139f907bfb0d9184036be755528ce7134e89309e0c5db35cc0d4d39a621024c4

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_57322b3ef05c1f0e000672a69a15834d_amadey_elex_rhadamanthys_stealc_stop.exe
Size 1.5MB
Sample260709-msmdsagy8n
SHA256 139f907bfb0d9184036be755528ce7134e89309e0c5db35cc0d4d39a621024c4
MD5 57322b3ef05c1f0e000672a69a15834d
SHA1 a0577e405293dd1519d57a3806acc2e7d0c81678
SHA512 c809597b22512f569107f425a4062039fdbf2a6595cabee197d3f9f8243d2c51676280d993631f010cb37b6eef9ccab49975d627b3fc6cc2daaccb493230fb0e
SSDEEP 12288:rjndvQSr6XvbGIqBGr1m+91PLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcq:rLm5qMr1nDjf9n1i99k32tY5cz84
TLSH
T10E75E11077D0C036F1B324764EBEC665967DB9712F2191CFA3C0266E6E70AD1A931B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5212	elevation_service.exe
1512	elevation_service.exe
2884	maintenanceservice.exe
2372	OSE.EXE
848	PerceptionSimulationService.exe
4400	perfhost.exe
3436	ReFsDedupSvc.exe
3764	SensorDataService.exe
1836	ssh-agent.exe
4060	AgentService.exe
1096	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_57322b3ef05c1f0e000672a69a15834d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-09_57322b3ef05c1f0e000672a69a15834d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d6c81115ce3e03f1.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_57322b3ef05c1f0e000672a69a15834d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-09_57322b3ef05c1f0e000672a69a15834d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-09_57322b3ef05c1f0e000672a69a15834d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-09_57322b3ef05c1f0e000672a69a15834d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-09_57322b3ef05c1f0e000672a69a15834d_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_57322b3ef05c1f0e000672a69a15834d_amadey_elex_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e84fedc8f0fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000003d56420900fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000504637de8f0fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0128720900fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009dafcadd8f0fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3404	2026-07-09_57322b3ef05c1f0e000672a69a15834d_amadey_elex_rhadamanthys_stealc_stop.exe
3404	2026-07-09_57322b3ef05c1f0e000672a69a15834d_amadey_elex_rhadamanthys_stealc_stop.exe
3404	2026-07-09_57322b3ef05c1f0e000672a69a15834d_amadey_elex_rhadamanthys_stealc_stop.exe
3404	2026-07-09_57322b3ef05c1f0e000672a69a15834d_amadey_elex_rhadamanthys_stealc_stop.exe
3404	2026-07-09_57322b3ef05c1f0e000672a69a15834d_amadey_elex_rhadamanthys_stealc_stop.exe
3404	2026-07-09_57322b3ef05c1f0e000672a69a15834d_amadey_elex_rhadamanthys_stealc_stop.exe
3404	2026-07-09_57322b3ef05c1f0e000672a69a15834d_amadey_elex_rhadamanthys_stealc_stop.exe
3404	2026-07-09_57322b3ef05c1f0e000672a69a15834d_amadey_elex_rhadamanthys_stealc_stop.exe
3404	2026-07-09_57322b3ef05c1f0e000672a69a15834d_amadey_elex_rhadamanthys_stealc_stop.exe
3404	2026-07-09_57322b3ef05c1f0e000672a69a15834d_amadey_elex_rhadamanthys_stealc_stop.exe
5212	elevation_service.exe
5212	elevation_service.exe
5212	elevation_service.exe
5212	elevation_service.exe
5212	elevation_service.exe
5212	elevation_service.exe
5212	elevation_service.exe
1512	elevation_service.exe
1512	elevation_service.exe
1512	elevation_service.exe
1512	elevation_service.exe
1512	elevation_service.exe
1512	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3404	2026-07-09_57322b3ef05c1f0e000672a69a15834d_amadey_elex_rhadamanthys_stealc_stop.exe
Token: SeTakeOwnershipPrivilege	5212	elevation_service.exe
Token: SeBackupPrivilege	3436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3436	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4060	AgentService.exe
Token: 33	1096	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1096	SearchIndexer.exe
Token: SeDebugPrivilege	5212	elevation_service.exe
Token: SeDebugPrivilege	1512	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4364	AdobeARM.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 4364	3404	2026-07-09_57322b3ef05c1f0e000672a69a15834d_amadey_elex_rhadamanthys_stealc_stop.exe	91
PID 1096 wrote to memory of 1796	1096	SearchIndexer.exe	102
PID 1096 wrote to memory of 4256	1096	SearchIndexer.exe	103
PID 1096 wrote to memory of 1344	1096	SearchIndexer.exe	104
PID 1096 wrote to memory of 2612	1096	SearchIndexer.exe	105
PID 1096 wrote to memory of 3156	1096	SearchIndexer.exe	107
PID 1096 wrote to memory of 2936	1096	SearchIndexer.exe	108
PID 1096 wrote to memory of 1284	1096	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-09_57322b3ef05c1f0e000672a69a15834d_amadey_elex_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_57322b3ef05c1f0e000672a69a15834d_amadey_elex_rhadamanthys_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4364

