c91697f509ebcccf72b810511af1fb62b4f38e262d15bc048baa433a1a0a3424

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 10:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_f965db384fd8cc3f910220c042fc2ef3_amadey_elex_rhadamanthys_stealc_stop.exe
Size 1.7MB
Sample260629-m1yf1sbt21
SHA256 c91697f509ebcccf72b810511af1fb62b4f38e262d15bc048baa433a1a0a3424
MD5 f965db384fd8cc3f910220c042fc2ef3
SHA1 db052d5b852f23f64b7a1293019aaaaf9d8546e9
SHA512 348c5a34dfa4b79c6c6adc2741a001bc2c50723ac5ab3f34453eaef94a11fe10c5bfecc32297e662b47e8b4742175ae6ee5fd15dcc96c2daa8a59262f0b61fe4
SSDEEP 24576:+Lv5qMr1nDy2JOt934J7Z6bQaj1BvUm9J:+5qMNJE3jM2ce
TLSH
T14E85E1007BD08036F1B328724A7DD665566D7D716F2192CFA3C12B2E9E70AD1EA31B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2484	elevation_service.exe
4892	elevation_service.exe
2828	maintenanceservice.exe
2056	OSE.EXE
52	PerceptionSimulationService.exe
2096	perfhost.exe
880	ReFsDedupSvc.exe
5076	SensorDataService.exe
592	ssh-agent.exe
5396	AgentService.exe
2504	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-26_f965db384fd8cc3f910220c042fc2ef3_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-26_f965db384fd8cc3f910220c042fc2ef3_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-26_f965db384fd8cc3f910220c042fc2ef3_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-26_f965db384fd8cc3f910220c042fc2ef3_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e64ea91881289776.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102906\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-26_f965db384fd8cc3f910220c042fc2ef3_amadey_elex_rhadamanthys_stealc_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-26_f965db384fd8cc3f910220c042fc2ef3_amadey_elex_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000716c9fbb507dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084cc84fcb507dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000461a740b607dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002b2c02fcb507dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000038f5b9fbb507dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f6b8e40b607dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc07f1f9b507dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a954affbb507dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a06321feb507dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
5668	2026-06-26_f965db384fd8cc3f910220c042fc2ef3_amadey_elex_rhadamanthys_stealc_stop.exe
5668	2026-06-26_f965db384fd8cc3f910220c042fc2ef3_amadey_elex_rhadamanthys_stealc_stop.exe
5668	2026-06-26_f965db384fd8cc3f910220c042fc2ef3_amadey_elex_rhadamanthys_stealc_stop.exe
5668	2026-06-26_f965db384fd8cc3f910220c042fc2ef3_amadey_elex_rhadamanthys_stealc_stop.exe
5668	2026-06-26_f965db384fd8cc3f910220c042fc2ef3_amadey_elex_rhadamanthys_stealc_stop.exe
5668	2026-06-26_f965db384fd8cc3f910220c042fc2ef3_amadey_elex_rhadamanthys_stealc_stop.exe
5668	2026-06-26_f965db384fd8cc3f910220c042fc2ef3_amadey_elex_rhadamanthys_stealc_stop.exe
5668	2026-06-26_f965db384fd8cc3f910220c042fc2ef3_amadey_elex_rhadamanthys_stealc_stop.exe
5668	2026-06-26_f965db384fd8cc3f910220c042fc2ef3_amadey_elex_rhadamanthys_stealc_stop.exe
5668	2026-06-26_f965db384fd8cc3f910220c042fc2ef3_amadey_elex_rhadamanthys_stealc_stop.exe
2484	elevation_service.exe
2484	elevation_service.exe
2484	elevation_service.exe
2484	elevation_service.exe
2484	elevation_service.exe
2484	elevation_service.exe
2484	elevation_service.exe
4892	elevation_service.exe
4892	elevation_service.exe
4892	elevation_service.exe
4892	elevation_service.exe
4892	elevation_service.exe
4892	elevation_service.exe
4892	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5668	2026-06-26_f965db384fd8cc3f910220c042fc2ef3_amadey_elex_rhadamanthys_stealc_stop.exe
Token: SeTakeOwnershipPrivilege	2484	elevation_service.exe
Token: SeBackupPrivilege	880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	880	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5396	AgentService.exe
Token: 33	2504	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2504	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2504	SearchIndexer.exe
Token: SeDebugPrivilege	2484	elevation_service.exe
Token: SeDebugPrivilege	4892	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3880	AdobeARM.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5668 wrote to memory of 3880	5668	2026-06-26_f965db384fd8cc3f910220c042fc2ef3_amadey_elex_rhadamanthys_stealc_stop.exe	91
PID 2504 wrote to memory of 2472	2504	SearchIndexer.exe	103
PID 2504 wrote to memory of 4736	2504	SearchIndexer.exe	104
PID 2504 wrote to memory of 1868	2504	SearchIndexer.exe	105
PID 2504 wrote to memory of 4932	2504	SearchIndexer.exe	106
PID 2504 wrote to memory of 3480	2504	SearchIndexer.exe	110
PID 2504 wrote to memory of 5992	2504	SearchIndexer.exe	111
PID 2504 wrote to memory of 2296	2504	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-06-26_f965db384fd8cc3f910220c042fc2ef3_amadey_elex_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_f965db384fd8cc3f910220c042fc2ef3_amadey_elex_rhadamanthys_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5668
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3880

