eac9836fe57cc86a6cac25968aa63b4e37939b4704a092872e2ff318e989de89

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.4MB
Sample260716-marwjsas9k
SHA256 eac9836fe57cc86a6cac25968aa63b4e37939b4704a092872e2ff318e989de89
MD5 5856a8a579da75901c54d09ad1c6e3c8
SHA1 d067de8cdef5da770df040dd9c8f8d3945e191a2
SHA512 9ab4ce955c79beeacbff81191cb1bd19916cd159e6616dbcbe95a21393d7f20c34049611e59e70d255e9df9a1f6aa8420c9c8907ff8276871ce07b7c1012d0dc
SSDEEP 24576:LDF66jedCdjTTkql1n8jy14XcmBV04TnxfTIf:XFeCdjTTvmTTNI
TLSH
T1A76502257AD0D033C6B365300CE1E37579ADBD718F619A4BBBC14B7A4E317919A2838B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3868	elevation_service.exe
404	elevation_service.exe
5344	maintenanceservice.exe
4772	OSE.EXE
3048	PerceptionSimulationService.exe
2392	perfhost.exe
908	ReFsDedupSvc.exe
3532	SensorDataService.exe
3524	ssh-agent.exe
2752	AgentService.exe
5832	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7309e2db23e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec9b26250c15dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002b15f7240c15dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e14f94240c15dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f7e02250c15dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000dfdcd250c15dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe

Runs .reg file with regedit 1 IoCs

pid	Process
480	regedit.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3868	elevation_service.exe
3868	elevation_service.exe
3868	elevation_service.exe
3868	elevation_service.exe
3868	elevation_service.exe
3868	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeBackupPrivilege	908	ReFsDedupSvc.exe
Token: SeRestorePrivilege	908	ReFsDedupSvc.exe
Token: SeBackupPrivilege	908	ReFsDedupSvc.exe
Token: SeRestorePrivilege	908	ReFsDedupSvc.exe
Token: SeBackupPrivilege	908	ReFsDedupSvc.exe
Token: SeRestorePrivilege	908	ReFsDedupSvc.exe
Token: SeBackupPrivilege	908	ReFsDedupSvc.exe
Token: SeRestorePrivilege	908	ReFsDedupSvc.exe
Token: SeBackupPrivilege	908	ReFsDedupSvc.exe
Token: SeRestorePrivilege	908	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2752	AgentService.exe
Token: 33	5832	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5832	SearchIndexer.exe
Token: SeDebugPrivilege	2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	3868	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 480	2008	2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	89
PID 5832 wrote to memory of 5964	5832	SearchIndexer.exe	101
PID 5832 wrote to memory of 2004	5832	SearchIndexer.exe	102
PID 5832 wrote to memory of 5436	5832	SearchIndexer.exe	103
PID 5832 wrote to memory of 5880	5832	SearchIndexer.exe	104
PID 5832 wrote to memory of 3244	5832	SearchIndexer.exe	106
PID 5832 wrote to memory of 3792	5832	SearchIndexer.exe	107
PID 5832 wrote to memory of 2632	5832	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-16_5856a8a579da75901c54d09ad1c6e3c8_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\regedit.exe
  C:\Windows\regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\config.reg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:480

