b1bdae5544d085f6575f224c32d508aee140c7b38fab0c5ab8f33824589a6d0d

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 11:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_3c3f395229c4670d9fe8cdf3378da36d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 1.2MB
Sample260706-nhwp5sat3p
SHA256 b1bdae5544d085f6575f224c32d508aee140c7b38fab0c5ab8f33824589a6d0d
MD5 3c3f395229c4670d9fe8cdf3378da36d
SHA1 55d7d5a551f09e1548baf61ddac89ba085bbd8d5
SHA512 ff67c5933f10ec8eb30fd080c999ba94bef27a4170105bb84af9e7c0f797db3a4b2303e42b2358522142c1726f180f009d3dbd5b0dcd654ecfa8b5e0fed55da6
SSDEEP 12288:/OTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:/A7Nnm5uqLazZn3zAj9
TLSH
T12855121A7453C133EC064A71935085C06BFE9D8375E2526FFF15AD4F0AF52A88A1AAF4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4472	elevation_service.exe
6104	elevation_service.exe
2864	maintenanceservice.exe
4348	OSE.EXE
1484	PerceptionSimulationService.exe
6036	perfhost.exe
6644	ReFsDedupSvc.exe
5972	SensorDataService.exe
6688	ssh-agent.exe
2360	AgentService.exe
6728	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-06_3c3f395229c4670d9fe8cdf3378da36d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-06_3c3f395229c4670d9fe8cdf3378da36d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-06_3c3f395229c4670d9fe8cdf3378da36d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ccba0b4ec8b6c6e4.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-06_3c3f395229c4670d9fe8cdf3378da36d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-06_3c3f395229c4670d9fe8cdf3378da36d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_90781\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-06_3c3f395229c4670d9fe8cdf3378da36d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-06_3c3f395229c4670d9fe8cdf3378da36d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_3c3f395229c4670d9fe8cdf3378da36d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005349d84c3a0ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b85240093a0ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f1ce59093a0ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005c5766083a0ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000751856093a0ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f1fd6083a0ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7e60a0a3a0ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b612ae4c3a0ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4472	elevation_service.exe
4472	elevation_service.exe
4472	elevation_service.exe
4472	elevation_service.exe
4472	elevation_service.exe
4472	elevation_service.exe
4472	elevation_service.exe
6104	elevation_service.exe
6104	elevation_service.exe
6104	elevation_service.exe
6104	elevation_service.exe
6104	elevation_service.exe
6104	elevation_service.exe
6104	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3260	2026-07-06_3c3f395229c4670d9fe8cdf3378da36d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeTakeOwnershipPrivilege	4472	elevation_service.exe
Token: SeBackupPrivilege	6644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6644	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6644	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6644	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6644	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6644	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2360	AgentService.exe
Token: 33	6728	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6728	SearchIndexer.exe
Token: SeDebugPrivilege	4472	elevation_service.exe
Token: SeDebugPrivilege	6104	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6728 wrote to memory of 1936	6728	SearchIndexer.exe	100
PID 6728 wrote to memory of 4752	6728	SearchIndexer.exe	101
PID 6728 wrote to memory of 4252	6728	SearchIndexer.exe	102
PID 6728 wrote to memory of 7124	6728	SearchIndexer.exe	103
PID 6728 wrote to memory of 944	6728	SearchIndexer.exe	107
PID 6728 wrote to memory of 4272	6728	SearchIndexer.exe	108
PID 6728 wrote to memory of 4916	6728	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-06_3c3f395229c4670d9fe8cdf3378da36d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_3c3f395229c4670d9fe8cdf3378da36d_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3260