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5212

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2884

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2372

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:848

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4400

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3436

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3764

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1836

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4060

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1796
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-515251955-468707340-1782030364-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-515251955-468707340-1782030364-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4256
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1344
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2612
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3156
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2936
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e5959dddc42876256ac00af65227121d98ad0fd40a43bf57371e418727a45a5b
MD5 ced323e9ba4acc46e6d42aabc46fd017
SHA1 21f08f94e4c1b027bd96c84d4c8536368634df73
SHA512 13b04959e09cd4069a7212bb8f5862703d34c6e7a78a8ecbce0459c43385bbe02ade7b333c8c7f09589a46da56e967853f33f60cfc851ee45505a6304942cb28
SSDEEP 49152:Hb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn+ln1i99ZG5v4:13q6sjBpEHGt4
TLSH
T129D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 9c06565f1b78df1767023d141365e0c1954ebb6d304f7eec40bfad0286bd1785
MD5 22ba27936a1251f1d8026821f3db43ba
SHA1 1bf94a3ddbc2aefc2ad83c0f34ed6c8c9e66da74
SHA512 47ee550b64cdab1a0f6f3689abfb8347a9fc926de1a95881b763304e50bc842a1a7d60b71ccb0686cc5e05d0a9982bf141a7f089af721966ee69459abafb9e63
SSDEEP 12288:21XLsswWkxy2lRq2czATLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:0XYfDtczAPf9n1i99k32tY5cz84
TLSH
T105650129B3D408F9FD27827CCCA2C911EA32785547A0E78B03A499662F377D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 2092c0f5779f0742f16bffa74d2c26a3be3cf25502d10d2bd0fb35e92da8db40
MD5 42254b4234cedfd9c7459b792cdbf447
SHA1 4fa5109e315a345e81312ca4792acb2597e0e40c
SHA512 41b6856bada75ae939e5ed2bbbe877989d32512ddb92394034d2f0805f455871c77a45180f1ba96b237a4e2b03938b017f2f67ff4bee29c67ea29042d8f66c1d
SSDEEP 24576:90Le5ji0hmxxrM7f9n1i99k32tY5cz84:9Pji0AjYln1i99ZG5v4
TLSH
T135859E16F6748335D073C0B9C5D2A69EED7130865B308ACB4286D77C3E6BAE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2700141b8bb9b344c8f1c588babb54392292544e7f2b5ccce02f7fbf049e838e
MD5 def8c830acf1cd8a467b338c1409d629
SHA1 eb234ea2425fd9ed0f5cfc30ff24c0c0f518badc
SHA512 9d585c69b4597fdb44e54303fb3a9eb92e846703fb6ece090c3350d8892aa0b1630c371b4d5cd6f12f1e62a886f7d7e69d16867b3e62f991617b92376457affe
SSDEEP 24576:1a7/ezSC6vUyD/aqgrvWn6q8wyuRf9n1i99k32tY5cz84:8/ezSC6vUzPveHjyUln1i99ZG5v4
TLSH
T176756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0434c88e2619efd86755038ff5387b7090012379f5fc7d6e511b07ca32b50519
MD5 0b31d27d9a895d2782ccf37f3b22d00b
SHA1 df6224b54dde3ec71fc7f09802c0291cc0d96b4b
SHA512 a23dfd18f0f9157777393d444449298f9df243969176df69d2320ce7ee2982967f2d87a0d8537cb60f8dd90c784a7be35aac564deb322855a1ad648603d1971f
SSDEEP 24576:nVbqPb88hv/l+Y6f9n1i99k32tY5cz84:nVO88hXl+pln1i99ZG5v4
TLSH
T1E8559E66F5748331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 9a2ad9983e6a16d1e118f7c5242bcbb11c8c292c49dc25a76e4858aaa4da85c6
MD5 9f27a2a991669ba5df51979a1151a22b
SHA1 69f0c9e927943a50ffdd6d057202874d1d66416b
SHA512 3bbe81521c4d772c13622f762edfd371fda2c5f5518960c007328ecb07f0876c5dd87bf9bf0ada7e91b281b635e463865eeefa75d7c69920390a50f1e7279404
SSDEEP 12288:SLjLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:SL/f9n1i99k32tY5cz84
TLSH
T18A452353F60891D9F71722BA9CE5CDF4AA785F0CECE8A812D3617A9738FCD78A050512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 5da11b4870b1e055479b198f260c1695f911ab2c8c5538534c2893d8c9d61d24
MD5 2a25fa3f779eb3331c537dd81fe1ff86
SHA1 29079aec85f32e28013a2e397823320724eb3ae7
SHA512 180cb9af169bbe5e018a661fcdccb48658aca01c20d8d7f0b9f30e65e6c36287036f189388db1c4ffed81739c9fb7431b6eb303b61ff84a14e0b819eab48c580
SSDEEP 12288:ZeBNUbTVO86UaLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:ZJIUif9n1i99k32tY5cz84
TLSH
T17365CF3BEE28FCD2C23A5DB95A91C640E77278304F61A3CBD165830E9E279E05D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5a6cac2d7d5d43e471a967c434403e09e0fbd30cbd55207119492c0916591a25
MD5 a10b27e63689e0fe785ccffd6e975d83
SHA1 d9e4628f6710add088a60f7f6a6b73b6ff72ec6d
SHA512 16947feb251b3d86d18fc78c285866f0092b27a19d27a92bb6dfca5c9fabaf3bc814c8c46a4f98f5530671b0970aa365ba4315895a4e93ce5f3ecbc7704b795c
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THX:BQvGAdlCEL8c/DRNw5CXEHGt4
TLSH
T18D267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 40a0123d79fa8269075a65d3d034c2d734023d8be1026f8230ddcb0738c2d771