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:404

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5344

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4772

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3048

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2392

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:908

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3532

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3524

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2752

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5832
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5964
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2004
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2888 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5436
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2864 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5880
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3244
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2864 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3792
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2888 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 27f380a13cf295e3b2ca6a6a6da417ecdf432ae7b09fe82a38aec3516f43a50a
MD5 f5dee80992c785226bd9f31baa4c73f1
SHA1 d6b03409be06f0aac15b92620ada57eccf38e7ed
SHA512 a2eb40dabf864645cc20c85a3f82cb903fd14a08218e0c16186bd14ef49c58a450f9c39cf9198cb22c5c604a9820bb8c9ea8db4e59c67da4d24634a12c39c0b3
SSDEEP 49152:+b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnACdjTTvmTTNI:A3q6HjBodjTTs
TLSH
T10DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 cebaede0a0a61c9e5baf2c7ef4150323480a623854038fce5c09a964238599da
MD5 316125e9da74c2f509e48822200df0ba
SHA1 ebeefb4b7f876ed7a3f4d89673509597334f2666
SHA512 e0cd3efa4f70e7a6b1904d5e814ad33c673bd70fe463eeab530b7e7148d523b62e8645fc1e0bad3693b7bf946fa0abe9bfee4f9eaf24c6fe5885483f06adc9c1
SSDEEP 24576:1XYfDtczApCdjTTkql1n8jy14XcmBV04TnxfTIf:gtcKCdjTTvmTTNI
TLSH
T1D265F129A7D509F9DDA78238CC618511FA737C4547A0EB9B03E4C9264E333D86E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 93bb2ff8c251d2d6a45f6e1fd9159149d21d0d47c819fd855c5a399bfcc25261
MD5 c271259422c9e7432952c8128d628c0e
SHA1 46b014dbbbcd6dec33c132626498d50e78cb312e
SHA512 1f43455e3e2626c5ccc462c12f3ae34ecf1a8e4df1f3e8e4b47ae5052111ed18e31d06f98bd45e50217544f108de4e22fb8331f96b4fa771d00468a269500832
SSDEEP 24576:D0Le5ji0hmxLrM4CdjTTkql1n8jy14XcmBV04TnxfTIf:DPji0AlnCdjTTvmTTNI
TLSH
T197859E16F6748335D073C0B9C5D2A68EED7130865B308ACB4286D77C6E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 febdcf8afd1c36c5f0c66f58f92520eeba7bc5cd8f1ff052dbc9c79b0bd1c045
MD5 5da7485786e0b1f2bbaf9fe5c0663f47
SHA1 50c18da7661e7151916a61b20e3b34e3c14499c4
SHA512 16bd2cbc951ac45c69aabed997d796d3aec85ba0f940b9bbdd26c8ab2440afe39e1704af61980d887ba682ab47db3b093d5695fb42fb209f7ebbf3807627d952
SSDEEP 24576:5a7/ezSC6vUyD/aqgrvWE6q8wyu6CdjTTkql1n8jy14XcmBV04TnxfTIf:o/ezSC6vUzPvxHjybCdjTTvmTTNI
TLSH
T1E1755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3D277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ce1a8a546167b090ead3b35209bbf91fc162d52836b26307e7d61e45a455ec0a
MD5 ccfa270628744385c9c0cd09b17de310
SHA1 2660723aff9121ef96eb52bcbb09a522cf9b8b9f
SHA512 a2760d99d071eeb23318081a419076594adcedc058912fc3e6a1a6c6b229e9c1a73a8ebd294e8fce93888cfb6701203da9a209a7fc398a1b8e1c0990974266b1
SSDEEP 24576:wVbqPb88hv/l+6FCdjTTkql1n8jy14XcmBV04TnxfTIf:wVO88hXl+sCdjTTvmTTNI
TLSH
T1F7559E66F5B48331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7fea174d241acb834a73cecc7bf37cbe8af83bee8482d67ffcb14bb518f8c0ed
MD5 6e83ec60c34f045b2e3afdb68a12487c
SHA1 dd4e0204dd77115f6594f490855a84a752a97346
SHA512 2a905059a714369261543ba5ffe92c0929747cdc14e1ab99266e27371c1d40bc5f544f1d1eb347fc35fb0dd1262c7a6dd82209f7b3f561e509237a5bd7c809c9
SSDEEP 24576:lz0CdjTTkql1n8jy14XcmBV04TnxfTIf:uCdjTTvmTTNI
TLSH
T180552312CA95B172CFE6CB307830A24578992E8A46C4ED27E7D3DD678C39311FAA49C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 ff39d3032a8315ba210771256597c2f0dbd63bf27075aacfdbaac2f88d261c74
MD5 774ab61e70f873b2acac9a0824556668
SHA1 ed9d4c5790cb631f0d199f1a47e4dbe0264762e7
SHA512 a57adb03a994e339fba5e39ae305e3590d15cdd78da47129a2b616c79f0537fcf7434b1ab5fe9b2b1a2c72befe1e4a55283f052550141635cb7c7753cd65ca40
SSDEEP 24576:oJIUdCdjTTkql1n8jy14XcmBV04TnxfTIf:oJIUdCdjTTvmTTNI
TLSH
T17C75CF3BEE28FCE2C67A8D785A518300E77278714B51A7CBD265C20ECD236E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2107c5106d7877be04a1ea5d8a71351cc852c5265cc1bf5b4e02cdd8cee987c7
MD5 cac18210a19c1427f7d2ff1c963d12f7
SHA1 445ae0abc7316fe599846f0a06bdbcbf59c674dc
SHA512 ff8369125f6455d1541c259e651c0d48d8e58cab7731dec5c87a2cca0c82df463c096b5bc15a7395522a5c9faa4a0e406faba992e3b3889def71f26a5f37564a
SSDEEP 49152:iQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THQ:iQvGAdlCEL8c/yRNw5C3djTTs