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4472

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6104

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2864

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4348

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1484

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6036

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6644

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5972

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6688

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2360

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6728
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2581000985-3042091657-4068028891-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2581000985-3042091657-4068028891-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1936
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4752
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4252
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:7124
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:944
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4272
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0380a3d149d7fc71de217de2183c5ce7945b33a81732ddf5deb15e2bf3cf9fff
MD5 d95efc771243d4c06058a06692709cd8
SHA1 3a3ec8a38c1b73c774cc1f4231df415e3fc94a00
SHA512 507fa24d96e03e0675d45ab86bb746c7f7fabdae405146103cfb5ad01e7fe770e86115972adc8ebafe505ea78b9ac48604d4b628d04f997f0b6d8e390d96a973
SSDEEP 49152:ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxn1AxUsZn3zAj:E3q6HjBFxUc3z
TLSH
T19DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 4b4a4fbc3a0a216146bee9636283e8c4e1fae3d935893759dabada16d037a03a
MD5 84161efb41ab04e2b42df946c7eeb25b
SHA1 990b00181514d5832f744494c4ed45628381f4e1
SHA512 d5bb120deeafd92259715c522f03cd8fe505f82059c115b2bada596f8ace9696506fb422d6bd4db5ff20f1c55c04c4771133640bade67534c5cd32d7269331f1
SSDEEP 12288:+1XLsswWkxy2lRq2czAmOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:MXYfDtczAmA7Nnm5uqLazZn3zAj9
TLSH
T1D765F129B3D009F9ED67827CC9A18501E673B89547A0E78F03A4D96A1F337D84E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 26f4553e244d490df455d752eae09626e9bfc7bd90f330ec1349992319051dd3
MD5 d490064799f6711c896cb5fdc0011589
SHA1 aafeabcd1da3244f5fe529ef45b35dff5cfb96cd
SHA512 8b6097f35971be1f8d1500f653f4ffa3f57f5aa050da3b226b6e72f97685ca73ed0fd523dcd9945a3a84c6d5ffdd1cf846845fa59472634035c8c71062745558
SSDEEP 24576:G0Le5ji0hmxirMMA7Nnm5uqLazZn3zAj9:GPji0AcxAxUsZn3zAj
TLSH
T1B6859E16F5748335D073C0B9C5D2A68AE97230865B308ACB4296D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fe2801e9a14760be8ffae0c1ef55a8845a33e2a36f6bbaa742e7ff2db8cab1ab
MD5 13d678dee3ae6d9b59a67a47afef854c
SHA1 ab58c2700365decb307bc88223efba9d5f6f99e2
SHA512 ac1824ac46ac9ac7a45aa81b36a128312345ba5ccb675f6d55aadfff1aa0a238c0f7eb533a8c171ad3f2d6ec8c4395567872ffe9a1d5b811f72be3b70c437fde
SSDEEP 24576:Ma7/ezSC6vUyD/aqgrvWE6q8wyuOA7Nnm5uqLazZn3zAj9:r/ezSC6vUzPvxHjyNAxUsZn3zAj
TLSH
T1C4755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 498a9caf9d6e70286ed7ca1f6f6edddd83412ede3920485a0cfd67b0d67a2366
MD5 340d303a77c3569d1f9a835f73db11ea
SHA1 f9512e2a889ba221b12fce5b525990009217b6b9
SHA512 8a7c297970356801d560ada04245a524894b40a6e6e7af49ccb12700dd6376a860bbef86c1b77205f76a46384fe0876c316ee28062ac9407876b5a72722e3dec
SSDEEP 24576:JVbqPb88hv/l+6nA7Nnm5uqLazZn3zAj9:JVO88hXl+4AxUsZn3zAj
TLSH
T1EC55AE66F5748331D073C0BAC5D2AA9AEE7234415B318ACB0246D76C3E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 edab3cddb2af3ad0845a1f2906f5bbe5360aa826b84f74e457de872823bd6a2f
MD5 ff5c2316961c461696fb6065de5a3ae2
SHA1 69aa30c6d1854dd76003f146e4b1be23db936171
SHA512 04b2c132660c6552d203305482b2395d93f117c4bdecfb823e854280786701b5991db2c34f9fdda03e0f0ed7399d0463d3e0412c0d12252f68a6ac1d642ed915
SSDEEP 12288:eRAOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:eRAA7Nnm5uqLazZn3zAj9
TLSH
T1E945236390915237EEAB9BB1F72098C0A0C6CDC49890574D5B30FE4F1D7DA74CE1EAA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 fde47117840d21a03f856c884846761bfc6422959a4d7a3ada4d02b78693c921
MD5 630d35a8ce459d083320519567516e2e
SHA1 b52b5328c0f73bd1e334b1ec3d00c0173c85ece7
SHA512 cbefd0957da4960bc830284f583d17e0ec39d7bcc3c99819df71bf7a234e61628f79019badacd6b818b18cec372b20cab2e46ff04f74428f1d81002047a105ee
SSDEEP 12288:seBNUbTVO86UfOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:sJIUfA7Nnm5uqLazZn3zAj9
TLSH
T1FA65C03BEE28FCE2C67A8DB957518640E7A278704B5193CBD175C20EDE235E04E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 31c83c2ec351a4ad5bf6b9b61cfba750ec99c3d64edb89b79698f4f3474918f2
MD5 91608b90de5c956e9d8b28053f121391
SHA1 766ffb759b3c7fbecbfeb0eec5c302f432244fac
SHA512 de188e81e636997e73caabb174fcff07337144899055d86c6d0269912a258217351d2cfca50bd6b3f5cc9ab43d98a3e9df9c5aaaec7f0b8517b2c4a49580ffdf
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THL:xQvGAdlCEL8c/yRNw5CxxUc3z