MD5 a719c0f6d3964f9469a8e044d13bffd0
SHA1 341a663649108c91927b7dd7ae05e77109ba9d06
SHA512 c49e627eef7a2419cf1d2140333693f2113bfb467fbca94391643dd3d227f9e93720a48f570e1fd42814718f4ec092dc2d76e34b95630bc4572790a532506e36
SSDEEP 12288:ZAwSfxL/2Dc3RDLLmt0LDQewsAjsLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5/:K0ewsAjIf9n1i99k32tY5cz84
TLSH
T1A075E031FE74E036D37B0DB61B66CB16583C7A204FA119C3E3A84E9E19746D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a810241a9ad2f1eef4de617a3e210acb3a6e2ca5ae7bc61fa37e4ec632761c60
MD5 aa1eb1210ee511ab0d372bf97c0567b9
SHA1 8821f4239909d67a64a2ebd6b7009b86c392594c
SHA512 cb9ffee81c7af881aa01555a2ccbb595ef905d98b582e7c0c18017ba2d55c939389db80ceffb281ea330442bd03d3a37da4add3286cff5d6a3c7e529be3ca6eb
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHG0N:wUEtQevvqc2W1cpV2tI32
TLSH
T112474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 db5ead775d29c978f8619c128609442c0c9ccc9308426674613a260d55cc0e3c
MD5 47c3a893be1e65e56d64ab21e7bc902d
SHA1 e49a3c8e896ec163e8be383d2b340d5f4b841de7
SHA512 84e90d47ee214c2a75adb19a88cdebe90d975c35ef31d6af99ece9dcae5840be2ab0b5ff3cc7c21a63bda2f3de92d4fc6758968d2b13768b20b964a16c79badb
SSDEEP 49152:uCbRquA/m2yL5zifFiV+XenmE3/zoln1i99ZG5v4:DoqHVjnmLEHGt4
TLSH
T1BCD58D0976B8C2E4D1F6C77886A2C647F37178154B34A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b5d84298ad00a7ec66f72b058e9ab654ddfcb88e1d1bdf860ac2b4c94f483754
MD5 b2744f36e090ce0494d0392688a7716c
SHA1 9d4a21af5d499cc14f0e12c7e661afde75288444
SHA512 beced0e3f2cceb513c9bb7e51268f755826c3f157bc86c9557250609d5c5b619bbea80857175a78c71c9b421c32b06b9dff1b97e685287282fe23655ec2f71f0
SSDEEP 24576:UAhGL3IFoiwtA5l7S53df9n1i99k32tY5cz84:UAMUFoiq5tln1i99ZG5v4
TLSH
T110359D81E7F945D4F5B3AAB899B68570EA76BCA95E30C20F2160D11F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 fee710772e77ef2910fb21b4712794fa02688a9508b010b500667306de71ab9a
MD5 d06bcd592aa5a3878477e8bd41383111
SHA1 375ebcc03b24e6f7f46d9398e697d823bba09316
SHA512 89bc48967aafb963aede866d09b8fff7b06a33de17233750ea7f26cc83e3a222191e4e286ff5887bd24c84bd18f85de43115f113d22ea7d6bdce2c42e4be527b
SSDEEP 12288:wmw5HEjsChNVBFgl0WDm+ChLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcL2:twu4OW0f9n1i99k32tY5cz84
TLSH
T17265F14676A80CF9F9675239C997C536F7B2BC052A64DB1F4360C65B2F37320AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 fb8e8d00ab46155703cdb487e78d6b0f47c0897e3d6e334f1d873f538d71f6a5
MD5 5103e94264fe15ca50a6a99a0099d985
SHA1 bb1fd56cb69821240f322c59dc9cb17eca608f69
SHA512 cf53f60b950a2a4669c0376b8d7e75b9607e51e6968977ab766e9222c5c725c929b4421a98b613e7a125ce3e3c9a493b6cbbf8ed33fb0a33c83476b6f046cf9d
SSDEEP 12288:ueZ1Iy8LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:zZujf9n1i99k32tY5cz84
TLSH
T1BF551297339860F9F223527DCCE18A54E771781967B493CF5324469A2F7AEE42C34722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 946e540ff4623583c7ca1d123784e3576ca1b84c81444fefd5fc3770712d4919
MD5 78a079457331be169c73167b4ff14b02
SHA1 fede440971960fb3167931e45692ca0ee65857d2
SHA512 c1d7dd224dad26481d54afec656d40607e70b58369adfd0e9088a5f88aa7a62033dddbfb7f033fd49ee5cc9a371abc768deb7e453da3c2d85f23484c78b37a23
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U7:1QRQyi36YOcPbLvw2gAf+PN3MEHGt4
TLSH
T120667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 78af91cbfb678d2aa6a60f2429885a91c3005deaeb5d09585eaa6f3a61e4a9fd
MD5 580b3959a2c86cfa282d760a7fced84a
SHA1 8bb5fb78074b1cfdafb019d460e8a9cbda97e017
SHA512 2640d01efcd4e1815499937c5f4c16d7b922da817648cceeac299e4efb2b9f79743da6a0ee3f8bcdbdf3b58d13b0c4ac0f8b3b422cd6d56b28001074410b0b89
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U7:+QRQyi36YOcPbLvw2gAf+PN3MEHGt4
TLSH
T173667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ab2b6bfc42b9680e59072bbfd5faa0d6a88264bde26702ef9dc47241afd3bab9
MD5 4b06210e9270b35691164cab5845c92b
SHA1 ad3e740a8b0faf46380be20b27e82e86e9516bcf
SHA512 1f5b15062f1979cf42156a8a10534852d902a449eabcb806398491f900cbdc7a44a84fae33dae5045a70ad4e13321156ab57101678158e842775b885c1a73771
SSDEEP 24576:4wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0zf9n1i99k32tY5:e68Qg55nhceWu7PNU3/Yln1i99ZG5v4
TLSH
T1A9B54933B2F600A9D44DE1769F4A873196E17C758FE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e483a1bae1e6292efd8204976b3e46c26def759bd1d38676ce6d898fa4e9b6af
MD5 aead6acd074bf70ca4ceea51a84be480
SHA1 cc3e131d594e4782b858b2fad144b4730e486e5a
SHA512 ff267d2d3d53abd30a25c49ba963205ab50f900e237f52d66d42747caaabb33080725432041f669b2aaf2f95d495ec519802e7adf814e3c0732f1ff44b57ab5b
SSDEEP 49152:C3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99V:Dy5112gYy5azzVvt69nLKnhZlEHGt4
TLSH
T188167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4cdf003657871298726550aa2b94747dff72d8f273bc3cc9ec249217d335683c
MD5 90f6188f2c725311c9e226eeb39148b2
SHA1 3d025f1caa9a3867c81eda4b3d22b9a16a581277