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2484

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4892

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2828

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2056

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:52

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2096

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:880

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5076

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:592

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5396

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2472
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3226024100-3888324339-2736661264-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3226024100-3888324339-2736661264-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4736
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 2960 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1868
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4932
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3480
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 2960 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5992
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 aaf5694a46e661962c756a6919cdbe90683d4dbb7d935d57f2cee1b65e15a9d1
MD5 7b8a8240b0e0de63844c6e527d61b9f7
SHA1 e59342721ef0fb10bd1a7e635f81b1f1034af83a
SHA512 cb389315af4b2573b4c8ccba483b88f68b42ca59aff0cfc54878247a69fbac127f56b04257a8825a96e43288f87338b226c11e93f1317c3c26516a1e79f84f6b
SSDEEP 49152:Xb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnaJE3jM2ce:F3q6mjB3E3Xc
TLSH
T112D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 22cf96706223fbc14bb372f81bb7e8353f5a4c3639f033508e9530eac94a4218
MD5 d3e881491a9f4281d3f635e334731ff2
SHA1 44f4ff8a923cae15e80817b61353a1034a2f59a3
SHA512 8f1797d90d378c1ab23ce32a3bfb47bb92995527b8ffc79d0cdbd5dcd7475378e09dec9a4b430eca84397b1085f58d9d52982636bddf8845e16f1b33874e2244
SSDEEP 24576:mXYfDtczAf2JOt934J7Z6bQaj1BvUm9J:FtcvJE3jM2ce
TLSH
T1DC75F118A7D408F9EC678179C8A2C512EB327C954790FBDB03B49A291F376D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 b7201cbdb4bdd52dbc82422cdee04fef7aca118d59310b4af7b136547fbc0e4c
MD5 46fbd1ba929d1a970f973753486feaa9
SHA1 c104e29c2da0bc0af0be176f05a632fd90098841
SHA512 5e3d36512f41bd7ba225bcfeda37d579c1f282c4e8c332af9f1086fead0e36f52e404546db0969f5f13429bdca48cbbfc25080e8a6530803ebbc80ebd66ce0e8
SSDEEP 24576:+0Le5ji0hmxhrMa2JOt934J7Z6bQaj1BvUm9J:+Pji0AzoJE3jM2ce
TLSH
T10695AE16F6744735D073C0B9C5D2A68AEE7130865B308ACB4286D77C3E67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6bf49944bd03460e7393a4df1826731eb09887549b3256a20c46be5c8e8b6c53
MD5 39afd8bb1bd075d99f2403c2d8f226b1
SHA1 93eb44afec5e6316c608072c35defa71c94efeda
SHA512 e5de1f0a497d59e22f477045726177fb3e8eb126c69e4d19ca7ce8e133e94d86f6e61934f048194626d47fabd0124e55e83dea0973d1b3c29e3110381b513ad3
SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWj6q8wyuE2JOt934J7Z6bQaj1BvUm9J:a/ezSC6vUzPv+HjyMJE3jM2ce
TLSH
T192755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ddbdea8fa19e0d9101f3f90f46b52bba9ca6f4dbac285650744398c90ddd4e1b
MD5 aaccaba115564a5763888993b6bd2a9b
SHA1 7f0e532bf2a096db37ff002263d0bbaf75fed066
SHA512 7f7da50f64c39dfa6f6ff0fd68a7e1a1cf02352e86d4af4873053636911bb758c7c074723e6f8039b2633549b2266672317cecf1b88051da8525e9a74e47d835
SSDEEP 24576:/VbqPb88hv/l+Bb2JOt934J7Z6bQaj1BvUm9J:/VO88hXl+IJE3jM2ce
TLSH
T17D559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 f6902c47db27d650400e6bcf454ed3e59e5fb532750afd6be5958632674e7151
MD5 5645640b9e5c825d6869232ad322cf9e
SHA1 935adc2ca7e187fc55a10848c449ca7543abaf59
SHA512 830f3241d674983d4099f46b06040df183f5db1a8a790b0c5e5470243f0a6a8dc1f7b76da298add0958a38e6736bc2097af16fdee41c2577d7b2820c3c00abd0
SSDEEP 12288:iGloH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:iGm2JOt934J7Z6bQaj1BvUm9J
TLSH
T19865230EC6481CE9E6160C72B9EDF8E36B582E9E9DC13EE78531BB6D9D7C954C0B4402
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 354a75b414a2a4acee626e391eae63bd6de81956bacfcbd026f0583ace3d46cc
MD5 1a0b7a873ab72d9a884856da926ea785
SHA1 fe34b69acf5de32cf1ae94c5537d573dcb451c44
SHA512 84600dd6e9d838c565cb8b01177d406efcfa9a34684b6ca76d446b0c30cbd6777fd413e3336467b7da34f4198de62af9e32ede92203570fb4cd386f75c7fbd0a
SSDEEP 12288:2eBNUbTVO86UQoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:2JIUD2JOt934J7Z6bQaj1BvUm9J
TLSH
T1FF85CF2BEE28FCE2C27A4CB95A91C640A77278714F52A3CBD175830EDE275E04E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ff406b154730d11a9279f5c438f7dfa8d9e2ec06b979793f0bac63b3f0c28cef
MD5 be8d5e36f6d0074e84ef3edd80742e13
SHA1 739f2a8e229deb4a5b200529891deb54cbd49968
SHA512 e43a0ba4736d246741e91ca7ff01a7ea43320e7d669620fedc7f31631a76999b41487f3a23d4bc9774313f2fc9be016c8c065b99b7b006ee5c3dcb6e29a557a0
SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THN:eQvGAdlCEL8c/WRNw5CBE3Xc
TLSH
T12B267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 cc23664189f199581ff7cac28ef8f655b511ffc2cf75ae023d0439e394523a97
MD5 d1caa4499a7bc60b9bc9b04ca0bc2d4d