TLSH
T170266D656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 a2e0756425bd2dff4469c79c7f4ab37cb3c56bbf32a42bee36eb7b3e9f8f991a
MD5 4408aeaa9c1edca80b370418c69454aa
SHA1 fe7b81754e3c211f32d7a26e88762fa18875131c
SHA512 cf3545a559d589b32d54fdeec770185c4e11442613caf55d64adc24f5e607e04722ba2cd8ede459ac2917e3347a4905f87e3ecbe7ff88bbb7d9452f95a1e6839
SSDEEP 12288:kAwSfxL/2Dc34DLLmt0LDQewsAjBOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzX7:5dewsAjBA7Nnm5uqLazZn3zAj9
TLSH
T1E475E031FA74E036C7BF0DB22B35C706546DB9604BA11AC3E3A89E8E59342D25736E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a51fa590ddad54adc256f9347f0b4df0ffaf9453f886dcd61b7f04499ec01d75
MD5 ccc734ce48c4465c31cb2e703f049272
SHA1 a7eed0b2ef97b6bb28c830793084c2eca8795fb2
SHA512 1b4d352a1112bc925ca9ba08dab961e717b6c5d0c2f1e3b8b9efdb630fce296895b086ad2977df18b9d914d1deca17fd7abe047faa5f8a432563cdfd3dbe6c07
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHOdz:FUEtQevvqc2W1cpV2EI32C
TLSH
T17C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f14c96e23c1001d0cba9a2c8b7de9f7f28b75d3997c2eef499c0581c02fb9e09
MD5 9ab9c02a6f42aa1d3a1df0fa54d14500
SHA1 360b46238a255d1b048823bbc8ef9ae573e3647e
SHA512 dc7172695e34dd84142f85d8c502872eddc1a15e360c0deccebb05bd8b7c910e8c62b23caa6d7046306f6ad43a4da9ef0d5863aedd4321bd3b880965fdb2defa
SSDEEP 49152:5CbRquA/m2yL5zifFiV+XenmE3/zhAxUsZn3zAj:WoqHVjnm9xUc3z
TLSH
T1A4D58D0976B8C2E4D1F6C77896A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d81a6897cc67b092c8366d2d6390ca68bdf20fb61c1f1bfc2f7eb7f62dd7a17e
MD5 13fad4fee65804b71ef7f49dedb89137
SHA1 a7c7cc941d2bd74f70fdaef0af1e5f5e7b5d7b1c
SHA512 4328b870927b820f3ee2a572faacff0a73a9972d293160657b9b36ce8a5ed53bea644101a8e41c544b985925d7344b63b9a33faeb32ff8cac367cef21214b6c2
SSDEEP 24576:NAhGLJIFoiwtA5l7S53aA7Nnm5uqLazZn3zAj9:NAMyFoiq5KAxUsZn3zAj
TLSH
T135359D81E7F955D4F5B3AAB899B68570EAB6BCA55E30C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 8fd4f253892eeab2db265631f8e700c1e59332d8f45a03d0c8bc11d7a829d0ae
MD5 c7933c9f4360952e264ca26b2018c08c
SHA1 5c4e78dcc08f8222df41dfe651c742f150632b4c
SHA512 07503dcd9608633bdf6531068d50b905e6ac5b8bdba109256dc38070716bc7a99f5d850beacd17450d82cf61b3cd4dd64df326e430be9f1ff2922a5a215e2058
SSDEEP 12288:Smw5HEjsChNVBFgl0WDm+CuOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTsZ:LwuoOWtA7Nnm5uqLazZn3zAj9
TLSH
T15165F14672A40CF9E9678239C657C531F7F2B8412A21D71F1760CA5B6F37361AE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 1b2fd72242f093f811be9a9a2c1b9f09f4fd865449a79757bcc10520c7a446d6
MD5 e5b5819e4ff3ebae117e720f8a63df89
SHA1 b0dd696f79dc44fb9d70f700491abd89ab0dae0d
SHA512 0cb55af4e53615a67932b48902deaa5786b43138c2237c310aeedc40bdd452b3cebda2b73bce2df2b9b2de2361fcdb51f2240cf17d7c67304e02138381538314
SSDEEP 12288:OBZ1IyROTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:IZuEA7Nnm5uqLazZn3zAj9
TLSH
T1B755125B32D421BAE5A38378DAA04540E3E2B895577143CF16209A5F1F77EE18E3E732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fea7d5308617b17f3f4b3b126b84db7fc63d9f3b410ec0437457c6b4daddb09c
MD5 88d0a43b0192504b5a833c9018b17167
SHA1 c4ba6310da7bc69fb3af44e9ea435d23ba1f0250
SHA512 4aa8ab76e8788c5d095ab9dcdd9c116f5013e2e4e38e09b4bc359cce689b6c3f978e6aa5e8aef391cf69fc46efb64c5a202883742476f498852a6bae7d345a9a
SSDEEP 49152:oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UX:PQRQyi36YOcPQLvw2gAf+PN3UxUc3z
TLSH
T1DB667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8d14f1a25af1a54ba8949827efa1ee5ceb2cb96d54d7361b37d07797dae73a6b
MD5 943f0b95130197b60144385ba05eada5
SHA1 0d926aa88b8de8e17f7fe3f6153d8bed70305d14
SHA512 e0677e5136558eb4b82bf83345f9bdf01239044e6a417543c0ccd4d2b37232dfd64e17e5734a1cd8c1fcb9a690a1d173be3fb2c6a3afb072d6b7a8aa14885993
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UX:/QRQyi36YOcPQLvw2gAf+PN3UxUc3z
TLSH
T11F667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d53e750e318003e082e927e61e7a3d68ec51c378785b680d307a6c34e5fdf1be
MD5 a15bc4279fed805491a6088e4b1fad03
SHA1 54adbd42c8a2ad57d53d133de0874d9483104562
SHA512 7b922069d021d7ddde375cbb7c49f3c232bd19ce6697e8a45439cb9d5763c98fbe6524005a34406a74b42b8b05710ff40fb2017f13145724da99dd8e7536aca3
SSDEEP 24576:uwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL00A7Nnm5uqLazZn8:Y68Qg55nhheWu7PNU3/xAxUsZn3zAj
TLSH
T13EB54A33B2F600A9C44DE1769F46872196D27C758FE0E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 adada1b614716418ffd49911aefa51f8c81affa586ebe8ac2524728537692907
MD5 a11dc55c05501099e0f8192d83eed063
SHA1 1516834eb93dbabf110739b74a0a1f9380f0eefc
SHA512 2d073fab5ff3b88cadf4d28f1ef65b14a7a41daf5f34a9bc66d8a2324d1c7194f5e071ee7a6f2333c091c84b00cb92b18af76ce33aab2f3d1d046fc27ac1aa2a
SSDEEP 49152:13aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99d:0y5112gYy5azzVvL69nLKnhZLxUc3z
TLSH
T116167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cc768418533072c9a23ea7b34f1e3300cd642b154c98fadf19b36f5d46b1fcc1