SHA512 3e7410d316f4a33342790377afb437acc8aec568412cad02607b42684d23ba83c33a3526cd3ef268a21a1bc2205c9498a9ccda3529b0a5e352f48cadce84e450
SSDEEP 49152:+B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glfln1i99ZG5v4:su6Jmdxd2dFEHGt4
TLSH
T1B7D59D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 98989dc1dd2b35d3b1a0a6fff216fe8d680c21c4c21d2fc239b454f91c019c88
MD5 05efde2e9c6855c55a5f13667825c173
SHA1 1ccca451095b618438d7f07a4b59e1aec627b6db
SHA512 c13a271094e4a7b09d4fa16fb67b047054a3354957adcd6ca1eb0871b9dfd05f297998f5d94dd2465ae555c18a1ad9d5a520b158376982f305cb152371ead103
SSDEEP 49152:21hpsNoJpF1A63U44CwH7R4xCln1i99ZG5v4:2mifPWRLEHGt4
TLSH
T1B2B5BE13F29801E8D05ED17887569632EA72BC450B34B6DF0A90B7962F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c38401bacc4a0e972effdc47f2069a8123a8d2fb5d15e25bb35ad93f4023abd0
MD5 6b93300eed1bcc01c694a7fa20ae14b1
SHA1 64301e7b4080d1a2eecca63e49c2c8f6f75dad26
SHA512 136ad97ef8f2fdfdacb869fffd83c77362ead78aeb6f0fafdc8b6c509bf37dc8706de50d6689bb71b97e88d4722a82a82579b82ec9ed4e74830231e9cf802321
SSDEEP 49152:USuZQIY0Be2KcRVtOnks6NMHqjln1i99ZG5v4:G5dKii61REHGt4
TLSH
T181C5BF03F2E940E8E0BED6748B669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f5e411d7d7cee9733f57827cdef3f5c3ec74052db47c657cb6846faecb5c35f9
MD5 2b9cd8e1ae38d5c72ca5b5589ff34314
SHA1 793b8692929379e3b5a44e03ea908bf5226ab1c7
SHA512 9c43e842e0b8a1d36a00f1ff0bb54f99ab9cec9cd6c767d1f22d229881426b8fc4d17f006c872f4074528d2af1e22c5950fbc6bc5f892a0890eea302d6750e2c
SSDEEP 49152:MhtSn8EApI0fig3giDn0AP5wWln1i99ZG5v4:tX2imphPEHGt4
TLSH
T1DF95BE13F2D901E8D05ED178C7468632EA62BC150B38BAEF0A90B7561E7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 cb1fc350b3bf4c2bbfd940957f482fadb09e3a33a82d2a3c7ddd872f98034e1e
MD5 6c902ae2952be1f8beb4d8dcd49616c0
SHA1 17241a37a67e6e6ed3ddef2332d47062782ec1a2
SHA512 22d52c51a3695d4e7eeeaa0fe459bbe9915d345c7e55438a508a52c5ace1051710c66743b8227f0eca267daec0ab1ebba36630f6243f5f8b59a8b7bd63f656a7
SSDEEP 12288:MbLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:Mnf9n1i99k32tY5cz84
TLSH
T1DB452353F94882DAF21722BACCD5CDE4E97C5E0DFDE8A452E329255339FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 271c7935b903af2d0b892d326279a763213393dc81e1a2af2dd29bc6503acc26
MD5 fa702eca05725a58def76258c1f48e76
SHA1 9df5a67dda758a39b841ea096235b416efb04bae
SHA512 b3ad34052d5d01725059fe1942de99b30cc96f2ffe28ba2bd77c63e61b85a1ec2abdc2ef204b35f5f821b2a4e68aa7b15951a4affbdce8c078af2aded2057e32
SSDEEP 12288:wILfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:wsf9n1i99k32tY5cz84
TLSH
T1C3452353F94882DAF21722BA8CD5CDE8E97C5F0DFDE8A452E329654339FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 0fdf2f47b5fed9875ee6d285bf2767b2d34559d6ccba727c00d3e02217d4bd0a
MD5 c39f8f77373b5ded7c8ce3dfa897d6eb
SHA1 b2f234f0c91670cd40dc40d2725a0623c72552f7
SHA512 182dfb243e360b2a705e1b6b9f7aa5436e60f3ddd3b7b8fb19c1fb56c0bc1a7055d139b997750633272f64685ae0cb111021a4a5eca4ab2aa6adef70527ec1ed
SSDEEP 12288:mSLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:mKf9n1i99k32tY5cz84
TLSH
T18A452353F94882DAF21722BA8CD6CDF4E97C5F0DFDE8A452E329654239FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 65ce60e3c6ffbae7e0d37d27da0879e7fbcf2cf84c170156a37275b296cc78a7
MD5 02b6678115e465279d0bf3265029ff27
SHA1 cae96b20ce1631ed2530f4c83fa4dbb4c300e1fc
SHA512 88c906b26643740925fdac936b93d51688d50d3710f1dd1e1cc99c078dddbccdb84d36241b39e2e4be4a30058b5c8040374439ff663ee726f49ab66ffd289bc0
SSDEEP 12288:NV1LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:1f9n1i99k32tY5cz84
TLSH
T1EF452353B65841D9F523A2B9CCE2CDA4E6B87E4CEAB4A59BD31015473DFCF782420B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 fb4a6a06ad91cf77220604c0b47da52b2512ecab3f6135f6555c900bf6b02765
MD5 ab7b4f47f5f5a4f7e1dd236f12d4f2c6
SHA1 aee624bb6003c706516e7c7a4442f3b479d06dac
SHA512 5fd56d86f36aece16d608805c2b7f3e044b3e359877f539d9e9cb0551f7afa7e03ca7eec9ff9f098beb4e67d4b40600031e932dea080d0e744aca5ee1c7eb3e9
SSDEEP 12288:49LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:41f9n1i99k32tY5cz84
TLSH
T105452353F94882DAF21722BA8CD6CDF4E97C5F0DFDE8A452E329255239FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 7353ea676577aa0056502469259f98fb04c79c81665f1dca04744e9b20cf5195
MD5 c4c4c7dc072f60ab0cc6cab232797507
SHA1 2bed8277b4ea8f1e5e02c2bae51613b5b603a03d
SHA512 3b63d6b575619f50215f3893c83b2e399be9e022ed6fc67de1ed6ba1f2ec4aca19447bc4e3d7c681c71aa1e90aba08f49f8e74237f79e30f6549be44acba0b9c
SSDEEP 12288:AELfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:Awf9n1i99k32tY5cz84
TLSH
T13B452353F94882DAF21722BA8CD5CDE4E97C5F0DFDE8A062E329654339FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 4839975132be6f729b04a53cc42c317f3a62bc0094545cd1b4fb96b1cd5a852c
MD5 37bcd4a95f220ecd65af95613ca7813f
SHA1 ed61e92ba276b5fcd7783336a3927ac1d09f84b5
SHA512 36ee2ef42649d44c6cd5ce085aaca26d326f25b86ce2a06d795f1b9996282b4111916cc0889fe3ff7affb9280d10837e3b84cd2a12f70cc8ae53742a5a3c47a4