SHA1 d5931ce7127b46efa846099292925f56bcac3ac5
SHA512 d58d8ae5b5453fbe4f2c7ed9feab20f71e392fad1c1f44177ac7b8aa9ce2470e027480d4729d2c62632c9d9cfb31930ef4935c84bafa046a0c39cae30dcfc564
SSDEEP 12288:DAwSfxL/2Dc3mDLLmt0LDQewsAjGoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712C:8fewsAjt2JOt934J7Z6bQaj1BvUm9J
TLSH
T19C85E031FE74E436C27B0DB22B76D712142C7E604F912AC3E3A89E9D59342D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 309b8970c8c2434000b839d3f34bdd460d1fb65d6f6af3e080d9931c3d9811f6
MD5 cb7f108250851d84ba713e5fa2aaae06
SHA1 b36fdce062fa8ff081669758d83d92ca221a2533
SHA512 c56b99289eca569b7c69816f750a6176a74568af17df95183cb62609cb5b799534c2c9ffa35e1f4587a59f3fcb1fbe7984a275e495a678d9efd0daa9c6aad3c9
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHt:7UEtQevvqc2W1cpV20I32
TLSH
T12E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 82030b4f38ff860e43309defa37dc98c76a6f3134669bb848774da958a8bb182
MD5 9c972f153cb5eef3cccf929275698d43
SHA1 a9fcd2086f106a9a0a0321dae6d0e274fc2a10fd
SHA512 36371b95b7c89225fced7df07b27b86e612324e83cefbbc304246dc33c987da0297a70fa190cc5a31fe27f24022c6c2129bfa4c64da767c4a448d61054cee240
SSDEEP 49152:qCbRquA/m2yL5zTfFiV+XenmE3/zYJE3jM2ce:foquVjnmVE3Xc
TLSH
T107D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 368d4d4b894adaac8aa6b1c9b0596e3e80a97fba67ee0d02ae8662ca937cec7d
MD5 2ecbedde51f34413030b3851716cad70
SHA1 5d92ecdefd2d2c9067c8ea9f191c5c64a6081918
SHA512 f8a1e5601b62f8e88e0c3df9464a809b52984aa9b50142cfcacb4ba4dc3f41e855396555a892a1458a011882a2c256b6216bef665cdeba21e6a983b993d66239
SSDEEP 24576:NAhGL6IFoiwtA5l7S53o2JOt934J7Z6bQaj1BvUm9J:NAM5Foiq5DJE3jM2ce
TLSH
T1F735AD81E7F915D4F5B39AB899B69171EA76BCAA5E30D20F1160D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 1dd7c4f395f76fd51266b3e1e45786cb7d728632788104b6f62493e76521e73d
MD5 c38cd9d15a6303ec09c5cc2340d8a35b
SHA1 5c2aecbcf9b7a356eb306bf20de318c8d4bd77e4
SHA512 593b6e14a0d03902ce7395d042ae9142cd089d50c249d9cedd24faaa88e1c7bdac22a164623d6b10a1f2f8ab4b4bad9845d80da62b230af46efc9a10bfa8fac3
SSDEEP 12288:Jmw5HEjsChNEBFgl0WDm+CHoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+511:EwuROWR2JOt934J7Z6bQaj1BvUm9J
TLSH
T13575F14A76A80CF9E9674539C597D532F7B2BC062A21DB1F0760C75B6F37220AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 3c97b5218ebee2c2687ddc4d3da2a721acb391a47c5288895088817c493c4c07
MD5 81ca9b5e0958bc9e92ee7af8b9b546eb
SHA1 64f71018b4a532541c278350c601c0fe97baa842
SHA512 5b9fe021c1276126d62cee7f205b71186e6f1d38961f29d08bb49cb7f2c4067f9fbf14f181c342761fd9b88eaf8b43a8228ed6d285950df12168c8d71b477af5
SSDEEP 12288:yyZ1Iy2oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:rZui2JOt934J7Z6bQaj1BvUm9J
TLSH
T13F65124E23D824F9E1634579ECE49A42E7713C9B6B7117CF063197692F3AAC08D38722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fc6d9bb518a91c4ae2b87d550a28b3b8d3ad930311e1b6db7300185ef48dbd6d
MD5 9cec4adab8fe6239d7af32187c150a76
SHA1 390d40391a61916a6d4652286dc3c4efa0ac9d12
SHA512 fa18de493560b5a48283824725a63c2adf09aa664a21defcf273192e7d1ba1c045617bf4f75328589471d230eb4a25f8b432a0dd8fcad6fc3daf74fad07f9163
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ux:uQRQyi36YOcPDLvw2gAf+PN3yE3Xc
TLSH
T1F8666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a59b740622f18272b189d8d59eff491538d62eb7bfdd7be03f9f4be637edbd86
MD5 fb601b5a0948fe176bb95c7ec0463fef
SHA1 b1144135bfd0cdbf74757d3aafa9d8ad03ec0274
SHA512 8d4ddddea78a3430605bce2e494d6b3c92f64116bedae84f84e53b85a26f0b7feb7223124a76ce835487dd5a5de7aadacd728f3cfbbc8ae1aca0367382321582
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ux:EQRQyi36YOcPDLvw2gAf+PN3yE3Xc
TLSH
T19E666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ddf0d93e709f610a52620e837406167ae56b54ae3f3d647c98980f8df3bf7439
MD5 1ae8b22322a5b68155ddb0098d98ba36
SHA1 0ffed79c8b9f48d2d409538f3910e50d5b227819
SHA512 4faf48d7f8eae3bec2e52fa6026d9efa4d0dc62aaf40c3b900834712ad6cff25a75bbdd647bc7c36f523c359ea6e21615f380bc5e129e0e5c34a999e9c65b8b6
SSDEEP 24576:wwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0S2JOt934J7Z6bQ8:268Qg55nhkeWu7PNU3/oJE3jM2ce
TLSH
T136B55933B2F600A9C44DE1769F4A973196D17C758FE0E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9d3470cd109f1722d7d0e51f5145af2b3f6c68355d63fae6982101b8f039bd0d
MD5 0b16a3dcb0de5c53b4d4ce1224254905
SHA1 c2f07997c1dbf87f8c369ff5c7786bd80c0d992c
SHA512 432282332aa4d3e3197f3121d8e50784e5e64364c090a87c00e4369a5e4d4404fdca84c5b55245e112f287bb0073be91d53336cf769d3c6fba061d2346fcc332
SSDEEP 49152:C3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99n:Dy5112gYy5azzVvU69nLKnhZfE3Xc
TLSH
T18E167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 28275f64d6165d2e4f92b9ae8224f9be6d4dc14923ad1192b0482fe4f04735f7
MD5 de743c321aa6d98041c5f4daf8754825
SHA1 e8d20e87ac3e36347ed7438112f72efffd053f14
SHA512 afd86adf6ef6736f9ee0c9a30a1c1c0497d23c122ef0c025bf78a8423fe2b8106efa1cd4693f06dbf96173550084a0d037b64bfb8dad535b37225d984a43d7e0
SSDEEP 49152:aB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glpJE3jM2ce:Iu6JmIxd2dDE3Xc
TLSH
T15ED59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b95e8c275a2ffbe645a527d20d8c8b845325185ed8375b559dd860a149b9ebc9