MD5 d8c58d17653abb52a71de811a003d75f
SHA1 7178e5ad2469b3032c3a71370e0e96cbe2b1f965
SHA512 03290610316c93dfeae593bdcd3558f082e8849cad701e3d2403588e942b8a054684a7459dda37151e3b17a7f0c2651441828b235e9782ec79da0d9cb6994d14
SSDEEP 49152:0B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl2AxUsZn3zAj:uu6JmVxd2dZxUc3z
TLSH
T174D59D13F1DA01E8D06ED578974A9232FA62BC490B34B6DF0A9073562E77EE49B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 edfab02b01d0df44101ac82481a0bd7b5f4546d0653dd0c52001e15023c32f82
MD5 f7a4d1bb97cff16e4d252930b20c762e
SHA1 027518e430a95409b85e1fc520e7cc834b587778
SHA512 3e2c8c8e47035b943857eeea44becbf6f7a7434e3c2b45214fadfa3f26505dd438e5760e0dd413469f4ceb1f5b34206ae5cdf4227de0a1d68e7b540517082bb0
SSDEEP 49152:e1hpsNoJpF1A6UU44CwH7R4x/AxUsZn3zAj:emifPbR9xUc3z
TLSH
T100B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9ac6783fc0a2fb2a597d24d79e5e43349a33bff047b1ff8d15a3ebce679c9be1
MD5 92259fb4a2ce4e221e2a9439db2d49c9
SHA1 313c728f45b6c7f75d90d39607667315ca3802b6
SHA512 face6692c07c97b4fe10a244f039dd9a1d6260f621df018ddd4562ad5c71073dcd362c0f585abaa1a75eb263da229b86015b69328eebb5f56cb70ab7c148a4c9
SSDEEP 49152:ISuZQIY0Be2KRRVtOnks6NMHqEAxUsZn3zAj:S5dKTi61vxUc3z
TLSH
T185C5BE03F2E941E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3f0636c5e741273996296e34f743e8b23ff0bf0e158fad3ceb4a4cfeb7d15519
MD5 d08b7e2c6a862e0095fab5f53e97cee0
SHA1 3af2898ade52d9e1f1801b8626e9361dd5688588
SHA512 84818c002a1abfac3fb5ac32747e5f2929079caecdae6f523938bd00ceee0689ab4cf416483ffd6409a116a592278bdbee51df99eb8ddbb652bcb5d4c867ae2f
SSDEEP 49152:OhtSn8EApI0figngiDn0AP5wjAxUsZn3zAj:PX2iyphpxUc3z
TLSH
T17095BE13F2D900E8D05ED178C7568632EA62BC150B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 5fd4cd58e70845c3c0c7bfbd3b7dc87d97abce17719ff4fb7a2d54b0ba9b030f
MD5 14ffbc7c3905ec64325e40f8fa5007b9
SHA1 3c8d9ae76295543dca08b0aa36997a9cea849f3d
SHA512 925def66cb4d1465ce42f1c13d57354d73a50504e3982cdf81b9bf8a9106d2a8c341a6ea94e4145ab119b69746b5f9c8ca4df643c44b85da37964835b75f3339
SSDEEP 12288:g4OTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:g4A7Nnm5uqLazZn3zAj9
TLSH
T143452367A096562BED5787B1F72094C0A0C6CDC8A890135D6724FD0B2E7EE74CE1EAE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 658c02fa0815d3eb9e5cfc693759a10011777bfd685b15aa08c0c6dc69af9161
MD5 8ded889c2eaf297b46958bf49bd3c40b
SHA1 215a9e7514820a936dc499e656f2de5c1879e9b2
SHA512 5fb89dad2a890be8996e3e6edb2e54986e8dfb1fe9e3a3483fd503fc986a0df1d60eb65a2d363707d0bdc4765240a2892ca83f45887d0eba4eecb69f39ff6282
SSDEEP 12288:4VOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:4VA7Nnm5uqLazZn3zAj9
TLSH
T125452367A0964627ED5787B1F72094C0E0C6CDC9A890138D6724FD0B2A7EE74CF1EAE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 3e53f2263bfda1b64c8a2f4db332aef0c77bf39a5dfe0ee7042ba5f5f6c25940
MD5 d978a3fa89acd1a5a5f786b09f3aeeea
SHA1 62b7b6cd20447c3b8d273934fa265ecda3c85db9
SHA512 e5456a29beedebd4925c819ba1dad3ee73fd330cec9dccfa094b8dd3bb68cc5ccce235bf620252efb87d40aa81ce72fd239ebf9a0b00cd47c0e80a3e1257b70b
SSDEEP 12288:TXOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:TXA7Nnm5uqLazZn3zAj9
TLSH
T15A452367A0964627ED5787B1F72085C0E0C6CDC9A890139D6B25FC0B2E7AE74CF1E9E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 999a42fe01a7fdc0ae3949c6fd6b8b1c7639037ea83b9adcb06c4ac6903a1357
MD5 a558e3868b762143a9d5221c2150e1db
SHA1 5edca19290ec53e6beba8f7209cfaa97c4ced8bb
SHA512 f60f13fef1da6a1b3d8d9b1914d01ebfe7f14158b44979f2cb546fdc373e4ec55035a641e35e97650bc670872cbad53e679787ecddcd61c252f8d1daec6bd6e2
SSDEEP 12288:/V6OTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:gA7Nnm5uqLazZn3zAj9
TLSH
T1B9452363619601A6DC67C3B4E6208480F1D6FCD4A670538F5B20AD4F1E76BB4CE3AFA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4e0e0520d6afbef7c3e6d611ba0261784ff46018427a4f4c2da99ea6aea09280
MD5 2b1372ffc0e05e99184e239df554300f
SHA1 a0a635fa8a3997cd41a81745cf03c4f67d6e7bb8
SHA512 b9d796c10248cceb264d66542891383739748eeff38f013f9b1050f65e7e26232ea36a73caf29b324c59ab3fdf9f42160eed25a5be8a4d8f0c57823c0017743c
SSDEEP 12288:NCOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:NCA7Nnm5uqLazZn3zAj9
TLSH
T113452367A0964627ED5787B1F72085C0A0C6CDC9A890139D6B24FD0B2E7EE74CF1E9E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 df604a34f19675bd1a01700ba1a16f018c51cb0eb40d81e59d0fbd2765b8b815
MD5 7c0b048de5f24a2ae8f365bcaed7e474
SHA1 9a13f323f7eac6ac896b8cbc0cc368a1d0543ebd
SHA512 5275370b4a3415b213212a7ad9d44b1b6815ca78d6a8e1dd6132a0ea1044c7dd0a59e0d9122a3f94521d640912e10dae9f7c96cb8e1a28dd4c591c5f6b57cb3c
SSDEEP 12288:M5OTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:M5A7Nnm5uqLazZn3zAj9
TLSH
T100452367A0964627ED5787B1F72084C0E0C6CDC9A890139D6724FD0B2A7AE74CF1EAE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b8330d197f745aae03fce62a9df4228926f1da32357bb7c60c292196a5bc524d
MD5 1d01bcf1af4436368867fad31c53d74d
SHA1 e3ff9cb584d3eb99b56e8bae5e9abd6448f6d183