TLSH
T1AB266C656BF880F5E1A7E134897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 f0688822238f1378afead4ad33b0e20586e87399caece229ca9936f6879c67d7
MD5 d405685858de32591cb708c838393804
SHA1 2091ccf5e4ae3b81fbcc2ee6218dc6e80fa59db1
SHA512 4dd6ee8660d2ace9e50e0ab88c624e1cc0ce1032ef610727d7aefe0a4b007cd8c2a8bf6095c0aadeea8e5c19ae885db995381dfb424874181ed8a8d781a09e8b
SSDEEP 24576:kQewsAjXCdjTTkql1n8jy14XcmBV04TnxfTIf:ZljXCdjTTvmTTNI
TLSH
T12A75E031FE75E036C7BB0D722B35D716246D7A604B9129C3E3E88D9E48302D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 90abe9ea9de4f6088b28ca6bc5438c9219c80d89fa9b74b9e46d2637f54b8bde
MD5 89d4a83a67919ed51a1950a6a2b31399
SHA1 09dc24247a49cb8e46c385e5bd0909881a8aece4
SHA512 fea0831ed8d7999556b60445a9875d4e11ae7061aa863c65665c2d4842af00f069f9fb17251dc5126d2ec9eccb0e7deafe7229e3afc5360c38a98e7f65b89aef
SSDEEP 196608:pUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHqFTs:pUEtQevvqc2W1cpV2EI32qFTs
TLSH
T1FD474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a5e4418bf34cc05caae8a7502b4bcc3db9881c1d98674cc2fd4f1fd8f13e99aa
MD5 651815cfe7f347c5366437aecf08a1eb
SHA1 a5658e4551438c5530be87d5901b3ffa20527acc
SHA512 7712f81b2263575b42a8bf412b9ef954f3bba1e30f641ff28c295d81cb5a9ba840bb92cd8c8f7e1340a138125926844d01fa4a0e15c02643a367773cdab5e00e
SSDEEP 49152:9CbRquA/m2yL5zifFiV+XenmE3/z3CdjTTvmTTNI:6oqHVjnm7djTTs
TLSH
T110D57D0976B8C1E4D1F6C77896A2C647F37178154B30ABEF4266461E2D33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2561cce4901297dbe955be30f60a80f00c094b44d5f22ac9837be2e0d32b532b
MD5 d585f17860da856137a15667cff11d08
SHA1 615bf6ac60cfe8fdf3a7c43a3e4b12ebba61ada8
SHA512 ad07f2b453364be40b13542434e18a0bf864412282d4916ec504cdf2f854ab12e62230e0eb834c4cd3961e7ee14c7fd662fdf764af4312359c83c1d9f0023061
SSDEEP 24576:rAhGLJIFoiwtA5l7S53eCdjTTkql1n8jy14XcmBV04TnxfTIf:rAMyFoiq5uCdjTTvmTTNI
TLSH
T13A359E81E7F955D4F5F3AA7899B69171EA76BCAA5E30D20F2250C11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 aaae3f5a27833538a737bca78c12e5e257a38ba7c01191fcd460430b351c93db
MD5 b185e8e5d9916adc11a9e40a6b2b6625
SHA1 d980b74085927d0d76310b1d702731a5a20654d3
SHA512 a6f496e45dac747c25a31dbab4d24686ce6d91da7eaa5d691c97adc48efc6b749367357f39de814e63b8d20c7a77f34856fa6f4ee8f0450ed62973ce22472c2a
SSDEEP 24576:FwuHOW7CdjTTkql1n8jy14XcmBV04TnxfTIf:FwsOSCdjTTvmTTNI
TLSH
T10E65F14666A41CF9EAA786348553C136F7F2BC022A20DB1F57A0C65B5F37321BD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 0ad3b7bb5791cae3d9a72821b9d8d0bfe09d71bed1d40662659a4c2fede1288c
MD5 1c6250e285c19862e1e1cc7d5a2c3a9b
SHA1 69404c20349bb5c774d58d6f6cf2c95a86fa0183
SHA512 21dfde2c7eaf9bd8f3e0cc3d8b860a0ea2c524520537eb6d84d7dfaa3083452198cacccf8427203060fb52a829165fa0d14d20ad26f7905f1b436980ced8c483
SSDEEP 24576:DZuwCdjTTkql1n8jy14XcmBV04TnxfTIf:jCdjTTvmTTNI
TLSH
T17455124667E470F6D6E386349CB09605F7B23847137097CF576286664E33BC2AE38B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 19d7c5e3993bb8ca826ca5d41d7f82459bd338706525b6e1f00d5779be769928
MD5 c6b8938b435e94fa451d2827ef830e22
SHA1 807ff005c80a913a1ee71ea062fa4e1148de9e97
SHA512 5b5b96e4bc5e33e64f743fd11960dde1d0e899d9fa7a7241c5802c82b2a9b8d65ede55271a3cc9dbdb3be8a99a8ebf7f02794503fc756bfff0a03da1a6b66830
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UU:QQRQyi36YOcPQLvw2gAf+PN30djTTs
TLSH
T15D667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 136ebff48efd38eeadf91d1218134a6d18e64515d459e9a2afd8e781aef33a48
MD5 a70f9a2749760c0f4623bc8cb55dd565
SHA1 34b10ecefea892aa084cce7a5e9ec5fd4f3ff1f0
SHA512 767e0574eb47712859abca951c212c2957245f42c921eaa0664d12e3f59bad103955e1a8a029529e8d0bf7c63b10c4fa3a59c061e6410a651515c6c932d4cc9a
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UU:wQRQyi36YOcPQLvw2gAf+PN30djTTs
TLSH
T1DD667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8b56c18a391c952c77486db06ba7a3f0f6d7f09249dda4511a05f75ad518c07d
MD5 ce0cc324b5696c3eb24a228686e6f9a8
SHA1 49466c5d4ee88fa90356a970556a1576b648ee14
SHA512 49c1df7a4947f30f8b0efa67d0bf193e58c9402c3b03ddf58c1b0338dc46e09637eb300dc11995e085aa72470b85fea4cc8cbf2afda52edc53e384e0809ddb3e
SSDEEP 24576:bwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0ACdjTTkql1n8jyD:T68Qg55nhheWu7PNU3/nCdjTTvmTTNI
TLSH
T12AB55933B2F200A9C44DE1769F46872196D27C758FE0E7DB861172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 db5257697369d051b9d3ea33dd5ee60f71cb596dda7cf5972aab0b2e9be7bf19
MD5 8e876e341fe88a15f8518fce04f3fe03
SHA1 6095f20105a81b3ae8c7107b9a163949d8aa4096
SHA512 72460c1044ec9317f0d78206358a4710c473c5090de53f92972e0b1070d2120c8b2ebdcbf0511faddaa6383b73aa35780a981e512dcb7e00bca0f99f141c9633
SSDEEP 49152:E3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99a:Ry5112gYy5azzVvL69nLKnhZpdjTTs
TLSH
T1F9167B13F29900E8D05DD1B9874A9232EA72BC474B35B6DF0A5077522E7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d259dcff397291816d5ad0fdb5b9ac172069a1999e2ee4d1c6ca0782ac753de0