MD5 f789406b11c4859d371df9d7f8ce2586
SHA1 fd8f74fbea5adf6a70846caf24a72128cbae2a74
SHA512 a4491542a089f66b2ced375b88e58aa8d23ff9ff11162953e11fdec335424e5d2b9c8b04c2acb1f0275b8ec4e2be97a12f3f800fe2fff086c78afe0132a483ba
SSDEEP 49152:31hpsNoJpF1A67U44CwH7R4xSJE3jM2ce:3mifPqRVE3Xc
TLSH
T170B5BE13F2D801E8D06ED17887569632EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cfb3cd268066804c5f7654831575b0cffeda4ed4b03b45b57524a2a06f842746
MD5 00e685297d53db308eaeb6dd1cfd3e3d
SHA1 6959214bdacb0cc5b2ec4cfe1638b7bce6e094c6
SHA512 162c62fe8e574f84c344ffe15ef22199a52e064cc9418aacc5c94ed79307f8d064e9f7ac45a35c0d355d099f4328071a2bbfb4aa5af9b6924847af4e79a42baa
SSDEEP 49152:HSuZQIY0Be2KkRVtOnks6NMHqhJE3jM2ce:d5dKqi61rE3Xc
TLSH
T187C5BF03F2E941E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b070588d147cea796d00fca1e3efb94dc59c388601789a4c4022648686f5bfb3
MD5 3488831e9469fef44012b4161b409c03
SHA1 dbd7fb4729d4ce270281ee7bb244d315d7cff4c4
SHA512 7ee36dd12bf5bd4dea2a6b9e58d2cbce0a4f8af7d8d100e7d5949a33bf8b333adf093ac46e654536f6c3b244e38a634e8a8e357427bd794b5202941776b3f423
SSDEEP 49152:0htSn8EApI0figjgiDn0AP5wOJE3jM2ce:VX2iWphJE3Xc
TLSH
T10395BE13F2D900E8D05ED174C7568632EA62BC160B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 e23ddafb2ba59f9a4afb93fef88161d3efd799b3752b6d524ea211e13e92c3c7
MD5 8ee5d80e49b1fccb8515abf9df1da5c5
SHA1 49154da32f1cd2d063604611c0e2dbab2382fc89
SHA512 245a29b50e0829d90bf919a7a258c689105b06a256c33aca93cd31ed4a74c7a10867e289d027286de2f4b7bf998710e3e9c8e5e7fe06d8fc29212175b3a4122a
SSDEEP 12288:u9oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:uu2JOt934J7Z6bQaj1BvUm9J
TLSH
T15665230EC9480DEDE1150CB2F9D9F5D26B5C3E9FADC13EEB4636B629AE7C954C0A4840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 a2d2d59c729ff30e9be8d5b3bb421e841b777fcec467c4c7cfb6f8fef3788945
MD5 a72b4f6bc42ea33149b8376f8454687f
SHA1 73b0b1df39552f6cd1ea8f22512dc411d3c125e9
SHA512 b00206fbf97bfd6189ed086b39425e8bee1401a1e675445281d70a9fcbc2ed1617abe9d48589d3efb08acb2a6c50ac674de3362c6f84c7337bbf8c4fecd80e83
SSDEEP 12288:MqoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:Mp2JOt934J7Z6bQaj1BvUm9J
TLSH
T1C065230ED9480DEDE1150CB2F9D8E5D26B5C3F9FADC13EEB4636B629AE7C954C0A4840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 4f09c1ef2bef97a9d6cd3fb8379489e9353531b70c1e95f8044b085ff7f80059
MD5 cfb6412f3b1a1776e811a9432c9ecaaa
SHA1 44db3c3a1cdc7c3ff5139a3489d3771eac252b0b
SHA512 b1781d2d49b600dbec280297e12eaad5aa51085eb26016619adf0ad2bde32f61af5105603af94036b48039c09da199005aa1a185177628a36ac2314abce5ef13
SSDEEP 12288:+IoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:+L2JOt934J7Z6bQaj1BvUm9J
TLSH
T18565230EC94C0DDDE1150CB2F9D9E5D26B5C2E9FADC13EEB8636B628AD7C954C1A4840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 70ed834f9513341712267ca03e8f70358fe9aa3d693f1503d302562ea30a342d
MD5 afe6347b25982ec14dacbc6dd854358f
SHA1 17727c840b870b16efa63f30909dbe06b81ae60c
SHA512 54cd94516add64271ab46d7e756021309893e246354e317f74ad3c5402748dfa67e3480dcd7f2a810c2c022fa1bfd43129a79915328835aef2c0b80ddb1542f7
SSDEEP 12288:ZVzoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:c2JOt934J7Z6bQaj1BvUm9J
TLSH
T1E465230A965C0CD9E41288B2E9E5E492F7783DDEEF813FEF86217A1D5E78694C474E00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 8cbe454d3776aeca3972e890539431b7423a4f84a40919c22f661323034fa85e
MD5 1a6fe6e1d2d416f0fe1947f4dacef153
SHA1 9031746f6233514bf1ed92ef583a09c88f156599
SHA512 f1a91b79070d5a70b241744d965b2969297d91acee1bd5deff63ce7e3cf874536b9257f42e5e98d3a00b8bdf647585de68be46a90a2ae9e38d8cd03532d567e6
SSDEEP 12288:27oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:2A2JOt934J7Z6bQaj1BvUm9J
TLSH
T10D65230ED94C0DDDE1050CB2F9D9E5D26B5C2F9FADC13EEB4636B628AE7C954C1A4840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 3b984ce82b27b2fc8202cd44b45b97d32839e39d651c7601c3c2731a1c30a776
MD5 ef552093483fb54f96c13595967b8f0b
SHA1 c397113ed3fabf9d974128b411ef5cb6d76338e1
SHA512 252b594e6dd9474c0ac3c4461c9f543b1ae000c5516f26fced4fd032fa5f0879441e486cc40501fbab993148d7d9ae70cc7a0fd2fdc19fbd5a19da1ed9f782d6
SSDEEP 12288:oeoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:o12JOt934J7Z6bQaj1BvUm9J
TLSH
T1FD65230ED94C0DEDE11508B2F9D8E5D2671C3F9FADC13EEB4636B629AE7C954C1A4840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 d5e7bd634b3bb4675a830d455385b572f924bf906dfd70c7563e7d262736847b
MD5 455e4ae5617494618eb4ab72731ef9c8
SHA1 62e1762b69fb132d6c536a7010085bd6212f9b08
SHA512 5a48a45300a6ad85775a0cc7ace90ba10b498acbc320334e14c91a2774359b6111775830e970f66ac5d6d785c93871021e974c42fe868f7384019e8cfbaa043e
SSDEEP 12288:byoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:bB2JOt934J7Z6bQaj1BvUm9J
TLSH
T11F65230EC9480DEDE11508B2F9D8E5E2675C3F9FEDC13EEB8636B629AE7C954C064841
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 a5eb27fca3eda7f28a57cb214a1f440620609c5812f63e673e9c9739feefd5ed
MD5 946f60bba30a7525474101159dce10f1
SHA1 5fa863e9cdcd75e46d4ab38f2b0a9dc7916bd380
SHA512 1f660518f96958137edb6fedaac61acc41b9aed82035d98617d1b00f205a86a8b1b7e749010803535c811b0441eff6f2fa4ad2ed7d8c852bc95620380d9b97e5