SHA512 86fc9652907b94eac647cde06139734f2556bf6336b877c7f88cfc2e60b2a59f0f6877b567e64e03300d2ae7c2819b6dbd779d5cc9e81d641dc0824e7001de29
SSDEEP 12288:qdOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:qdA7Nnm5uqLazZn3zAj9
TLSH
T175452367E0924627ED5787B1F72094C0A0C6CDC9A890134D6B24FD0B2BBEE74CE1E9E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 143c06e0aae66906b3259d3658a10e1484e13e4abe2a2ecf8a7a1976b56fbea1
MD5 aac691434379994f49a13f90fc0c017a
SHA1 9919325ff5958a8db27ff2398300f94e0dbc3c9c
SHA512 c55cb8b791f0297ab9a6d0df7a4e16e9765f26007413a8842c8a7cc95238e8493a03f3176584b41091ea8227203afd8330b9a155ff46e5ebe8ce339813c55fc3
SSDEEP 12288:ZiZwb6zzFEoS2cPvy1OTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:cZMSzFVSO1A7Nnm5uqLazZn3zAj9
TLSH
T108650195B39018F9EC67823EC9258945D2F2BC590A70C61F03B43A6B1F737A14D3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 36fcfa286867c298c907664484d1bd79720390f73d62ad5f77b03685fe8872ec
MD5 8e232f95bb6975c13a6a01a535ceb374
SHA1 627260568a6e618712c4580996bba7eaf11335ec
SHA512 6ddf3925b278db2739aa0afbcd2d520348a944bd0bb55fa4432d1bb32f61fa6c19d7cbd3005dcedc321c0255dc11856d892cd8851e10f70c618f8fc82889644e
SSDEEP 12288:2UOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:2UA7Nnm5uqLazZn3zAj9
TLSH
T125452367A096562BED5787B1F32085C0A0C6CDC9A490138D6B25FD0F2E7EE748F1E9E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 aae40c89c7c948edeb05741ebe2fcadf401585e5effd8bf89bd9ed6204800f02
MD5 0b0be9b30515bfc01b35b9fba35a3599
SHA1 749a351c087ff0393b3aa4f241e49442d08b44f8
SHA512 fcd88cb388aeb22ed8dbe6259555fdf975301f4e0ece09a3467ed77807a7cc647df63827ce09ddf9765dbcf816d4938d3fbdfae323f96b45ef428c16d400b7e1
SSDEEP 12288:yQOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:yQA7Nnm5uqLazZn3zAj9
TLSH
T162452367A0964627ED5787B1F71084C0A0C6CEC9A490138D6B25FD0F2A7EE74CF1EAE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 3d4d5429aab046c1ca6cb963580eb5879722e5382811f0eeb05030f498a0c93a
MD5 830e7ea85663cf30180a95ff40fd549d
SHA1 fa5e1cddcc729fe3b12ebd80cf96e8243a0603eb
SHA512 984cbd925ca7980314b127ea182b298cb310615e0f464fd6e06442e64d9c6b5fdd673278c707e918394202f08ff730fcce4cf12ce7f128e6d5f4b1202895af65
SSDEEP 12288:vyPz5L8ROTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:CzyRA7Nnm5uqLazZn3zAj9
TLSH
T1F155021772A130F9D5678374C9611A41F3B2B87547608BAF17609A7B2F376A08E3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 1012087714b41f526220db9d97b844000546bd235d1d1e331b73c3331178888f
MD5 2d04e22c26d4aa87894b6539c7d14ec7
SHA1 6153e84e2fe1bf6a7118105d0e7005399617f499
SHA512 7ecec121154861e4c9e0de74fb23c65ff5ecea1b774caf7f73169ea60c08d7989b11bc219c0ab6a097115b18afe9c0617876271f3b1e4d4abede763838e514bb
SSDEEP 12288:tUOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:tUA7Nnm5uqLazZn3zAj9
TLSH
T1CD452367A096462BED5787B1F72085C0E0C6CDC9A490138D6B25FD0F2E7AE748F1E9E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 efe8a275ed386be3740f0293d60c2f2c52c056d790a7ef0e4e1ec1ccb646de96
MD5 c9e0359785bd3e0eba49a3eeba8c090e
SHA1 22de02753554be0576a9c11e5c067851dcf01faa
SHA512 5652a7472131511d56e394fb6ee9d0646e3e2aa3590beeea8be101896fa5b6b4b2a51554251ca783e2a38d2d05321a6b07ac531e77a234aa532359ec84393f8b
SSDEEP 12288:lUOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:lUA7Nnm5uqLazZn3zAj9
TLSH
T182452367A096562BED5787B1F71084C0A0C6CDC9A490138D6B25FD0F2E7EE748F1EAE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 d5ddaaab98a084ddd10523e9ab1b6ac3311b6038e9880dc86d34535ab03ddead
MD5 462600605ebb7688e3e541c671e16ea7
SHA1 d9e864233cf2b58fe9fb91dbdd243cf6ae131d05
SHA512 c9cb893ec8325151781b66480bbabd34c56cafac8ca2cbf70e08c5c2201300fbdf498acf614273f6551ecc6f354f1e82f141dbccecb9422e9e9bb2e9b3865433
SSDEEP 12288:GyPz5L8ROTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:7zyRA7Nnm5uqLazZn3zAj9
TLSH
T1E855021772A130F9D5678374C9611A41F3B2B87547608BAF17609A7B2F376A08E3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 dfe25291f5d965d2dcbb112455337af451d89828bc70d30e9fb600ba7e433e40
MD5 36843323f04756abcb93b6520407bf76
SHA1 28e2cb196c8308e8d36abc84a4f68657633ffda8
SHA512 b7c9811c6cf74327bb2af67d720c788f20d543ba6d36ec493cb98ec9037b5adcf215dd744087d45faf047f7d4d0e2b5396e52c0121ce86e5b57c245eb2101532
SSDEEP 12288:LCd9eWYoaLHF3z0z04PDvhHOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTsZ:mTHaLl3z0zDHA7Nnm5uqLazZn3zAj9
TLSH
T1546501A5B39018F9EC67827EC9258945D2F2BC590770C61F03B43A6B5F373A04D2EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 f12f065f0620985e5e7fd939e7ed53c9255b8944a81ac71b3ad5195d9a079a11
MD5 26190721183c4fc5515598a2de4d6d31
SHA1 01112211994d2c8c2664faf65858f581a76a0bc3
SHA512 09345ecd7402518f1ebe4f636f1073639361238f7d46f3bd303e6091c587c7905eaddb7421f555cd55394416eea6d8f6aee9bd8e9c07ff2775770337dd5f9991
SSDEEP 12288:zi4e7+RdTfgwCHKy7GLbbdIvWOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYio:z37d9CHKy7GZ7A7Nnm5uqLazZn3zAj9
TLSH