MD5 a3cca0c4152bcb0d19cc6947babbc1bf
SHA1 e8870914dbed862a5b5bff0674efca8a9aa589cd
SHA512 48773b1afb9d41d77ae2520969b575952582f45fd3f429cec44be6405c7302d19ac02a9eb11e92d4ebf11ff4a58c07d5689cac8264534fdcf7385e2314998dd4
SSDEEP 49152:6B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl5CdjTTvmTTNI:ou6JmVxd2dcdjTTs
TLSH
T1A4D59D13F1DA01E8D06ED578974A9233F962BC490B34B6EF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d468e53b1fc97810726aaad3566f47daf2a25b7ccca87b3338e621dfb330a006
MD5 ad434ed5411d98b8f47195c09f42b19a
SHA1 18b14fbd60b2007c4f3cf7789b10bd21113732a1
SHA512 0c518149a5c4d673792a056f145d001b9265cdf2d19180430a061eca1b3bf6e03929cf95c92c6cc0aa57602a193c2b7f9a033584196be416e56c8197b9768a33
SSDEEP 49152:f1hpsNoJpF1A6UU44CwH7R4x9CdjTTvmTTNI:fmifPbR7djTTs
TLSH
T151B5AE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b7fe3d54652be08b8a2f836a0c99dc714a4098966bcfc0613278904ee0819b6a
MD5 af2b4033ba952d1e2b675e78e4d7c2ad
SHA1 bb39f8299a9a99e8c8cebe6e496cdf19b31a3328
SHA512 7ab720620ee1bdf96e13c90773b9aecf37096090b2be8202074d0f9d0277541be2b3a416d10aa10ecb0108f93e38533e70bfcc7612ec5f0a6741733ba4e5028a
SSDEEP 49152:zSuZQIY0Be2KRRVtOnks6NMHqwCdjTTvmTTNI:x5dKTi61FdjTTs
TLSH
T1F9C5BE03F2E941E8E0BED6748B659232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e5c606778913620c6fcba8688399fa0d47e0bb8813f3818c110cda0212f1f001
MD5 d7ad2d36e181eef73861d802e92042af
SHA1 3e1ee43d8f9a7418ea8921195780bff63904e777
SHA512 2d89f0b59fd16a37c6c14255ed31a0aa4990aa9129c328d5d609f3642ca601d8ae60e672e117c9112586f2b4884e00d54493402158d52b02ea5d2b014c386dbf
SSDEEP 49152:OhtSn8EApI0figngiDn0AP5wpCdjTTvmTTNI:PX2iyphvdjTTs
TLSH
T12095BE13F2D900E8D05ED174C7568632E962BC160B34BAEF0A90B7561E7BBE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 276aec72c0db4df6a72971e59139a0185897ed308472333f2e890e17f319e4aa
MD5 1b77604aaa0045787edea283d907f529
SHA1 a7eef683bf36c48070cc76001d1ed596da59b34f
SHA512 f4c19f0eef86ea84fbbb07b0c14b0d6390f0fd210a968c4c0d56b8d89313db6e50edfb545a8266887a7a5173f3bb4fc630a0b9f8f514fde76be7eaf4155c198c
SSDEEP 12288:/K0gtxbjYyOdjTY8U6Eskunl58Gdpx8SZKyZr4XiBJ4BV04Tnxf5n7FIf:/sCdjTTkql1n8jy14XcmBV04TnxfTIf
TLSH
T1EC552316DDD6B276CBD6CB3068309349749D2E8F9794AD27F797C8238C36311BA648C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 ba1ad9d3363de2efd629106b5efd7984ac0a6f6d3bc4054cc6e06610dd3d7adc
MD5 ddf16d60740d77fa3adb6cc07fa60c11
SHA1 3824144113cfd46a8efa83d282ea1e5cb4f5526a
SHA512 62d88711230a392e03b3a0580e4eb7db13a445e5becfaed6a45a69ecf0c645133807561935f955cf8caeef5679d138575e3885d6f697bc457f2c6811cb547f54
SSDEEP 12288:3H0gtxbjYyOdjTY8U6Eskunl58Gdpx8SZKyZr4XiBJ4BV04Tnxf5n7FIf:3DCdjTTkql1n8jy14XcmBV04TnxfTIf
TLSH
T118552312DDD6B276CBD6CB3068309349749D2E8F9694AD27F797C8238C36311BA68CD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 05827e7032c4b5e01b709acf270ad9899610e8103371394065d6cf8bb1a87cb7
MD5 5c7406b414f189b1d01be633e4ad7e55
SHA1 6a76121ee94686fc84a69f63a7d2a7eceb142a09
SHA512 34b99e3366dc442647393a6ed3a19cc813dee357ddb7ff3bc92a5ecad8b6773730673fbf388135764f0ce38370e0c806348df9ac770e089ff677af66493a75b2
SSDEEP 12288:u50gtxbjYyOdjTY8U6Eskunl58Gdpx8SZKyZr4XiBJ4BV04Tnxf5n7FIf:uVCdjTTkql1n8jy14XcmBV04TnxfTIf
TLSH
T172552312DDD6B276CBD6CB3068309349789D2E8F9694AD27F7D7C8238C36311BA648C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 b1b7393a0f3a82bc9e8d0932a31b22eceeced72e163725f75206739a8620790f
MD5 91bb80f1c72d052e8c41f6bcaca8f7c4
SHA1 3de4ce9337f1533c24a908f5c9fccccf53053dd7
SHA512 e71e2e367b943ae28768456e96d23ec09c1f1b8175354535d08c0702c5aaa07516dba8646d662176fe9d12fd469b1c983426aa1388354e7f6b41885b2c91860f
SSDEEP 12288:ZVM0gtxbjYyOdjTY8U6Eskunl58Gdpx8SZKyZr4XiBJ4BV04Tnxf5n7FIf:CCdjTTkql1n8jy14XcmBV04TnxfTIf
TLSH
T160552302DBDA61E2CEE2C73098309205F5E93D8B9760AE6FE75388574C32351BA74ED4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c087f7e8526f62a7bf349033644c674fb14c20603a06711d23384749ba63d9b8
MD5 8b8fbb43da43c6403cf8a24e071f1fb0
SHA1 2617aa6c9818d8dbfba3b081e0e3fc30c0a7fbc4
SHA512 78f0cb181e52c629622736d1636f5a646db3f46b33fd842c794fea35ffd11c048881eca1865a71c52f77414b9b1a026f91c86f51aafce89d1758647116c121e3
SSDEEP 12288:h00gtxbjYyOdjTY8U6Eskunl58Gdpx8SZKyZr4XiBJ4BV04Tnxf5n7FIf:hmCdjTTkql1n8jy14XcmBV04TnxfTIf
TLSH
T1F3552312D9D6B276CBD6CB3068309349789D2E8F5694AD27F7D7C8238C36315BA68CC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 21d112e8c6d86607f19db6852d4135bdfa7810369e123ec57550e2c193be05af
MD5 16a452b1400b77a3a55638efec0b2b07
SHA1 1ac6ff3598bc1dc83c88f816d5700195471a8e89
SHA512 5ff045da769482e141356e76673f7576f205fcd3eb633547def9f806c900864e6a20d091d02b91cda5130f3b8e26b481bf54e3c72bb92dca66f746478fb0864a
SSDEEP 12288:6T0gtxbjYyOdjTY8U6Eskunl58Gdpx8SZKyZr4XiBJ4BV04Tnxf5n7FIf:6vCdjTTkql1n8jy14XcmBV04TnxfTIf
TLSH
T113552312DDD6B276CBD6CB3068309349749D2E8F9694AD27F797C8238C36311BA68CD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 9dfeab3fe092221b82d0be2982c021fedc81fc3b78d8c2514e605065cf6f7414