SSDEEP 12288:RwLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:REf9n1i99k32tY5cz84
TLSH
T1C6452353F94882DAF21722BA8CD5CDF4E97C5F0DF9E8A452E329654339FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 11e535ad091d3f42d5d38184e3263056e2bcc670f93598e0835c5604b81ffb36
MD5 9194d2b706df92b2eb5ce0d467e9fa47
SHA1 8ea9beeb4ebcb830bba7ce3611aa1a090a90276c
SHA512 1685654775d06402740b9fe27cf6833c9f6fe7d70554de8ec93682cabb7c36214d8a4137f970e76b0fac83942dab7a81ab7af5ae6061d4756209ebe6857ab569
SSDEEP 12288:IiZwbVzzFEoS2cPvyoLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:LZMRzFVSOMf9n1i99k32tY5cz84
TLSH
T1A3650195B39018F8EC27823ECC658D56E6B27C194BB0C61F13A436672F777A01C2DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 62db32a08b9da692f086eafd6d72b2ea8ef73eb3d18374cf23fd6246b0d45c20
MD5 bb97cd03093707a9d69e22e332a1c161
SHA1 538c0c3666f3ad94e83475c2f37a4acdec956029
SHA512 a1e51aa83f4a8a8cd52d8ca358e9dabe53e249cff82d021c3770ac9406d8aa1e6eea273049db383dd0859e309d3a75cb1d7e426573e63adfcca33c89760f218f
SSDEEP 12288:3fLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:3Tf9n1i99k32tY5cz84
TLSH
T147452353F94882D9F21722BA8CD6CDF4E97C5F0DFDE8A452E329254639FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 aa44277b851b214bcc6ecdf41257b103335e354e40f3c62f98cd17357b0dcc15
MD5 d0aff1d3a38e0e9b037e9e7cec424146
SHA1 dd246d623d3e1b8bd10bca023d0a725e0864183e
SHA512 807de3a2fbe2117383f90b4c1db1aea0e9de18b85e408f4b6a0c6e055805256347bdccbdcfcc9de594ee15647c64f1388d1962b4a5c087ae30e3a23449d16f6b
SSDEEP 12288:YzLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:Yvf9n1i99k32tY5cz84
TLSH
T110452353F94882D9F21722BA8CD5CDF8E97C5F0DF9E8A452E329664339FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f74765f4133b6380ec7ae56bbc629277a59b3326aae20c7048eb81b1161d85ac
MD5 603a808b3cfdfde731f51d43c0f5eec5
SHA1 92c66bc7ec8eb7ca3728338f0e65fd155a74a713
SHA512 e06cd83368c80c9a450a6a6a04eb30d5b996542240f60de5486649128798873312648146bac111d6339a3f23c291a3e05fe193b66552230d40801685c44190e5
SSDEEP 12288:UyPz5L88LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:Nzy4f9n1i99k32tY5cz84
TLSH
T13E551207B3A430F9E1279239CCA24E51F77578355B609AAF536007773E7BAA06D39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 821bbfc9fc8d4a190ca1338d57c68c41956b44142cff8f28c98873dca37c0bd6
MD5 63f008a48da4a05e682cd1f09ab6b30b
SHA1 6dd1a43d1041a73ee8eb9bf98130298021f153e2
SHA512 364ac4ae38d7f820bcd3476201ac47c07fd9cf9e8a79f04557186de3c45b9cdfe46acf623c41c87cf2776a06d25b6953d5c23ce1ff7be0c1caeee15c0eb62520
SSDEEP 12288:ZfLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:ZTf9n1i99k32tY5cz84
TLSH
T199452353F94882D9F21722BA8CD6CDF4E97C5F0DFDE8A452E329254639FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 88e0c07d07874e695ce4b473f3740e762a030a91b1de57a5525a51ed46304ab3
MD5 5038062c630f627c99fa7e0d4500adc7
SHA1 ea91d369dfb0cfe0f084352d59453f8b84c83a33
SHA512 c9735d9aa01cfec84f53af50f4485bab23ec2ed6551694da4f52b3756b772a41fee73489604e7168cfd7da8513be784d00e5ea9b277f835abbfcb48f9186a2df
SSDEEP 12288:ZfLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:ZTf9n1i99k32tY5cz84
TLSH
T1E3452353F94882DAF21722BA8CD6CDF8E97C5F0DFDE8A452E329254639FCD782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 46a8a2a06222d7c16537575123aa65cce4d96960b30baae54b3a3dbf67045f11
MD5 33e5105dadeb280f37a48ca29df81acd
SHA1 79ae27de38edb8308bedecf329da8f8073c4f468
SHA512 decaee4b90c271f288b23627454391673f553eec1672617939e7eeba5a6a00fad882207cc48af3a0487cdf4200873189f88c062cd506408450b25ff038babbab
SSDEEP 12288:wyPz5L88LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa468:Bzy4f9n1i99k32tY5cz84
TLSH
T174551207B3A430F9E1279239CCA24E51F77578355B609AAF536007773E7BAA06D39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 f7e6010166fe9ea8bb4dd963b60b9c6753a5dbd15fac89e1fb96c11a27e51085
MD5 2be82be903be9a0a5089506bc13b8f63
SHA1 927223f882aee6ee40d0e9a13344a377887eca11
SHA512 e94cfe4dc74dd6917d02c0f2f259a9b67670cd7415019958cb21b8cf702b7fc2d2ac222bb530c252c401d16261b5cdb531abfc14ba97d5c27686e4ad264913c8
SSDEEP 12288:iCd9CWYoaLHF3z0z04PDvhCLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLF:jTDaLl3z0zDaf9n1i99k32tY5cz84
TLSH
T1ED6501A5B35018F8EC27827ECC658D56D6B27C1A4BB0C61F03A436672F777A01C2DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 5cc1a69426a477201b070b510b9b22954923d5b82c275c6559491a8a704970f3
MD5 e5f02690354691a040fe95ff73611e8e
SHA1 3e875ac66b679b6f442bec439d525bede1523018
SHA512 528befa418560a14fa992d6931657ab95bac9ab23df67a60913e71061145bf2305dcbe214b3058dfbe2f66c4f9c3b7dd9762dd084b95f6ddf7c7a86e98f01ee0
SSDEEP 12288:Qi4e7KRdTfgwCHKy7GLbbdIvpLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKJ:Q3vd9CHKy7GZ+f9n1i99k32tY5cz84
TLSH
T1BD75CF91F3E810E8F1779A35CC768511DAB67C595B70DA8F03A4265A1F33AE18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 5e470577440ea2470168b5cdd33a0afc21a9e67f27a71d4c0778b4d2c92e9577
MD5 96e6f6eb51274f75bfdf7ddf832e653a
SHA1 b37df234efa3a0c18271e2d0462f8b2912a24940