SSDEEP 24576:DZM3zFVSOJ2JOt934J7Z6bQaj1BvUm9J:DZM3zfQJE3jM2ce
TLSH
T17C850189B3901CF8EC67813ECD659952D6B27C5A4BA0CA5F03B4362A5F373A04C3DB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 a989eb362ed6536b496164edb1cf4e82ee1e39f5cf1f5be34966a6a7905f3d2b
MD5 1835541ff20fc0f16beed77821f2638b
SHA1 231697fa485cc636751e60cab706c64a67fb13ad
SHA512 6082ee2a61bb805e510afb1b76769a665c148c0247fff1129a5e94cf8b2ef93176cc4e7b77b074e8f321eed4e8c92cc0a0901d312b7330c380e1862688a9fa15
SSDEEP 12288:lpoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:ly2JOt934J7Z6bQaj1BvUm9J
TLSH
T16365230ED9480DEDE11508B2F9D9E5D26B5C3F9FADC13EEB8636B628AE7C954C064840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 754afdbda281202c28a30a2bd95f8ac75436f311957757b80a683c9c6f1e41bf
MD5 e9b816fd2e612455c0d8707d05e7e369
SHA1 27889f9885db2efb63c711f50fa32cc69f653dd6
SHA512 e26a0e22ab77d5eb502bfdbeed39a0a91d43052c7ca5f4d6ef75f7694eac38e6df22f78d70f6832bdb640de7f49e595d3d7ebc83a1652c763d88c234c063335e
SSDEEP 12288:AVoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:A22JOt934J7Z6bQaj1BvUm9J
TLSH
T14E65230ED9480DEDE11508B2F9D8E5D26B1C3F9FEDC13EE78636B629AE7C954C0A4841
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 173f1d7c72265db245b9598b4314b06ed6ac8dfede9a3607375d2ca9a0b4c9d8
MD5 6c26eb467401af9bb78edbcffb18e768
SHA1 1120e0ba707818606dd47ac73898b02c2c9fc0db
SHA512 543d5ba8aabdcd2d036beb0f4015bb9548f722dd6af2366dda0d0bfad1fd8f7bef5afbe57ae63d0a2aed205bae9d59dd920929eaa767849c46df81b3487fd68f
SSDEEP 12288:IyPz5L82oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:Jzy92JOt934J7Z6bQaj1BvUm9J
TLSH
T10A75020BA3A430FDD1268135C8A65A42F7757C7A4B509FEF0760577A2F3B6909D3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 1935ce04bc507aafec07aef3932a94be94f5d3734f7c7850e18730b715cc4c25
MD5 010186d9a3e17319e5a1e4850bd1ddbc
SHA1 b0fc16206f2e41c2bd2b999334bda939d7e34528
SHA512 1ac7b0c96e8d469e1fa2ced579edebe7bb8070cbc1f1552d6a26cb1353a2d36633faee2b987b0013ca7bd377bca301e942ac72e74fd64bfc190160c65ee7a627
SSDEEP 12288:upoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:uy2JOt934J7Z6bQaj1BvUm9J
TLSH
T14465230ED9480DEDE11508B2F9D9E5D26B5C3F9FADC13EEB8636B628AE7C954C064840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 48c6d986c11ba894ee481fc5402714efc086a86a308943dd551d66a95454cce6
MD5 f4769f62d8dd19d3b662d61c854c79a0
SHA1 056277aba60b2224bca3229f2d603f2bdc9b8e70
SHA512 36c7174bd4171d12e7742e953aedf3335526868c52d8d42f59eb9a7494976eb17424cbd548904b1b76a7405b7acf2e93b7b07ad9842c82de14e1951023465ad0
SSDEEP 12288:npoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:ny2JOt934J7Z6bQaj1BvUm9J
TLSH
T1DD65230ED9480DEDE1150CB2F9D8E5D26B5C3F9FADC13EE78636B628AE7C954C064840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 9a1ef2f61b82079b81dc5f4d671c03667cd0b52e17deaaf2030f9cdd33a2f873
MD5 8ceca285df73882d959498f6b4712505
SHA1 252e1afb46dbd46b261bfd68bd073554eef4ac9d
SHA512 4c38f6745f6e62c35fdd241caca9c0079dcc58d1d020ace147ca8b4da1fa0770ff24461c7ddf57bdb2837412a7c737f6e2009cc3cd98030f4e9d3b49ffa490e5
SSDEEP 12288:fyPz5L82oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:Szy92JOt934J7Z6bQaj1BvUm9J
TLSH
T1B975020BA3A430FDD1268135C8A65A42F7757C7A4B509FEF0760577A2F3B6909D3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 221dcec7455c71e0517e8b9c8a549b78d262dcf1f0cd3d2b657ff421f0ebcc62
MD5 4e805d1a777921629a019411f02ac61e
SHA1 1d1f76c09867317bb2c3107aba060eb64ae21953
SHA512 1ab40dec3f786438888235f1b7638f4d01cdce4bef019dd2395c0841e4562bf5e16ea8bfb488a55b97cd98986a395abd382661b4c3f37285c6cdf549a0a1347f
SSDEEP 24576:xT8aLl3z0zD72JOt934J7Z6bQaj1BvUm9J:xT7Llj/JE3jM2ce
TLSH
T152850199B3901CF8EC67853ECD659912D6B27C5A0BA0CA5F03B4362A5F373A04C3DB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 ee3c622ebeb3158ca46a59690420c4f40de6bc93e8aa1f86f2a4adca8971d115
MD5 ee5b396f2b3d89b804658a2ba80dd828
SHA1 4e83426f9909b26b5cc2a6a65e25289a90b2df2d
SHA512 f100d3cd7163ea9672b8b41b882f7e4370bf26ec065758ae93e5877188374875165360f3ff51d8a000cf0636c2f47cb3b36c77a1459a80901e15eb030d744206
SSDEEP 24576:C3rd9CHKy7GZH2JOt934J7Z6bQaj1BvUm9J:krd9CHKyaQJE3jM2ce
TLSH
T1E795CF90F3E414E8F0778A35CD769512DA767C9A1B61DE8F03A4661A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 318d32708ed82e437e569bb392a4014bf64935ac7e06fa7f0f29b0772c9a8ebc
MD5 f59d90df39bb344e41b3d193df7050d3
SHA1 5c887408504905102f8987aa26f008bdaaaf6def
SHA512 4a16cc9124d16455bde6ebb0f52f7f3b275c5e81bb2cfbc0352c112f0d48ad5eaec962fab84bc6dd5ed24994380600829b731924efeb0a396135095847c93495
SSDEEP 12288:eooH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:er2JOt934J7Z6bQaj1BvUm9J
TLSH
T1A565230ED94C0DDDE1050CB2F9D9E5D26B5C2E9FADC13EEB8636B628AE7C954C1B4840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 b07294db29f777327daddd8552b6714643793a9af14d1d1838ab1ad12b100ad9
MD5 e3706607281fb6a7f9b4a8beeed64695
SHA1 f89e1fb84148bfc8620d2ae28ae888488f15c280
SHA512 12fdb3e9db7e17d2a0fb6e5eebc2bc17acc4f85a079a25dbed04785f7e9cdecf45dea537481f00765ccaf9c4edb329c4379d8e62b109aa5fe49ce809f88f989e
SSDEEP 12288:DWoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:Dd2JOt934J7Z6bQaj1BvUm9J
TLSH