MD5 9d0cb2c95ab99262f9caa4236fcf8449
SHA1 911fc68a608c544fecdd819dd8d96f598399f5d2
SHA512 60de3ce8750253d2471bad481a6482bd18d8aac6be597dec98625cecda7c54cbcf47b85227f3406b5ddfb1b213324c7aeb36d876b5eb167ef8c78eabc629a67b
SSDEEP 12288:wP0gtxbjYyOdjTY8U6Eskunl58Gdpx8SZKyZr4XiBJ4BV04Tnxf5n7FIf:wLCdjTTkql1n8jy14XcmBV04TnxfTIf
TLSH
T19E552312DDD6B276CBD6CB3068309349749D2E8F9694AD27F797C8238C36311BA64CD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 1c09a37b99cd1f5f797964e678647f4830e2834f7757ef984874fec4fdcd0c29
MD5 aaa28ab2ed3b487c6c821fa5f1c91ff1
SHA1 fcec0822d0062a2be87a477295afb678fab9afa8
SHA512 5c4ce10d7a80f886e72f045d86a266df9f75833e6e76b99c471c960f70526671dc9995cfcea3ec5e1a57b5c3f2e99a142b6af11604e6918419cc792b0346b746
SSDEEP 24576:lZM3zFVSOjCdjTTkql1n8jy14XcmBV04TnxfTIf:lZM3zffCdjTTvmTTNI
TLSH
T1EE750195B39028F4DDA78239CC218906E6B27C5A0BA0CA1F53E536275F333A15D3DF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 bd9832c1f1d3762ade003bde5ae7c1da70954fbac91a7f1ab5d538bac6ac056d
MD5 e0406638955f1bd647166a1343a088fc
SHA1 3dcc931771f258105303bad060c7d90a2369a484
SHA512 50b7d12c20bb45d77cd40404545f5b46fef679b439a7e95705069621219acb2c5d857d3aa44fa8e30353497a69a5c28987f48a07ac90742906f3816b1bfd7ed0
SSDEEP 12288:5e0gtxbjYyOdjTY8U6Eskunl58Gdpx8SZKyZr4XiBJ4BV04Tnxf5n7FIf:5gCdjTTkql1n8jy14XcmBV04TnxfTIf
TLSH
T118552316D9D6B276CFD6CB3068309349789D2E8F5694AD27F797C8238C36311BA68CC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 5bad4e971ec3cd25ad7b89ad738dd0281de7d0fe0c3ec9851d946fb19c230dc0
MD5 50b65c39008a45fec5f644f323c13be8
SHA1 a45ee804d572f62247ddfaca1dc01ba67fe30566
SHA512 d765e8fe744a4804a2715cc48b112e0d52b623ecfe662c3c015b7f2e58fb4ca56ebb0fdb89763696d1459a347e4a920e59c1844a58dd09d8f6486e53f65b87c8
SSDEEP 12288:WC0gtxbjYyOdjTY8U6Eskunl58Gdpx8SZKyZr4XiBJ4BV04Tnxf5n7FIf:WkCdjTTkql1n8jy14XcmBV04TnxfTIf
TLSH
T134552316DDD6B276CF96CB3068309349749C2E8F9694AD27F797C8238C36311BA68CD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 8f2c0a72143d410bb1a7011b051d9c78084c451ce3ba28122bc690fb2ffa504d
MD5 263e1e157a6a41a9f307d080850d8958
SHA1 8eca3616e777d966ac9cb827046c9d502c17d876
SHA512 046ed610f82a6d6db0283370197adcbf044db5f862c161490e246525bc45805bae40c3421df2138e80455617e2677b0d828ebe688317133dd6bea2d00a58fbc4
SSDEEP 24576:OzyHCdjTTkql1n8jy14XcmBV04TnxfTIf:OyCdjTTvmTTNI
TLSH
T15B651207B7A230F9C677823088611A02F7B57C7647609EAF57A146771D37391AE3EBA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 1a4e5bc66bf2ec359706051496f4cedb4e00294c413969f20b4260496714118f
MD5 a92483bfa28c61fa5de734b32298df24
SHA1 3e7b0b9fc944396b0131071e90dc465d7d469e3d
SHA512 fc88872cbbf4118ae5627a16b4edc451b4c5cc8c87a07111e428d64eb6865f7b8953f142a6703698797f49d8384c8492657b6b7b5a0361a08c022142e9121599
SSDEEP 12288:2e0gtxbjYyOdjTY8U6Eskunl58Gdpx8SZKyZr4XiBJ4BV04Tnxf5n7FIf:2gCdjTTkql1n8jy14XcmBV04TnxfTIf
TLSH
T151552316D9D6B276CFD6CB3068309349789D2E8F5694AD27F7D7C8238C36311BA688C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 905ccf214964754a8fd2972659fa796069329df8981984ca77571fe4c5865af6
MD5 c65153773f613dcfa2c8163253be73c2
SHA1 80d4e7b5c4d2a239d5d78ba17086dd4248ac4c5b
SHA512 1aeb9e39c343b8eb287de420e69b32220d70040011fa7c34d6215aa6b0b973f78787f559498a2673c1a587eb30e5a1a88b0cb1016d5451e5b14da856b124e990
SSDEEP 12288:xe0gtxbjYyOdjTY8U6Eskunl58Gdpx8SZKyZr4XiBJ4BV04Tnxf5n7FIf:xgCdjTTkql1n8jy14XcmBV04TnxfTIf
TLSH
T106552316D9D6B276CBD6CB3068309349789D2E8F5694AD27F7D7C8238C36311BA68CC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 6c7c134e88294ee78f94b1a5435d50aa24c52e2379d62cdfaa0fe01ad6a8f881
MD5 5bf3a9a15141391612fd90c6450a78b4
SHA1 17dc95055d05b258d92e34bc734f52cefd25c40b
SHA512 ac4c36e085027be4fc6615741fc3602e5175b9c77932300b47c08a4eb5492d74413a09d12ea079d578170646e3fcfaa2c6e8df692634e60caca65b44c3b01485
SSDEEP 24576:kzyHCdjTTkql1n8jy14XcmBV04TnxfTIf:kyCdjTTvmTTNI
TLSH
T1CC651207B7A230F9C677823088611A02F7B57C7607609EAF57A146775D37391AE3EBA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 a52a7898475eb3fac88838a4615116b9c7e2db523030647a9954b44e37d0ba55
MD5 597ef622f9c35eb0ab2245f77ba2d138
SHA1 6eb5686061b7cb6d86d8f43509324377ac3e6e1e
SHA512 97ae0a567bda2857dabb17bc7895569624ddc500c27bb0e997ec818e529c0e37483da76c089aa16b105694bcaec735c56bb79f58637a0fb7d8c67cc4654c298c
SSDEEP 24576:XT0aLl3z0zDlCdjTTkql1n8jy14XcmBV04TnxfTIf:XTDLlj6CdjTTvmTTNI
TLSH
T1C3750195B39028F8DDA7823ACC218906E6B27C5A0760CA1F53E536674F333A15D3DF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 8e554cd72712f4388d2863513dc877186879000720952287c763cdbb4bc3fcdd
MD5 83b26c63d5da0e88e4b0feda178f889c
SHA1 24cd480d04395ee38bf6be556285dabc06d4fd49
SHA512 f4b1eeebac28f68f583166a981cffd5c263a08238e8c57648333362da60a4cd636cf4979ad2d8faa035a8e528f33e9af7346147de9318ba726a6886554530146
SSDEEP 24576:A31d9CHKy7GZBCdjTTkql1n8jy14XcmBV04TnxfTIf:K1d9CHKyafCdjTTvmTTNI