SHA512 c3c3862acd7b15bf9a6685a6123cf9f4511600735596f1cbd72ffa28772f3b2f15565cac4b4029ca27869baea2844a960cbcac8ed3ba0ddad027e4061dbb543e
SSDEEP 12288:3yLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:3qf9n1i99k32tY5cz84
TLSH
T1EF452353F94882DAF21722BA8CD6CDF4E97C5E0DFDE8A452E329255239FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 73d6a7457d922c8d8043d7c08eed2ae9ea719052426d64cc33d64d0cefc74f17
MD5 b70e841effc960ce6756e9afefd38b15
SHA1 19954ff03866274ff38893b3a18c462c97a909d2
SHA512 72c570b74c20cfd10ed58cc601686a45f5a811d869a80003de6aad352c5e78ef7bd78a319705549ae310808f43b8edd4a7f0b460a5f69bf0bcf1aa7835b9c2ad
SSDEEP 12288:7cLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:7Yf9n1i99k32tY5cz84
TLSH
T1B3452353F94882EAF21722FA8CD6CDE4EA7C5F0CF9E8A452E365255339FCD782010925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 d51e701af944f1f4bfe018aee9adcd6a3f9cdafece1f36fcaab38a04d2f6c08a
MD5 b2e6efdbebeccb3f229786dc6a76e5a3
SHA1 7c045e9246953b635bf1f21bc0ae5a4d3a34ac64
SHA512 ccb0d15de4136c020cc1f148f2ab36cb63eeab1d17e050678486b5b707ca2b98d61d5b7ddda0fa1ff14c09fbea55b895595bf529c4b8d49513f60ae7e864a7b3
SSDEEP 12288:0pLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:0Jf9n1i99k32tY5cz84
TLSH
T1E5452353F94882D9F21722BA8CD6CDF4E97C5F0DFDE8A452E32A264639FCD782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 952190813a270cf52234a2837c0f1aa2eb01e6f72786d65a197e3f8508b0463a
MD5 9875bac2ade85b980f7a5d24457dde3a
SHA1 f3f65d6b24aa7868f9bb5e90c22e22a0d22ff962
SHA512 cda4f8508493db1d015ef882282c4f6bbac451ac2e35fc8f900c06f5fe05c952fb0d9ef8d3f44ea38b87db6f45c70a1d49c6c83fa040964380119a8ee012e833
SSDEEP 12288:+fLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:+Tf9n1i99k32tY5cz84
TLSH
T134452353F94882D9F21722BA8CD6CDF4E97C5F0DFDE8A452E329264639FCD782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 92c6a35f5699b5af1c9717038cbac601b0240d41afeb00915e9ddce2ada4bd50
MD5 00c971c14a81eec5eadccb19b5f61ab7
SHA1 753e694f7bd876df412c28210295c37e823c2cc6
SHA512 5855c2b3d570e11921f208b1923b4d69450bf95e8d209309450c13bdb42670786e667d7cf27278ddf5905469597186269cfc2c3463441a5ea6f8bc3ce855a696
SSDEEP 12288:byLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:bqf9n1i99k32tY5cz84
TLSH
T17F452353F94882DAF21722BA8CD6CDF4E97C5E0DFDE8A452E329255239FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 4ccfc43165eda6fea76d240e3c76b49872809a616394554751d333e24b83bfbd
MD5 a49410434086a6db4abdc0f5454cc8f6
SHA1 ec2883a4b7b0e545ff81ee1d2ab0d4c4bd068afc
SHA512 a17c2b53c78a9f05b014f31683b2bc62362ae83d2e48e69349e051a2fad22bb4a291ece791fdb398b2efaefef55b227683d5f4fbfb828d317a1e04672f59c3f1
SSDEEP 12288:UnLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:ULf9n1i99k32tY5cz84
TLSH
T1C4452353F94882D9F21722BA8CD6CDF4E97C5F0CF9E8A452E326664739FCE782014925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 488715f9c3b5d91fa007f050f054eed8403675c8accb283fd8b1a16e678934a7
MD5 c6a46451d3a15eb4a7f9ed93b63ef9a4
SHA1 e0026c739798268d5b872a18a39f6efa6b5ca0a0
SHA512 6e105097a8c9878b7409e0ae0bdb7b381fe92c6e0d4d808a77771585a4a83f20a05dd832af648255fa91dcaa174301574e57c3455aebf08ca1bbe0291455fb3e
SSDEEP 24576:OfwvUk9RX6wkyAIff9n1i99k32tY5cz84:WMnYIfln1i99ZG5v4
TLSH
T17E85CF29EBDC44E5E177923C89B3460AF6B178591B31C2CF025A53AE1E37EE46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 12f98e9f0a201c8a9cac16c93886ba28cd1bff4db654154008ea0bbf0c6da66a
MD5 da3def787101a3b125d9e1314dd4e70f
SHA1 6363986fca261f13c2cd4651edc4ace5e2ef3b2a
SHA512 b1a489ccb1d1403560afdc43745fd2967b57203f338e50d473f01be928e868d6bd9a0a60fa088a681c47eac0029161d779a565dd321a9372a58b927e6ffef851
SSDEEP 49152:LYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02ln1i99ZG5v4:OySzPsEHGt4
TLSH
T19B066C96A16841D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9361f722dcada98472b5461cb7632fb60f7e3c5e8ca774537d55249d1b2fecd2
MD5 c2ea32c1806dd676f6f1723a1387a571
SHA1 ed067fd0b47b1a508ede179a4447daf4f4a2e5c0
SHA512 d82b43786bc01c3afb688e9858c5c53c5178db545a90ba1e10848c0c4405618aa69527b994ef27ef5002f91fe279145c776cac2b374c11cad7138a7a7390fe11
SSDEEP 24576:947Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY8f9n1i99k32tY5cz84:947JUQjTirIhCnDHUPfF/mln1i99ZG5
TLSH
T15F65AE1EA3EC01E5E17A927889158A5AEA71782D1F31CACF1270837D2F63ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 3fe08bf75609c58b7e2765b792df0f970e68edc25d71d36f46431a8b0a7cfc1c
MD5 8d2142f9c80d5f0639ba7afe5183a232
SHA1 43c5990d09dbf3bebcef9ae8e11f10526e4f0b3b
SHA512 9b2c0be4d2d356bf822ce4fe958ff8c57da1a7101b7a481d955a1163aed12c82b466ee0a65070952fdcc861638d9563897196b182e5bbe52067513e4bfe253e3
SSDEEP 12288:nbsfPLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:6jf9n1i99k32tY5cz84
TLSH
T16455F11AE25802D8D02E6279CB958A50F3373C1997E0D2CB53D0F57E2F79AA45CE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 a8357aa6b9d08d99f4d585ab7ac5f77ab666bb5df78967aceb3e93b9ae5e33f2
MD5 2684b258a8c6fc806fad8c175c073c6c