T17B65230EC9480DEDE11508B2F9D9E5D26B5C3F9FEDC13EEB8632B629AE7C854C0A4441
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 92a6e861630c937a0f340a72e85494ffb1e26262eee6a75919524705b857ed51
MD5 df1ad8eb219a7226761c050f89985415
SHA1 57185ac62e295b9cc4a2d4c9275a048a6b1a887b
SHA512 fe7eec9103dfc3eeeb5049f3c02b1e4caecb4516e6b1106fca72ca0ed8cd5e6d763ebdcbb9b028b5ffca616a505e08988f48d01462aa1ee77d554bc0368500a8
SSDEEP 12288:jvoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:j82JOt934J7Z6bQaj1BvUm9J
TLSH
T1DC65230ED94C0DEDE11508B2F9D9E5E26B5C3F9FADC13EEB8636B628AD7C954C064840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 848a1bb942b4fab5d2d31b41e85b5c3dbd9db498a79d8c69dcc76bfc709688c1
MD5 6af34f16dfc8734d65107dc7c10b9f68
SHA1 70fb9c918f0b09ce8c0bfba219909d9f0cd814eb
SHA512 29f4c52c81002591759da78db482cfa72fdb95d51e1d6c519c73d396ae05ca8ae99ef1f56f3f80d94d0d97ab3ab28900f5f30ea4f3f712dd139ce64212678329
SSDEEP 12288:1poH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:1y2JOt934J7Z6bQaj1BvUm9J
TLSH
T1A265230ED9480DEDE1150CB2F9D9E5D26B5C3F9FADC13EEB8636B628AE7C954C064840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 b889ec63e9cdca5b1d33381058a5c742c85135e29a1e54aee88c6b35f4b970a9
MD5 7d559be8e2212e445ab6e613fbf99e35
SHA1 8cacface5709bf0db291018aa553e5d1fd233748
SHA512 5fe2fe3e63d316d07329510c01d8cec888a4d9908da094c2e9b4fc6ba60a44910efc7084984a901bb19bcda396cc70e745388d5c2235b4ad0a41c5a4d53c7dca
SSDEEP 12288:CooH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:Cr2JOt934J7Z6bQaj1BvUm9J
TLSH
T16065230ED94C0DEDE1150CB2F9D9E5D2675C3E9FADC13EEB8636B628AD7C954C0A4840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 a8eda09a64b51daaf19a114f575433c4e785baf004f3515ada2575d2ab24e884
MD5 314fbc92eb35aad14e2f982108b309c8
SHA1 9efd64c28b159572d7f6e00c0036b2c2b04b6079
SHA512 b84f2a06997e5d6e69ef3aba65f635628b8d75c83cb322081c7c852d76cef4041f3f03bbb3e53e3281325b8188ad858daddde33734f63af047f5f202981596e7
SSDEEP 12288:lRoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:lK2JOt934J7Z6bQaj1BvUm9J
TLSH
T19965230ED9480DEDE11508B3F9D9E5E26B5C3F9FADC13EEB8632B619AE7C954C064840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 c1266ad0d16d3b7e988327e352ad6bac0d00e96c36ba509a61e2ccd19063b3be
MD5 5ca2f9cf55e253b39061d1138873c1a4
SHA1 76d4bc054338bcd322c0872f86025615ed0d3715
SHA512 65206eb84b1f04fdced1d6af201fcdc32989be43c0294b5a686161f62ce46b2e64ded8b046e6f65053f6cde333982f36e2cd0e3a1f43bcdde66fe362ee8533aa
SSDEEP 24576:bfwvzk9RX6wkyAIG2JOt934J7Z6bQaj1BvUm9J:OMnYIlJE3jM2ce
TLSH
T1D895DF29EBDC08E5E177813C99B7860AF6B178691B31C6CF02AA536D0E37ED49D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8a15f866cd8f95fac214e03e5764368d425c28c1c2357d8884319861da477f89
MD5 eb72a18c7b8433fb04f208aa32150b37
SHA1 4deee9a6b744d995de29c39fdb38cc79c920dc53
SHA512 3d7d95dbe01e8e9c4917b91f71a70f6351965104ccb4abcc9ca6a2e2fecbbbdca496ccf8417f9fabf59042b4221106f65fb669a92d6e434dd741332d1fbe8cb3
SSDEEP 49152:ZYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0uJE3jM2ce:QySzPSE3Xc
TLSH
T107066C56A1A801D9C1B9C1B98B1BCC17FBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d418c15357fdecd2f1af7ef08c5f224375d5d586e83e8dd0761e558aa5a50a99
MD5 7951c087543380c2d92ce4d1d53682c3
SHA1 c7b5c07e4bbcc6a913a4d1e6f37dee1193e5a5c4
SHA512 67e3fc6c3eef5a8a260c0acc2c236b3b1af6454472eef576cf00d0e85babe468379950681bb2f030cfadb75647851eb483a383bea54b9f7e82784d704ccc05ea
SSDEEP 24576:z47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYZ2JOt934J7Z6bQaj1BvUm9J:z47JUQjqirIhCnDHUPfF/+JE3jM2ce
TLSH
T14165AE1EA3EC01E5E17A827885554A5AEA71782E1F31DACF1270837D6F23ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 cd0774a4ed13eb09f97d74f905bd350c0b83e4caf8d99d1da5a852dce5402df9
MD5 6b19f0ee124557fd0807e372a04b3ab1
SHA1 09f32bf8022630cf26da3755670016d983bd1768
SHA512 e2168f8dfdf22c9cf3d503c391e21cd5ea3b43d5bcdb3030ac6bd9fd2767fe46ab735fbb0fb025477cf04eb3a482339e17f68b0da7dd6f94cc491b2be63628bf
SSDEEP 12288:Opsf5oH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:Hi2JOt934J7Z6bQaj1BvUm9J
TLSH
T14175010AD29802E8C02E5176DB959A41B3373C6A97E1A7CB53D0F53E1F796908DF9B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 98abf4dcd7754ee631c958d98d3671b0999a71ef0c8e42ed1dc0bd6d2e4bac38
MD5 a76fb304995eee3aa7c52286a1537b4b
SHA1 ac2dc748957398cdfa2a8ed9b38e9403a333d7e0
SHA512 83e77c9f8d4793085ac91635253fd941b3436c97ce866862dd1a9fdda2e16ff24234527dd4d336ef6dbf7dfeafef7b511938bc2082f5350ad25597ac5ba6d043
SSDEEP 12288:qIhHjBU3fsM8GT9++BOE79G9W5sxO/eq0B1Zs2GYRIgldFa:qkH1UPhN9J9G93xqeq0B1DGYRIEa
TLSH
T1714506007626D78FC6A940725E36D6CCAB707D41EE446F0373C88B3F9576658BAF9282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 ecb8c42cfc64572cb5e292fa987b6e0d426da5ed35b9fe7d1582717a40efe658
MD5 200b0c5025d2bd0c020b36887a1b8c1d
SHA1 bbf60047fa7217a496e39971263eab4689d7fdd6
SHA512 3a9d0b3d3bd38855bff2d0ebfa4151825d5e803331fd8fd184d3c87238df42c6bd38502084c8a01a53ba362cb6d26863c8ba20c19658797ddcc1e2645beaa271
SSDEEP 12288:t0LKavkMO6BGzLlnsNSSnyCsbCSMr1t6+Az+2C4nb8Hf2b:twTsNA1NSSnywYbnb8Hf2b
TLSH
T19A551B00A5B7E35FCD6E90775232C68DEB74AC06B7453F0173448D3C9863A6EB6E6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 168B
