4fe3acfd1a
SSDEEP 24576:ZSAwJPE1IDAo+4Kt+l4413lUQCAfYLH8AcevDN0FImbwQuq3Wia7gD:ZqPCIo4Kol4jQCAQgAT76sQuE
TLSH
T14755B02AA7F956E5E17AC774C663C611FB727822133163CF4290817E0F269E89E79F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 91ef19c55f5b6058d59b22bc19dcfd77d7146e57dc5b449ad0af8ac3483007c5
MD5 793fa2f8564fba5975183351744e6e18
SHA1 6b23623d1710450ec284052315780e9c3dfbd9e8
SHA512 ffb16ecc15a3bfd13181cc49fe9072f98548ac381191bc8a42b1c8c7a365eb5aeabc38e2b07288b2aacba7043f60c123e4ecef4ae6be612a797c56fce1a8177a
SSDEEP 24576:pyLXPLcT94tSAfYLH8AcevDN0FImbwQuq3Wia7gD:py7PoqtSAQgAT76sQuE
TLSH
T14975E03ED76C04E5E47AC27CC6A38506F6723CAD032166CB15A491792F7BEE4A939F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 fb1c006cb870994de2c504e8f2c96e4042308441e3fd3ca5fb937c579a0456ab
MD5 158afd11bbb8d87a1c3e4969398e8851
SHA1 f19a511365b7d30726220818eb48d707452585da
SHA512 7ac6589afa2157f794c12575659e031760a79a45d654d3ab149b87aaee3123675a30a405cff53606ad2efe5f3b60a58289c7bacfe11015591964a75bb09aaae8
SSDEEP 24576:SWv8qjpBAfYLH8AcevDN0FImbwQuq3Wia7gD:SWv8qAQgAT76sQuE
TLSH
T13565125F569834D9F47A8234D933817991B1BCB6135496FF30C89ABA4B39AC0D17EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/232-383-0x00000000006D0000-0x00000000007F0000-memory.dmp

Download

memory/232-374-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/232-158-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/884-12-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/884-107-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1240-426-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-405-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-398-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-420-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-421-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-422-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-423-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-424-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-425-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-419-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-418-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-417-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-416-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-414-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-415-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-399-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-407-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-408-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-409-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-410-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-411-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-412-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-413-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-406-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-404-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-401-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-402-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-403-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1240-400-0x000002035D340000-0x000002035D350000-memory.dmp

Download

memory/1620-117-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/1800-120-0x0000000140000000-0x00000001401EF000-memory.dmp

Download

memory/1800-338-0x0000000140000000-0x00000001401EF000-memory.dmp

Download

memory/2524-377-0x0000000000D20000-0x0000000000D29000-memory.dmp

Download

memory/2524-80-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2524-84-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2524-74-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2524-161-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2720-186-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2720-116-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2720-375-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2728-207-0x0000000001EF0000-0x0000000001F00000-memory.dmp

Download

memory/2728-386-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2728-189-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2728-228-0x000000000A1B0000-0x000000000A1B8000-memory.dmp

Download

memory/2728-190-0x0000000001C40000-0x0000000001C50000-memory.dmp

Download

memory/2728-176-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2728-384-0x0000000000E60000-0x0000000000E69000-memory.dmp

Download

memory/2728-170-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2744-128-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2744-381-0x0000000000590000-0x0000000000599000-memory.dmp

Download

memory/2744-367-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2744-122-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2744-130-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2892-100-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/2892-105-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/2892-115-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3156-142-0x0000000140000000-0x000000014025F000-memory.dmp

Download

memory/3156-39-0x0000000140000000-0x000000014025F000-memory.dmp

Download

memory/3156-31-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3156-372-0x00000000005A0000-0x00000000005A9000-memory.dmp

Download

memory/3156-37-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3272-380-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3272-178-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3368-69-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3368-63-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3368-60-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/3368-68-0x0000000000C90000-0x0000000000C99000-memory.dmp

Download

memory/3368-54-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/3368-65-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/4176-70-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/4176-156-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/4176-376-0x00000000001F0000-0x00000000001F9000-memory.dmp

Download

memory/4388-50-0x0000000140000000-0x0000000140266000-memory.dmp

Download

memory/4388-146-0x0000000140000000-0x0000000140266000-memory.dmp

Download

memory/4388-48-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4388-42-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4388-373-0x0000000000DD0000-0x0000000000DD9000-memory.dmp

Download

memory/4464-83-0x0000000000400000-0x000000000061A000-memory.dmp

Download

memory/4464-2-0x0000000002550000-0x00000000025B6000-memory.dmp

Download

memory/4464-8-0x0000000002550000-0x00000000025B6000-memory.dmp

Download

memory/4464-0-0x0000000000400000-0x000000000061A000-memory.dmp

Download

memory/4644-22-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4644-16-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4644-26-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4644-371-0x0000000000C50000-0x0000000000C59000-memory.dmp

Download

memory/4644-114-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4872-52-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4872-28-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4900-385-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/4900-180-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/5068-152-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5068-154-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5156-98-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5156-89-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/5156-96-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/5156-166-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5156-378-0x0000000000C20000-0x0000000000C29000-memory.dmp

Download

memory/5600-162-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5600-379-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5796-370-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/5796-147-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/6096-140-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/6096-144-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/6096-369-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/6096-382-0x00000000004A0000-0x00000000004A9000-memory.dmp

Download