TLSH
T13C85CF90F3E410E8F1B7DA358D729511DAB67C9A1B60DE8F03A4651A1E337D19E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d63f82dfb115232bc74802b3d65d86084e733aaf0029bc29f2a0f577104f9644
MD5 f092644147bf1a255bf8190801a0734a
SHA1 cce84c9af25ccfe6ce5a641eb9ed6ffce05b3ae7
SHA512 364ded61df4b0587ddcc07472aa7eb031b700d652311c41549acea671262638c570b3b05ec474b32ad7eb5f51172a65feecf1305218a13dad35dbb2e5b3e4ca5
SSDEEP 12288:3Z0gtxbjYyOdjTY8U6Eskunl58Gdpx8SZKyZr4XiBJ4BV04Tnxf5n7FIf:31CdjTTkql1n8jy14XcmBV04TnxfTIf
TLSH
T1C9552312DDD6B276CBD6CB3068309349789D2E8F5694AD27F797C8238C36311BA68CD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 74fea99e63ff2e7522f9bdbd01d2c71e82114d96c9e4d08cfb2817124c038335
MD5 1beaf2c955e087cf740de506f42885d7
SHA1 4ca03662fd4a48a25ef163cb7bb939ce544cede8
SHA512 9bb08153152d62697c2f392cd695dacd51c4b6f34bed0660797aff71c9684c80172d549f0514b470d67f23d52439c4a72e89e1f363c9a5477353eb3dbc06cab5
SSDEEP 12288:KL0gtxbjYyOdjTY8U6Eskunl58Gdpx8SZKyZr4XiBJ4BV04Tnxf5n7FIf:KnCdjTTkql1n8jy14XcmBV04TnxfTIf
TLSH
T1B7552312DDD6B276CBD6CB3068309345789D2E8F9694AD27F7D7C8238C36311BA648C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 0ba1ae492455fa9cf177a35311d0452f7d20981269f440fc568bedbfd9ff157e
MD5 0ddf83c90ef41538c319c48cfe817f75
SHA1 b9ff08cdcc66d643c9a1a45414187ef0283f927a
SHA512 d3bfd283998d8207321c62432ae72eb28d9fed130f3aec2e4a510c85d69c3bba136e84f2b7473afd0f2defa62429873b09c2a477888e0b67bfaac1b1938a1334
SSDEEP 12288:fA0gtxbjYyOdjTY8U6Eskunl58Gdpx8SZKyZr4XiBJ4BV04Tnxf5n7FIf:fiCdjTTkql1n8jy14XcmBV04TnxfTIf
TLSH
T118552312D9D6B276CFD6CB3068309349789D2E8F5694AD27F7D7C8238C36315B6688C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 e003677e042f4dc82e9121d518467dbb9ff88f7773f8713ee81c25209e301877
MD5 170add03f7e123205df146de66f2943a
SHA1 c1a6d4a0b732ebb1b39ee0f779411714fd10c18b
SHA512 445316b8f322f337316bf7487e9d82ceb19f352772d3f79e2de60d5c42de1c8c2c5f420b912bcabb15eeb1033ea540c77c4944bf59f096ab3732b8e1324f2e77
SSDEEP 12288:Ke0gtxbjYyOdjTY8U6Eskunl58Gdpx8SZKyZr4XiBJ4BV04Tnxf5n7FIf:KgCdjTTkql1n8jy14XcmBV04TnxfTIf
TLSH
T106552316DDD6B276CBD6CB3068309349789D2E8F5694AD27F7D7C8238C36311BA688C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 87865133a1f297156ad6925e16b7efa4df0afd8269b90d619ae85ca487b39ec6
MD5 12df471d2456daf51001b99ba9e5812e
SHA1 86a97b154414727b4835c66c0d726ee4941b4fc8
SHA512 5040b133ff71985c8fa22f43c96f5dc38e40b209f01b1f561b889728afc7d5ee13c731dd3b60b13d577f302a8e25f214841e49ede0bed155233c26a98cf1b2da
SSDEEP 12288:LZ0gtxbjYyOdjTY8U6Eskunl58Gdpx8SZKyZr4XiBJ4BV04Tnxf5n7FIf:L1CdjTTkql1n8jy14XcmBV04TnxfTIf
TLSH
T153552316D9D6B276CBD6CB3068309349749D2E8F5694AD27F797C8238C36311BA68CC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 537db37f315419537f5da4bb110d8047105ca2a9a23b1baa2440d01e0587ace1
MD5 50546a8501b82525362a646a795ab284
SHA1 9e0b2b2387ac95109d13279a9e44bf61a2cc36c1
SHA512 cd26742cf8d58c70920d8e0488a78f60f3b01a1456b54f30754e3a2e7f7b2cf0e75640c47c7f2a88a45cb98b5d1d7498e79c184c85a3e5bc4e30cc2a726074d4
SSDEEP 12288:lG0gtxbjYyOdjTY8U6Eskunl58Gdpx8SZKyZr4XiBJ4BV04Tnxf5n7FIf:lICdjTTkql1n8jy14XcmBV04TnxfTIf
TLSH
T1FA552316DDD6B276CBD6CB3068309355789C2E8F9694AD27F797C8238C36312B664CC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 2cc1c49ca9aebd5e8aa62573d21d9b7578ccef2c44268cde6e6a77d404a20324
MD5 f75f031ec5b15059b4d2dcf7b3f2450f
SHA1 6247078ec9f5999adb664adb58017441e9dbc12c
SHA512 4341e437e3782baec263935f8ac58b52866ec97da815ec0e7ddcb19361cc87b348faaae92b4dc8a130a4f44c66792aa3f595f6d8e4586ef6a531d978437cbb55
SSDEEP 12288:J00gtxbjYyOdjTY8U6Eskunl58Gdpx8SZKyZr4XiBJ4BV04Tnxf5n7FIf:JmCdjTTkql1n8jy14XcmBV04TnxfTIf
TLSH
T15B552312DDD6B276CBD6CB3068309349789D2E8F5694AD27F7D7C8238C36311BA688C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 490da05c6fd564f7d27a3244ad19d53247263f08f30e08bbca0cac1b7ec48bbd
MD5 3162714936508f67b0b8094fc530232f
SHA1 030d0990269236d3f0040e25298f7113e3c1a7db
SHA512 eb5835b7ab05cd54f36e7fc3e2cb4a0f1891f4df9ef6e07632eb6e14e2397af12a9317ada78c3de4973622293951b7611b3e6be4d3a367e441e6983ef05437d6
SSDEEP 24576:ffwv/k9RX6wkyAIUCdjTTkql1n8jy14XcmBV04TnxfTIf:OMnYIUCdjTTvmTTNI
TLSH
T12F85D029EBDC44E5E1B7923C98B3460AF6B178591B31C6CF129A536E0E33ED46E39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c18055acf1f671b3343c26d84949d10839dd3dfe3b2995761338232ce9cb60ce
MD5 bfbca1faf03ec63dcadb02dc8c30b575
SHA1 b361ceabc6b4e6b25b3fcdd2e2a66dd6d79fd1ab
SHA512 5b5a7812582dd0dc8f3fb21f48e295c7a4dec4d34a99f6e45595a7a2a8a0dd8c3f29bc0db7ff9d3716397e50e5b64a58a784a6c5ac728df507f0b6da4e4afb93
SSDEEP 49152:7YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0JCdjTTvmTTNI:fySzPUdjTTs
TLSH
T1BD066C56A1A801D5C1B9C1B98F17CC1BFAB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 29d9e1c380f24fc99d666649967ca04fbdce69bec48f7954f8a4ba435947f1a7
MD5 181093ba9b35295b6094f401bf926276
SHA1 d6a5773a77349f2c9812437b40b149b5cc1d7a85