SHA1 26f9a303524c065bc293b6ecc04734fce825c24f
SHA512 80aa41042a280335233ba8f3c22a5aa8c1fb57c1a077d86e1998273c7f92f6da855fcf0885820680dc52265b14a628f92bc0670637193bb46a103d5a9e7e1f16
SSDEEP 12288:/YgWJo7SQtIyNzdwk0GylO+siE77q9Bj/N/jA0:/MsbmyNzZ7yl9siEPq9Bj/N/jA
TLSH
T1E95516017626C68FC6AD40725E36D6CCABB07C41EE056E0773C88B3FD476669B6F6281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 8KB
SHA256 8929f4b12516841090e7c1e4a07b81bcb49315b1b69636eae34e4ee0dd4f02d4
MD5 167a302544a4f442cc8cf40f94c35252
SHA1 c942e10fce316aea7056f0d62197a655a083407d
SHA512 2de5b3533b4a9c66ebf7857252a6fee5745bec8cf25874b099194bfe070b2a683905b4aa3025ec37eafc0120eb5620aa680354ea386be01aeaead9fe60cb4e3d
SSDEEP 12:KwoWEEEEEEETnrgnEzBRMtrC0EEEC3UOKcEn8955RvGDvsMlE3UvLyz/:KwD2sCqvKc88HROrs0skG/
TLSH
T108022B7AEF604D50DBF34AB5D082AFA28F71E028959D43C36141223D2E447C45C7CB0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 84c61f670247ddcd43638dccad880c9a0eca1147185d26640d2ab79ff93fbf67
MD5 a3ae5c10e3925e3d1fb506ee6b539d22
SHA1 5d78edae609ade4a3f8105c458aa22a489608897
SHA512 9511173fd35cd0e1701f9033af890d9f9c510dd14c46a5dcf7ed67a3af17128aef2b221445d9508c890b3e404a8dacb281e19823a1edc2553706f4f8ce0b3c02
SSDEEP 12288:MVrfrLBXBTY8OfFP7eV5tUSyNKnshCmU4/N5v0A9pJSJMUfEC:OrfrLBXBTQFNKnshR/HX9pcJVfEC
TLSH
T162653A00A5B3E35FC9BE40774632D6CDBBB46C42BB45370173488D2D98B696EB6E22D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 168B
SHA256 c8aa91c49aa0a1809a3ac6bcfbd984e6b5a726934e4829f5cc149623eafa9b4c
MD5 467c0ad87ea0c0e3c1ffac15948ef2e4
SHA1 f2ff189b7e14e62fbbd86c8c69b6251c6988ff4a
SHA512 1f8142b8c15a5a99b504a434cf00b6aa0206f510dee6a8d990ea7d1d716b77f78570ad0e5dae5030e85938f31e12fe26fdb1659a919d3a69e6b8d207e8e68991
TLSH
T1CFC0120255FE60891B258080B92A3E9490C97260C3425A30B3212B0AA3204234E2F868
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 437ed78c947f87449ed8aeaeaeed5020393349f7333e4e708302510d838b3fd3
MD5 bea2fc3ff2716bceeb0e0d305ce3f199
SHA1 e60271769d0c760e540c376d2988ff093e33bf2f
SHA512 7b1a3eec119ea6e8e2e965f9f38d419d30267c8217b36c26b91d55845789e99fbafa95ac834630c923d9a66471afd329352721c1755291f4c8b30ba714bf8821
SSDEEP 12288:oz7XLfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:Wbf9n1i99k32tY5cz84
TLSH
T17F452353F64C8599F53722B58CDACDB4A53C6F1CAF94A0D3E315268638BCDF86830A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7c747ef04fa984122c358abb63c5d092fc2153832235dfb513afcfe6c0583454
MD5 555b51eab28a5a94c4d78444c871c698
SHA1 d5bdebca441b5647b238c065aefce494f2318b48
SHA512 2f2b75c2a8ff9ed60b3585996b78bde58e76d45dfa9a6055c841daf43247d853f67491fcce6e82afc8a24b31a146531933e2d0aaadd51e4247c28973ecd0a7fb
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bYRf9n1i99k32tY5cz84:Kgb4mBIBhGF8ln1i99ZG5v4
TLSH
T1D965AE1E22EC02F5E0F6E2B8CDA64417D6B278161731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 bb776ab72887004144aae6476ce744aed65785c2983ecc080cd86409d3713161
MD5 cc5b5856d6f154a615610ca1104dac44
SHA1 1c37463413bb4bd74139d417549b139b54422fba
SHA512 1665420f795489ccae62aa9201d5b4387cc740ad8901fe751c927742d40368b592c62ace856c519a4ae39a49eec163f1d6f58c7fe23e9addaf272f8a9fa6dee0
SSDEEP 24576:mG88u8FpJqH1bzria7/mMf9n1i99k32tY5cz84:t7ZFPqVea7/pln1i99ZG5v4
TLSH
T18F85F165B7E001F5E477D13889864A63F6B1B8151364EBDF07A88B521F33AE40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 b0f3117e805997184526db1646ed351c9625f6fcdfc6b2679bb71797f4810adf
MD5 ad888886adb70cc9361da9d4b452de0c
SHA1 73b7d3bb0dabcde0f6dee0c8af33731a06c63532
SHA512 fe162bca7690eba18dff6f801d12889089777c92a16239bff3cf0b62193c5e02e1d6f000b11df22c71680eda85a41d33bd5bb3b785d29eed1ce62385128a9c87
SSDEEP 12288:5HvUrBFrEjwaQULfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5czKcLa46:5PUr+NQgf9n1i99k32tY5cz84
TLSH
T11E65E12F72AC18E5F636A17D89828619F77178661751D2CF02E0817E1E77EE8BC39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 12f4653837783e9c3db367fbdea45a24a5bd67ca5ec729d980ee70697a34bea9
MD5 1d9bc2514ad48343af0ece5fbca7c517
SHA1 4d1526c0c5d444bc8fa0bb921700834e6d8a49c5
SHA512 eaa103730848143448cb38faed48ea3c658de8efebe0bdbd011f72f5e653698d2bfcec77f531234f9054d25d0a9c4158a4ec9aed1779a24701694b190e4a6509
SSDEEP 49152:5BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjwln1i99ZG5v4:aG05lO43bdEHGt4
TLSH
T1C0D5CF6E62EC11F9D1BBD17CD9C68A0BEBB23815033456CB02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 047eeb3dc6c70a6180ec94d2f288c0a8ef98e38873b4c36c1831855725bfc7a9
MD5 25f54be76ce874fdbbc3f4912236df59
SHA1 94670960d79aee088d589faf0efe2993c514a551
SHA512 1131510af81b37911bfd106b75d3d24070c7fdbb9e418f10c9fc766e02970cc8aa24b4502fa68847da0acd758bfb0bfaec70096b327afb69393379b5f93b34e5
SSDEEP 24576:Gfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn2f9n1i99k32tY5cz84:ea5POZ3BJt2pasx2+mYln1i99ZG5v4
TLSH
T1CA65BF5EA6FC01D5E179D17DC5838A1AF5B1342553319ACB022182BE3F2BEF89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 261738f8023375afe80add029283f586e0e0a32dbef54b96c24340c37f408109