T16875CF91F3E410E9F0B79A35C9764501DAB67C991B71CA8F03A4661A1F33BE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 bbe0e3dfdb93c3dba43b0d109d732eefb13f4aea43153dda4d087f142c996375
MD5 a35f06041452881226d22e70c1486fba
SHA1 c6243421bb4e7b61c399d1aba64c4892bf8d7770
SHA512 1cd211d2d97bc2173c45645091a2a8b7b61b8931ac25357e91b701bceab9c84c54bddb03f42868b0542cf765e98f193adf27a695729629c99fe2b8265e77541b
SSDEEP 12288:X3OTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:X3A7Nnm5uqLazZn3zAj9
TLSH
T11C452367A096462BED5787B1F72095C0E0C6CDC9A890139D6724FC0B2E7AE74CF1E9E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 6c4d450d09472de7ebc1bf61dae49bd80112c6a89048f0af9340d8be4183d06c
MD5 b724e9f4596f3a464bf1b2a43acaf25d
SHA1 5cf359f53739221028be00c46717f63699e6a2a4
SHA512 460e1564ad353d9ec420f54b352376a66084a86c64c6b08499a4af39f1978129419a02e611eca9a20d6eff3ccf959c5b957c6992652c3c96a9f80f9cb30e2a27
SSDEEP 12288:UxOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:UxA7Nnm5uqLazZn3zAj9
TLSH
T1A1452367A095463BED5787F1F72085C0A0C6CDC8A4A0135D6725FC0B2EBEE74CE1EAA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 d1e9f9789fe61664d377b2c94a9dbcc0d4457345f48e24571f67aff97ac0d369
MD5 58f775efded1eb60d770a6a2af0462b5
SHA1 b822d62b285cddc1c8db7cbb56ebddb419c39c62
SHA512 e37ab3ad0f7cb376cc794b1ed202b76b146916b220c96e120e2008ded34ae90ee972076f7191d2b31940e447b94d2a40b80e3bf4f5993441f7b0b65c3a7dcb1e
SSDEEP 12288:TWOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:TWA7Nnm5uqLazZn3zAj9
TLSH
T10D452367A0964627ED5787B1F72085C0E0C6CDC9A890138D6B25FD0B2E7EE748F1E9E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 c77b95a8ff7f458718a1292ca71bb704fb773eaa8fe238d4feb3871521690af2
MD5 1ac9b0027b7a02cd7393a0595e85f39a
SHA1 19485610387d23efcdca91165196cb9b182b8d2e
SHA512 3ab1d8aa5637d7739f7bc96b28bafd7d0822015a2e698a3f5f8e092714db633545e184a4d2ecf525ae5813acc9e4c83abc590d3e30ce4ffebf6bcafb3fb2cdbd
SSDEEP 12288:/UOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:/UA7Nnm5uqLazZn3zAj9
TLSH
T1CC452367A0964627ED5787B1F71085C0A0C6CDC9A890138D6B25FD0B2E7EE74CE1E9E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 5986de573961bfe9daed9b8b58c9c2727aa7376da2373ae34c62d97323151c8e
MD5 e3ab93709ddbf76009c072ff8444d711
SHA1 6b2ac1532ccdf9b3ddfe10c9d313d9466afb4506
SHA512 58e28253f43ba805281b473559a7dc2d2196c1cc868307fb2b3a68d9ddf007cb5ebf2d065c53d8e21b9c26618c67945bc0d33cbf3282da3ca5b6922e99e11f04
SSDEEP 12288:c3OTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:c3A7Nnm5uqLazZn3zAj9
TLSH
T189452367A0964627ED5787B1F72085C0E0C6CDC9A890135D6B24FD0B2E7AE74CF1EAE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 45bf40a27cb63e658ae08a8dc3a4c34a04a01e1456728d1c61e7230175f031d6
MD5 60380feb47721439c7949a3691ab5b00
SHA1 ee4f2567c629dce18be14dbdabb01300192bd3c3
SHA512 49f61d4fcf657f06f207b876698ccc5790e3b5d13568aabe20ff7e94893edafa4d11c98050242f5bf2a3584e5936c325eccf709e3b2075d19f944b3447ef8fc6
SSDEEP 12288:L8OTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:L8A7Nnm5uqLazZn3zAj9
TLSH
T110452367A096462BDD5787F1F72085C0A0CACEC8A490135D6B25FD0F2F7EA74CE1E9A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 cbe144c91673c32a937ce2ae80e76343b0584a8ae5189bc97d05330173133f6b
MD5 522d4abece6435c1d249c13fdce324ff
SHA1 4a93411949d646db5590ff4ff0a1d533b3ad2312
SHA512 a960bca395e5a0ae4b06dfa5b5c25874f53c35ce48348ee1410c3d95c12e86a0f3d6381b6348a23748a5e76fb0f8cc52e2671a34cc63405bd9f4ae6d6eda7802
SSDEEP 12288:1COTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:1CA7Nnm5uqLazZn3zAj9
TLSH
T18D452367A0964627ED5787B1F72085C0A0C6CDC9A890139D6B24FC0B2E7EE74CF1E9E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 55f64d0c3a0ea3259ec51092071aee29872d1f670028db3948487dfaef392f94
MD5 c75d945c853b8448b59610662cb45899
SHA1 f3d073aa3d664a94c2cc7bb306ea58f78077f669
SHA512 911730c7ecbf3824aaf388549a962c5937db998173dc393b5a4d45283e002a1dd277abdbef176d33ae2f060e21c3701c954d648c4c5be33f03f7570e95ce56dc
SSDEEP 24576:Cfwvok9RX6wkyAIgA7Nnm5uqLazZn3zAj9:uMnYIgAxUsZn3zAj
TLSH
T17085D029EBDC44E5E177923C99B3460AF2B178591B31C2CF125A536E0E37EE45E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 07812ff9c661b62988237d20cd29c6c990cbd88797ce0ad062418f864c245d31
MD5 d47a795fde986568f9fe1f05dc64c626
SHA1 f93a1c957e86a36032d120a96bedc6d080d78be4
SHA512 675d5796799e8fbc477cece0c18d8c324def132018042bdca9c29aa154a418e2deb599185055f44446f68d1a6a8885ca46bdb9a381287c0414f639ddd2c2e09f
SSDEEP 49152:RYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0DAxUsZn3zAj:5ySzP0xUc3z
TLSH
T1B2067C57A1A801D5C1B9C1B98B0BCC1BFAB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ef4f3242f577629617bbb0d9fa8dc7e55efe3057abb2bac3920443b077b8fb00
MD5 b91ae339bcf6c914c7e5c9e035451105
SHA1 323b37adb17d0e860c62d819fe650d041891b84c
SHA512 fff169815134bf8222ed053eaecf5e6399bebdce28b47e514101604020d2fe77062d453a94961f1c55252f5e8ff2c9e2abb94dbcbebb8a2d0588396369cc57e9
SSDEEP 24576:z47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYFA7Nnm5uqLazZn3zAj9:z47JUQj1irIhCnDHUPfF/TAxUsZn3zAj