SHA512 9533dd800a496ccfb573a830c456238ffbb3fab8d7f69e93d304b8d2614d9d6dd92c987eecc5dff1d5ee6c522e28e8abf1fdd0527c252f31e8757084850371d3
SSDEEP 24576:947Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYTCdjTTkql1n8jy14XcmBV04TnxfTIf:947JUQj1irIhCnDHUPfF/5CdjTTvmTTK
TLSH
T19A659E1EA3EC01E5E1BAD23885154A5AEA71782E1B31DACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 872f0457eaf5dee1ff32aa7ca8618c943b85329db62459ce7733b6e536446d7f
MD5 2620b5e61daf3b6f78c803cbf19e625b
SHA1 54a222c37d063f2c49f19c5471d6dbf63696c788
SHA512 786b5f4811588b046b19515492d213608736af5793cf074ccb91bf3e0a1a1c1abeb2eabe625bc77284c99a3f6d1854d811f307afd29f0dacc9d477f345845058
SSDEEP 12288:Gssfu0gtxbjYyOdjTY8U6Eskunl58Gdpx8SZKyZr4XiBJ4BV04Tnxf5n7FIf:gwCdjTTkql1n8jy14XcmBV04TnxfTIf
TLSH
T18F65010AD29852E9C5AE9230CB514641B3773C5687E0D7CBA3D1F83E0F36690ADE9B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 b18951f64dba94029d85fecbf0a745c1e32eee2c49a82f0416227a884a30c52f
MD5 56a0c6a819a917e090587865d5cc3f4a
SHA1 819e52406011e9c5d48f808fe0e1b6c116d480aa
SHA512 c9df783c290e37b6f9226eedb8dcc2efb8cbe722fc65500d0ebb0703908769b3e643cd0f0fce8679e38c667935d38653c382de5e5ffb29447c1805a608ee96e8
SSDEEP 12288:b+kyU3fffhbSyHQMXJVF5irWH4SXld883Lc6lN:b+LUP5/5XgqHNXld1
TLSH
T1F24507407666C78FC66980325E32D1CCAB707D01EE04AE0773C99B3FD576659BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 386KB
SHA256 cfdd4157197484300517864b346531ab738b417ff8fb250b002d9467321b7f4f
MD5 dcc74cfe518fee30a19e7e46b5921eb0
SHA1 3d32c7fcf6a9f8bcb8dcad2273afd562ef34a39b
SHA512 b65b0474f27d4ca4460b9f5555f8bd86b62b43442cd415e4714b38d52794423a074f1bc834bc8a4de4ef09f578a0897b01d47cea95fa002d43ac85b16c10fa06
SSDEEP 1536:ve/vjaZy1SEnvTL+G7ZR1+kjfJygJcPuHxW:GTaOLVkkWj
TLSH
T10484EA427724E31EC4B940738931A7DE9B3CB5129F026F023BD85975CCB226AB5B6BC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c4d7061d12f1d45e47e9041dab0ab0405182273a75fc9a76959efd3f9297ac4e
MD5 b18f3b87df5360cad6b3997a0fb110ab
SHA1 457a179e909ebe764f33fee9b5f86fce2db9bdcf
SHA512 dc83bc8abe41ca1df7ee3c5fffffcc82842c4a8c5d6a8e8d368d5125da410c725de82137cd1c9831b32af22378ad24087901073255daca0aa62e0082e510e9ca
SSDEEP 12288:vJ7W0gtxbjYyOdjTY8U6Eskunl58Gdpx8SZKyZr4XiBJ4BV04Tnxf5n7FIf:pYCdjTTkql1n8jy14XcmBV04TnxfTIf
TLSH
T151552312CAD9B526DEF6CB3028309214745D3E8A4B80ECA7F783C9678C35791FE74989
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a870d13621839b01d0daa8448e40a555bd4372a397f384c80bad09d802837c08
MD5 f1f2df8faabebfee029e66a7a7e37d7c
SHA1 aaa62e8bb22afd6881353c2abaadfaaad9398221
SHA512 b7a6d32c37091c0a5441db8529649aff410f090620f46cf1b0381c6bfdea6a3c850738dddf08b41b458f67b7449e04a9e1845cb65c6058fb8cb8aae9334559e1
SSDEEP 24576:0gb6bmBIi49WNNFpg1rSvFv7bY6CdjTTkql1n8jy14XcmBV04TnxfTIf:0gb4mBIBhGFTCdjTTvmTTNI
TLSH
T10765AE1E22EC02F5E0FAD2B89DA64417D6B278160731D6DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 369b3822b026f2cc48f04d6d9b8aa6f0c38a507472a71c672a6e8decc631276c
MD5 6c2be4d178fc56e3bc645bd980879c13
SHA1 ec827c2719b51b422a1f13e9b73d77fcd93ad40d
SHA512 9fbba02069d43d304549144f6d7d844c5f9a5159c63fdb090a916cd473a429553a91b8ddb2a4b814175dac4dcbdef116668557e5bc9918db24e57060859696fb
SSDEEP 24576:WG88u8FpJqH1Qzria7/mjCdjTTkql1n8jy14XcmBV04TnxfTIf:97ZFPqVva7/CCdjTTvmTTNI
TLSH
T17985F165A6E101F1D47BD13889424663F6B2B8160364EFDF07A88A521F33BE54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 9dd861c9b25eb4e45aa5879d3011fc27879bc77015ba1123874bf342505786d5
MD5 e57bacaddb4244288750ee6852aba224
SHA1 55ef532b505b94223db6bf2b713d8cd554d315f0
SHA512 eea5c68a9311464b8242fb256680c39a94e614637807f3f02dac09e80bedb441b24d61696e561629bec3c5bf55f860b5a6d0377707c753c6c5c8293e47e4013c
SSDEEP 24576:fPUr+NQfCdjTTkql1n8jy14XcmBV04TnxfTIf:fJQfCdjTTvmTTNI
TLSH
T1A165E12F66E918E5E676E13889428709F77178560311E6DF03E1817E4E37AE8BD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9cbf1eb5cf1804893bf60928856f71817999796093a096fafe2b5612adfe74fd
MD5 e2e15c5650b327eb397a5f8b0776e61c
SHA1 8fd440bf7bdeed6c8cd3f5bff485a6facc66770b
SHA512 d3fc8e0e901f0db167cb728dd8e04436204dcce09cdde467b9c6ee0cda585aa1307a523c73b35aed9be8ad2f3916e9d52fdbc088b5927aea2cf488609e2d17a7
SSDEEP 49152:YBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjvCdjTTvmTTNI:zG05lO43bBdjTTs
TLSH
T18DD5CF6A62EC11F9D1BBC17CD9C6460BEBB23815033556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9f52a577c5ec2c14385f1a55b180e3f01971ec5ff5e94d7b5ee2441eb0958163
MD5 af233979264768c2cf71fe377df94eb9
SHA1 b0017dda35deb2035ec341ff128b21f33f296100
SHA512 7e0c82a8d15f4f75f2f0676375d82028eaacdcef1cbf96cfd2bdf1c890e783762cffbdabf0e9bdf6068e1e4353fa081219dc7c170998ae730ee5f9cadaf4d669
SSDEEP 24576:4fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnJCdjTTkql1n8jy14XcmBV04TnxfS:Aa5POZ3+Jt2pasx2+mnCdjTTvmTTNI
TLSH
T10665BF5EA6FC01D5D5B9D17CC583861AF5B1342653319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f5b03c8922f919219cfa13eba78231b09ff0ec123160852e254cb5867ea9d2f3