MD5 50570f5915ef3cf0c9a450d53e31b85b
SHA1 f0f890fb774327a98bbb4c1dc4f79681c8a1525a
SHA512 1a2dfad2b1af90bac3e1f9bea1d12dcbd25d9bb849f0dd7cb996474f8a06473263c1ffec04bbbca3314adfb77af90beaeb2ac82f4536dddb465dade2e24151b4
SSDEEP 24576:ONcwHdjbyQ4nLC18lb/EOjowL7FkUf9n1i99k32tY5cz84:ONc/zEOVHFJln1i99ZG5v4
TLSH
T1B4858C1623E901E4F1BBE1BE89779946FA717869573086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 000f59cedff6dba91ddb2b23be0c559842679b8bdf9d80c2d5bce16c6a3c07b7
MD5 5b10c7ba448a6de60feb94af2d2ef537
SHA1 6974547f2731ff3e7ff2352b6445daaca48c342c
SHA512 b6a1b11a1a34243f492ee7e53d453728eea978e8e92123faeb3920e358d7c953977eca9b98ef0bc61e893a19db4aa80af80271a61809eacf04958719d94bb1b0
SSDEEP 24576:ATkNvNnaFeYhJNtmZBmDf9n1i99k32tY5cz84:ATMwBtOmDln1i99ZG5v4
TLSH
T1E855AF2EB6B846E4E1BEC6B4CD238512E6727461173293CB9390C13F1E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 2943de726e3c43edaa67c86e94985c7803f1a6b3b11a0dbe10ab42b92c0523ef
MD5 9cd239948a5ae4387bc2528dc2165db7
SHA1 58fbce26b21b6999a6256afc35fa88cd4538b8e3
SHA512 44fdc879f3fa2f943ae186e534b195487469fee53fc7abd345fbe6249b3ee1d52b9a51ed72b661903355dac98cbf4e152e35470ce826c372264d8fb6836843be
SSDEEP 12288:FQcMxWDXN1Dp/fshBItT1IQgA7LfwzWVj1m8Yei97Zdm/Os3T2QKuA79bEIw5cz8:pD3FHshBIYQgAHf9n1i99k32tY5cz84
TLSH
T1B575E17EE65C04E4E57BD1BCDAA38A06E77138AD032165DB029481B61F6BEE43D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/848-371-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/848-163-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/848-155-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/848-157-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1096-406-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1096-232-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1096-233-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1096-239-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1512-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1512-190-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1512-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1512-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1512-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1836-402-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1836-211-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1836-203-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1836-205-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2372-151-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2372-144-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2372-320-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2884-43-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/2884-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2884-140-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/2884-142-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2884-49-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/3404-137-0x0000000000400000-0x000000000062F000-memory.dmp

Download

memory/3404-1-0x0000000002590000-0x00000000025F7000-memory.dmp

Download

memory/3404-7-0x0000000002590000-0x00000000025F7000-memory.dmp

Download

memory/3404-6-0x0000000002590000-0x00000000025F7000-memory.dmp

Download

memory/3404-0-0x0000000000400000-0x000000000062F000-memory.dmp

Download

memory/3436-178-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3436-177-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3436-400-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3436-185-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3436-417-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3436-419-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3764-401-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3764-405-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3764-197-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3764-403-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3764-201-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3764-191-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4060-222-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4060-227-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4060-225-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4060-215-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4060-216-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4400-173-0x00000000008F0000-0x0000000000957000-memory.dmp

Download

memory/4400-386-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4400-167-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4400-168-0x00000000008F0000-0x0000000000957000-memory.dmp

Download

memory/5212-22-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5212-14-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5212-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5212-184-0x0000000140000000-0x00000001402E9000-memory.dmp

Download