SHA256 b2950f7a4e796f8bde29e72df0493f8b4cab00bd86baf0b6188562cdd91ccc11
MD5 e63416231a29833146ea4205d949a081
SHA1 075c589857f9a44d5261bc4cf52c565b317f20a2
SHA512 3976f00a251805bf34019f40603694fbe607e1e92ad59d731dff7bb661aa608997fe8a45d9d263ac2f8dcae59b7d5bf33e3f5a08c4f1f792c9b5f90782ea5518
TLSH
T1FDC01202717E7D1917E90046F62A1FD41050311283CA4A347310368AB226403096752C
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 be0661b298655445b685d2baed943b6e0be99efc0794381f040eef6e1208c0ba
MD5 7a6e33e54c0246c255ed1109d6f3caa3
SHA1 7ebbad7af7f4eb26075ce53f52ed5eb437e3cee2
SHA512 1cd3eb255505686621130af5db09f4a4719d5cdaebdb089f85d6df2dfd0392c08e42af0ebac151ce961ca7331709cce592e848de47d3f78760d11162f155b181
SSDEEP 12288:407hoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:V62JOt934J7Z6bQaj1BvUm9J
TLSH
T18765230AC64C0DDDF53508B1A8EDE472371D3EAE9F807AE79521B769AD3C9C4C9B4902
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d45ea3b9ac11b1952044b88fc14c69964dd8dbe85aa94b328df248f8e8dc71d0
MD5 6daf6b760a53448982af688ddf4d8b1d
SHA1 f0450420bc322af78655cda4740efbc3ffac2307
SHA512 49a604dfc2171152a942c5b401b8c7c6ddd1a2a774851c8d632906c59fc1c97034063c4e1b43de6a878b052fe9207d9861a450197646b666373f717dca5d2d47
SSDEEP 24576:cgb6bmBIi49WNNFpg1rSvFv7bYE2JOt934J7Z6bQaj1BvUm9J:cgb4mBIBhGFUJE3jM2ce
TLSH
T10065AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D6DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 d12dd3bf88a91f20d76c0df2b86334336e2170c5bc54290065280e5fd48862fe
MD5 9c40aeb97e713f05f5dd81bbce068f86
SHA1 f4a5a30a138edb57462a388117b98b1351df16b0
SHA512 0ab700382e76113c71e430c06fe6de337e636197623ccae06b85660ad670f297c7cb32da2e49d93893e32b4ccf5a443f9c69f53efd63a0729a1bbf28d841ab27
SSDEEP 24576:+G88u8FpJqH1vzria7/mJ2JOt934J7Z6bQaj1BvUm9J:V7ZFPqVya7/XJE3jM2ce
TLSH
T1DF95F155A6E401F4D47BD138898686A3F6B2B8250360FFDF07A88B551F33AE44B7EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 80f45a1f37e438542fddeaf954a328042ce4a570f2c8264e203a4d361b78d079
MD5 35de02f4dbbe1473e8a114094755c4ea
SHA1 7200415623bb8801e699d7aa2997ac990fd02a42
SHA512 e1d6ddc5a48f39359327f2221b7d57d4c3fa288c92610c92185809f8833a33b794bebf0e5b1c01ea609dd645060ec1bc04994becf7cfc11375eb31edb8f7bc6a
SSDEEP 12288:RHvUrBFrEjwaQOoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:RPUr+NQF2JOt934J7Z6bQaj1BvUm9J
TLSH
T18775F11F62AC1CE5E676A17DC9868619F77178661702A6CF02E0813E4F77ED8AC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 440b2af5df4d7f35f3624e0f14273db8e3c5f2011ad48840ca626af8866dee58
MD5 b549a2b99ea0f7ffc8248d1a48265840
SHA1 94be7a1c27ef8fd3d1fb0291ac050d3d97519ed8
SHA512 06caab62d13192eca1f303c7adbd321ec61ecb685c5a1c7616a1715ef3710ce8f6a6de0921b922aa9c2439ef90942c583ded5e7c0ea103cdd838f9e203116159
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjAJE3jM2ce:YG05lO43bHE3Xc
TLSH
T1E1D5C06E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 29277433d19c00d23fcc01a8f56d3492896eaac44017bf3f2741847fdbf53729
MD5 0fa3177faaa597851c99e711ad62fb7a
SHA1 56961515f4727bfebb27a7cab96ca65118ecd65a
SHA512 53b4898f44cb42f6c98412c06e8cdaf5931d52c9aaa44b256bde17a5180e1d33737a7cb6e918c59646bd49d03aa5b9968d1c95afd37c9a35e8ae55bed365f491
SSDEEP 24576:mfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn/2JOt934J7Z6bQaj1BvUm9J:+a5POZ3lJt2pasx2+moJE3jM2ce
TLSH
T1BE65BF5EA6FC01D5D179D17DC583861AF5B1342653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b08105fb04dffb2d6f734c39a032cb03192d0e7879624e2721248f0c1a8e1532
MD5 7a22f4789d86b8eaf0270c2cca9aafd4
SHA1 84016de01d77ac7e7922f95cd08f86c282234319
SHA512 9149fed0e13e92991967da310157acabf1f43787135ebe16bdc473d067554503c6a107a646622b9dbdaf5ae0b0b5c0b9b0fad187c4188bc02419bfe6c0e481b2
SSDEEP 24576:9NcwHdjbyQ4nLC18lb/EOjowL7Fkx2JOt934J7Z6bQaj1BvUm9J:9Nc/zEOVHF3JE3jM2ce
TLSH
T1C1857B1622E901E4F1BBE1BE89779546FA71786957308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a9118604ae1c6f9c27843156fff435cb0393be20ffc2cea42fff6f776f1c97bb
MD5 6965efec0f546535d815a6e54c914804
SHA1 98dfcbbbc29dbd634ffd729a0c233d76d1d18e69
SHA512 4dd107fbbb2c7b0cee3afd2b53daca3c8e56f94d99efa5e87d316d2a02776ff8aca721736c9f727e63a9f00961a17f65e12d1c37b926b96953881f746f2f81c9
SSDEEP 24576:/zkNvNnaFeYhJNtmZBmm2JOt934J7Z6bQaj1BvUm9J:/zMwBtOmFJE3jM2ce
TLSH
T1CE55AF2EBAB806E4D1FEC6B5DD238512FA727861073253CB5290C13E0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 0d01e3fc52c7cd5c8010af44b7bd31c23069c46eba0dbea0c7f853752f4b5a3e
MD5 bd0e66c06ab383671e900fbea8951d0d
SHA1 4dbc8ab404f5505de52af812562d1b0b32899707
SHA512 2e0398c1973a2c45bc79bf0f9567e58ef81db421e94f6309dd30e124091a60403aaec521b387799eb7f4cc097c7182ee96cc7e384ed10467b7fa44069ace8ec6
SSDEEP 24576:sD3FHshBIYQgAO2JOt934J7Z6bQaj1BvUm9J:sDVHeBIAAtJE3jM2ce
TLSH
T19285E12EE65C04E4E57BC1BCDA638902E77138AD07216ADB02D4D1B95F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/52-162-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/52-376-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/52-156-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/52-154-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/592-201-0x0000000140000000-0x00000001402DD000-memory.dmp