TLSH
T1C165AE1EA3EC01E5E1BA927885154A5AEA71782D1F31CACF1270837D6F63ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 a9f6c0fe6f744de01cefc6110ffccc44cf26926cec46d6be7de3e870ab8a7413
MD5 98557de6a4c485f853417dbb7523112c
SHA1 cdc2dba43bd8de0623fa47ed0f17e895f4062c03
SHA512 8a1ffadd9652841f27210a1540f8d99ae94b958fd7c07f2f15416cebe85a86420be39565ae0a8198f696e9faeac93c4a2eb3d6ff95ef8bde0b285927812e648a
SSDEEP 12288:RNsfEOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:WEA7Nnm5uqLazZn3zAj9
TLSH
T10255F11AD29402E9C46E6275C7114A40F3A37C6487E193CF57D0F93E1F7A6A08EEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1012KB
SHA256 685d633af3634a363be6b7da78cd96a89dbcea43e5dc77358314949b6b27ed12
MD5 a8b303d7660b51f94c306e5d893d96d0
SHA1 2256a589e12ae6247f2fbb4fd5c4b9c5dac14d15
SHA512 394b6603dc433efb1a0ca49588e9c3e7c5ad513db6a6a7f3dbcfeb86981206c7f04cd93997e3bc11da0f44c4e3528af48259efba61a0192fcddde816f34e17f7
SSDEEP 12288:QwC6wU3fJJTyZ+PUaKhIu4jsa+POCzMnHffYtELaRMnOCMQ:QfXUPvyZ+PUaKhq6VwnHffQELaRu
TLSH
T100252800B666C75FC6A940321E73C5CCAB707D41EE44AB0772C88B3FD576658BAF6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 7001f3d1df346a02ce56d013e971379b0b0be9cdbdb8024b5a6d052941023815
MD5 83967cda1bf797126da1835bf2c995fa
SHA1 3102e8f2f9611250fc6dc67f1046286eb12ebc60
SHA512 1d4bf7555bfa830ca7fb62f57e44a3cf3e89ed4098c224ca3296fb42983dadf4a68ed2e6f2e54e8c2e414d0095c4db4ca0a7bb67efae9bedbc19378c5c084282
SSDEEP 24576:RhNZ+PUa2aKhgZ+PhadPUaKhmZPBlZWZ+PUaKhPZ+PUaKhMZb0ZUZZIOZMCZ0BZu:RhNZ+PUa2aKhgZ+PhadPUaKhmZPBlZWm
TLSH
T11565FA41E437E38FC1BA1072073A5B8C6BA4EC17BB456F26B388453AD867715A4F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 85a4d9ea3b15134756d4ba941785d5e377f2b6af4dc12bdd1eb48ccda9bb4e56
MD5 ef03409ef28edda6f8892a4bfcbfedb1
SHA1 ecbea43681b21e27030325267613134d7dd29763
SHA512 b32ca554487156358b9fe4e40c1db9c681bf7d0ed25d9a6c5e562e1f5d0dfeb50fd63ff9f3b809ebad662d63da9f70e70f9849305ff52317a57dc75ee97e3ae3
SSDEEP 12288:sz7sOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:asA7Nnm5uqLazZn3zAj9
TLSH
T1E0452323D1955627EC7797B0A2248440B0CAEDD45F9042CFA710FD4F2A79EF4CE3AA99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 34939ed139615bc4077f48e926af077a37e09b818595a42f9b5e6e85fd206c5a
MD5 e2bd1871e0998f59b5b97b5f3a888e72
SHA1 596e8a93da64c288750246d84c71c5ee874a5b32
SHA512 1887a7d8d0576ccd2aa395613b97e47549335e9cb0cfba34c71271e1b7b4be4512081ba50d19afd6129effb925c9c447a534ecf74f944f514498a40ee3db6824
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bYOA7Nnm5uqLazZn3zAj9:egb4mBIBhGFFAxUsZn3zAj
TLSH
T10365AE1E22EC02F5E0FAD2B8DDA64417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 4d3901221911da040d1a62a2a049b50e37027f22efe805886357355b15b391fc
MD5 0e83e6f0bc123637cd5fabf283870fae
SHA1 8e8c64a665e69ddae55d1b83992377b0bd7b7a5b
SHA512 02ee66ffa3668be99eddd2f6df2ff6f1018fe6135a72051b755669d9b0db9c382356b90e02d6abc8e8319c71aac7bac38d105f20ea487bf3dbfc5df19f13686f
SSDEEP 24576:RG88u8FpJqH1bzria7/m1A7Nnm5uqLazZn3zAj9:07ZFPqVea7/2AxUsZn3zAj
TLSH
T19585F16576E101F1D47BD1388A424663F6B2B8251360EBDF07A88B561F33AE54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 5f71b44c79744729dff834802d46702a19138c0cd548a8f1b10c32f21ccf22d5
MD5 3479cdf1a248d6ca5d7e8cba96dceffa
SHA1 05e33fc65de406220570ff7ccaee775b6f058f83
SHA512 a975ee6dbec76e4c24e20b1ed5f611c445f2ff3ea3cb5505280f442c66e54a7f885ebda1b2afdf48345fc3e36d03370ada2e0ec5e0a50db10d6060f4c5ef0b24
SSDEEP 12288:8HvUrBFrEjwaQJOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:8PUr+NQJA7Nnm5uqLazZn3zAj9
TLSH
T19965F12F61E918E5E676E17DC5418609F7B2B462171192CF02A0817F1F77EE8AD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c00165fb6468a5e1d590568f09676a23b0bfbdbe8b9b5dbea8f6925c1a633847
MD5 645f2416fc104ded5ef80cd5757a38b7
SHA1 6589430a87efe1743947b272a8352651e693a37e
SHA512 2dc35c73ba40755ff0e507122b419591a93c552c29d3d0d3f8dca4e2f89e1b069ac38b2397ad816a115020971fb91814148d2f7761f00653840937822dcb3d62
SSDEEP 49152:jBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj5AxUsZn3zAj:MG05lO43bDxUc3z
TLSH
T18AD5CF6A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 768a01a418acfdd4a5d27e498c4addf5f8b63b54bc3bfe9a31065cf023900810
MD5 dff6fc9a9761016775f3ebc00df3a871
SHA1 e91ee3dfa1fe3b419ad18f7ccd0d5f543533347b
SHA512 f11943883a4eee84629eb427d25596f8426db675627a217624af868fe58ae244c4d09de35240ab1452d3d12ff4974bbf920a5240c8318538099dff05a62c7dfb
SSDEEP 24576:wfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnDA7Nnm5uqLazZn3zAj9:Ia5POZ3+Jt2pasx2+mxAxUsZn3zAj
TLSH
T10465AE5EA2F801D5D5B9D17DC683861AF5B1346153319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7452b3ad6386d3fff934549746cfea9f9fbe32049e7d5e7dc9f077dce324a22d
MD5 c52d276154d7e002ad520f4aee6d2e0e
SHA1 d11337a45007c25da08c3e12dd7aab509765d4c3
SHA512 1551f915f1212c02cda3b682d42e2eca47a1e36475e98658b1a9ba9fafccc6f4f5829eae097d346ef481f141600934ae24b61b95b26f492df42231ea861cfc41
SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7FkNA7Nnm5uqLazZn3zAj9:gNc/zEOVHFWAxUsZn3zAj
TLSH
T16F858B2622E901E4F5BBE1BE89779546FAB17865133086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 05249c07ae2b46eb62832200ef466c198f8f5a108412536b0aaf0c208e6cb3f3
MD5 b610facb024d9629cb265750d43005ef
SHA1 3a1a98de855c92419d8b164e1a9b12e80c6d7842
SHA512 d2e70ef03049f120667a2448e0fdd3905f1a8346b9d31f8b699b9de4e4979694f5a09eb8a534e7eecdb8b53fa08759fb2947077a1fce27894f74f2aeda67685f
SSDEEP 24576:b8kNvNnaFeYhJNtmZBmaA7Nnm5uqLazZn3zAj9:b8MwBtOmaAxUsZn3zAj
TLSH
T1D455AF6EB6B846E4D1FAC6B5DE238512E6727461073253CB5390C13F0E679D88E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 cc7d73e9e692b316d37d6e663a9fa803491533f79b0cb931ba7290ca4de4310b
MD5 e4706e8dff1c0fd2f9bc22693ae0ec1e
SHA1 a453373da66bc9ee654f0ec65beb84fed2e23692
SHA512 96281142740ca660c019577a9e544d7a9b148d61a3593f20989ac9336b0b14c41b5d410130226f54fb4a965db3dc7b736e23c86bd0235f5230649d9c5a7280d5
SSDEEP 24576:yD3FHshBIYQgAYA7Nnm5uqLazZn3zAj9:yDVHeBIAAYAxUsZn3zAj
TLSH
T10B75E17EE69C04E4D57BC2BCD6638906E7B138A9032156CB0294C1BA1F6BEE46D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1484-310-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1484-78-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1484-69-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1484-71-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2360-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2360-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2360-138-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2360-130-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2360-136-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2864-50-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/2864-39-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/2864-54-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/2864-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2864-58-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3260-1-0x0000000000A10000-0x0000000000A77000-memory.dmp

Download

memory/3260-51-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/3260-6-0x0000000000A10000-0x0000000000A77000-memory.dmp

Download

memory/3260-7-0x0000000000A10000-0x0000000000A77000-memory.dmp

Download

memory/3260-0-0x0000000000400000-0x00000000005DE000-memory.dmp

Download

memory/4348-57-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4348-65-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4348-59-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4348-306-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4472-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4472-91-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4472-22-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4472-13-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5972-112-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5972-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5972-315-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5972-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5972-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5972-105-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6036-81-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6036-311-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6036-87-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/6036-82-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/6104-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6104-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6104-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6104-123-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6104-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6644-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6644-332-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6644-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6644-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6644-93-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6644-99-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6688-314-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6688-125-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/6688-124-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6688-117-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/6688-341-0x0000000000770000-0x0000000000942000-memory.dmp

Download

memory/6688-318-0x0000000000770000-0x0000000000942000-memory.dmp

Download

memory/6688-335-0x0000000000770000-0x0000000000942000-memory.dmp

Download

memory/6688-408-0x0000000000770000-0x0000000000942000-memory.dmp

Download

memory/6728-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6728-147-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/6728-153-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/6728-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download