MD5 f8153da82312b59bc8735af7377b9c6c
SHA1 33fc52b9241e0af2d2e36108215c21141fced215
SHA512 eeaade3d5daceb90a0502345285a9aa719986cdedccfd762b628f16d96d2e03e6b8e73d52bd0dcdb3053a12b76ea526f3ac7828f734bfcaa2464e7fa167b2aed
SSDEEP 24576:bNcwHdjbyQ4nLC18lb/EOjowL7FkbCdjTTkql1n8jy14XcmBV04TnxfTIf:bNc/zEOVHFiCdjTTvmTTNI
TLSH
T162858C1623E901E4F5BBE1BE89779546FA71786513308ACF0291851B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4b5a4c92401562f3c9763ac798834383aee60eadc2e8cd1f8d6f07b7cbcaa187
MD5 d9f0101fd45c0e48d0218ded0b405aa4
SHA1 143951cfd45ce6f12c50bd0ccff57f20d5822b80
SHA512 f55f9250a2c2f789fd933e09f86c77a516b3d2146e81af66703845e9c42d5d006208c65620b4ca3c531774bec29073c0b003ab80305337fbb5489fe95b6ae3a0
SSDEEP 24576:98kNvNnaFeYhJNtmZBmNCdjTTkql1n8jy14XcmBV04TnxfTIf:98MwBtOmNCdjTTvmTTNI
TLSH
T1D155AF2EAAF846E4D1FAC6748D238512F6727851073293CB9390C13F4E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 59e58a617b4a477ea94c3b54d2dacdebe339342ad8b923bfe7996df349b6c9bf
MD5 111661271eb038ae87721c41c79c3ac2
SHA1 32c32d7616610299243ad821b570a5b68f294bea
SHA512 335a26a3ff9ceb5297e683751bd01f0d4f4f24b617edf2fa381b9093b653ebacda26fa59a8758acd5f3b7223b480a7e790ef627eefdbc2dbb6335d1b3d544c29
SSDEEP 24576:qD3FHshBIYQgAMCdjTTkql1n8jy14XcmBV04TnxfTIf:qDVHeBIAAMCdjTTvmTTNI
TLSH
T13375E13EEA9C00E4D57BC27C9A638606E67138A9032169DB12D5C1B65F2BFE47D39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/404-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/404-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/404-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/404-123-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/908-341-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/908-86-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/908-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/908-343-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/908-93-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/908-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2008-85-0x0000000000400000-0x000000000056E000-memory.dmp

Download

memory/2008-0-0x0000000000400000-0x000000000056E000-memory.dmp

Download

memory/2008-1-0x0000000002610000-0x0000000002676000-memory.dmp

Download

memory/2008-6-0x0000000002610000-0x0000000002676000-memory.dmp

Download

memory/2008-7-0x0000000002610000-0x0000000002676000-memory.dmp

Download

memory/2392-75-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2392-76-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/2392-81-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/2392-307-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2752-134-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2752-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2752-131-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2752-125-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2752-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3048-306-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3048-65-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3048-63-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3048-71-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3524-118-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3524-310-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3524-119-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3532-100-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3532-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3532-106-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3532-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3532-311-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3532-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3868-21-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3868-98-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3868-20-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3868-13-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3868-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4772-59-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4772-53-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4772-52-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4772-291-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5344-48-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/5344-50-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5344-38-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/5344-44-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/5344-37-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5832-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5832-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5832-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5832-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download