Download

memory/592-195-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/592-202-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/592-393-0x0000000140000000-0x00000001402DD000-memory.dmp

Download

memory/880-411-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/880-176-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/880-391-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/880-169-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/880-170-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/880-409-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2056-144-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2056-359-0x0000000140000000-0x000000014026E000-memory.dmp

Download

memory/2056-150-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2056-143-0x0000000140000000-0x000000014026E000-memory.dmp

Download

memory/2096-166-0x0000000000400000-0x0000000000636000-memory.dmp

Download

memory/2096-390-0x0000000000400000-0x0000000000636000-memory.dmp

Download

memory/2484-193-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2484-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2484-14-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2484-22-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2484-20-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2504-397-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2504-224-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2504-231-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2504-225-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2828-135-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2828-95-0x0000000140000000-0x0000000140274000-memory.dmp

Download

memory/2828-141-0x0000000140000000-0x0000000140274000-memory.dmp

Download

memory/2828-139-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4892-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4892-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4892-223-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4892-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5076-182-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5076-394-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5076-392-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5076-396-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5076-188-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5076-181-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5396-218-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5396-213-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5396-215-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5396-207-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5396-206-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5668-40-0x0000000000400000-0x000000000068F000-memory.dmp

Download

memory/5668-0-0x0000000000400000-0x000000000068F000-memory.dmp

Download

memory/5668-1-0x0000000000DE0000-0x0000000000E47000-memory.dmp

Download

memory/5668-8-0x0000000000DE0000-0x0000000000E47000-memory.dmp

Download