Analysis
- max time kernel
32s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 02:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
28 signatures
150 seconds
General
- Target 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 1.3MB
- Sample260731-c4j3pabd97
- SHA256 551b0dcb594dbd9642869fedbcca227b9cd6e3996467b21d1c83d3de1dae5a79
- MD5 b8256fd225fbb4b4685dded72704b6c7
- SHA1 a7e974b38bc06a29770993255b11ed579e624672
- SHA512 ef00803c5a524c36f519d5a043fa8dab00dd9e3a3bd7a0d736526e166f0be9fbaae0309a262dd3206116f714599da107f8702a1706a5db5c00bd4033ab8facd4
- SSDEEP 24576:vJksqjnhMgeiCl7G0nehbGZpbDHSbpa0sqjnhMgeiCl7G0nehbGZpbD:vJADmg27RnWGjfKBDmg27RnWGj
- TLSH T18655237A650870A7CC3248B5C2D5E16D680F7D6399205843BA5738FFBFF60A48A394A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" CacheMgr.exe - UAC bypass 3 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" CacheMgr.exe - Windows security bypass 2 TTPs 18 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe - Detects Reflective DLL injection artifacts 3 IoCs
resource yara_rule behavioral2/memory/3640-31-0x00000000046F0000-0x0000000004706000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral2/memory/3640-389-0x00000000046F0000-0x0000000004706000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral2/memory/3212-450-0x00000000032B0000-0x00000000032C6000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 27 IoCs
resource yara_rule behavioral2/memory/3640-19-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3640-24-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3640-25-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3640-26-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3640-28-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3640-27-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3640-29-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3640-30-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3640-34-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3640-49-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3640-47-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3640-197-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3640-198-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3640-290-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3640-82-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3640-342-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3640-351-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/572-449-0x0000000003C00000-0x0000000004CBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3212-461-0x00000000045A0000-0x000000000565A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3212-463-0x00000000045A0000-0x000000000565A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3212-464-0x00000000045A0000-0x000000000565A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3212-465-0x00000000045A0000-0x000000000565A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3212-462-0x00000000045A0000-0x000000000565A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3212-467-0x00000000045A0000-0x000000000565A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3212-469-0x00000000045A0000-0x000000000565A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3212-472-0x00000000045A0000-0x000000000565A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3212-473-0x00000000045A0000-0x000000000565A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 30 IoCs
resource yara_rule behavioral2/memory/3640-19-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/3640-24-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/3640-25-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/3640-26-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/3640-28-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/3640-27-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/3640-29-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/3640-30-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/3640-34-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/3640-49-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/3640-47-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/3640-197-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/3640-198-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/3640-290-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/3640-82-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/3640-342-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/3640-351-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/3640-387-0x0000000000400000-0x000000000054E000-memory.dmp UPX behavioral2/memory/572-455-0x0000000000400000-0x000000000054E000-memory.dmp UPX behavioral2/memory/572-449-0x0000000003C00000-0x0000000004CBA000-memory.dmp UPX behavioral2/memory/3212-461-0x00000000045A0000-0x000000000565A000-memory.dmp UPX behavioral2/memory/3212-463-0x00000000045A0000-0x000000000565A000-memory.dmp UPX behavioral2/memory/3212-464-0x00000000045A0000-0x000000000565A000-memory.dmp UPX behavioral2/memory/3212-465-0x00000000045A0000-0x000000000565A000-memory.dmp UPX behavioral2/memory/3212-462-0x00000000045A0000-0x000000000565A000-memory.dmp UPX behavioral2/memory/3212-467-0x00000000045A0000-0x000000000565A000-memory.dmp UPX behavioral2/memory/3212-469-0x00000000045A0000-0x000000000565A000-memory.dmp UPX behavioral2/memory/3212-472-0x00000000045A0000-0x000000000565A000-memory.dmp UPX behavioral2/memory/3212-473-0x00000000045A0000-0x000000000565A000-memory.dmp UPX behavioral2/memory/3212-563-0x0000000000400000-0x000000000054E000-memory.dmp UPX - Executes dropped EXE 13 IoCs
pid Process 3868 elevation_service.exe 2972 elevation_service.exe 3672 maintenanceservice.exe 4496 OSE.EXE 7136 PerceptionSimulationService.exe 4512 perfhost.exe 1916 ReFsDedupSvc.exe 6364 SensorDataService.exe 4552 ssh-agent.exe 1276 AgentService.exe 4508 SearchIndexer.exe 572 CacheMgr.exe 3212 CacheMgr.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 21 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" CacheMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" CacheMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" CacheMgr.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\StubPath = "\"C:\\ProgramData\\CacheMgr.exe\" -as" 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" CacheMgr.exe - Enumerates connected drives 3 TTPs 54 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\I: CacheMgr.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\D: 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened (read-only) \??\J: CacheMgr.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\G: CacheMgr.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\D: CacheMgr.exe File opened (read-only) \??\H: CacheMgr.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe - Drops file in System32 directory 39 IoCs
description ioc Process File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\4ec75b4f957eebe4.bin elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe -
resource yara_rule behavioral2/memory/3640-19-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/3640-24-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/3640-25-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/3640-26-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/3640-28-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/3640-27-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/3640-29-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/3640-30-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/3640-34-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/3640-49-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/3640-47-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/3640-197-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/3640-198-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/3640-290-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/3640-82-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/3640-342-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/3640-351-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/572-449-0x0000000003C00000-0x0000000004CBA000-memory.dmp upx behavioral2/memory/3212-461-0x00000000045A0000-0x000000000565A000-memory.dmp upx behavioral2/memory/3212-463-0x00000000045A0000-0x000000000565A000-memory.dmp upx behavioral2/memory/3212-464-0x00000000045A0000-0x000000000565A000-memory.dmp upx behavioral2/memory/3212-465-0x00000000045A0000-0x000000000565A000-memory.dmp upx behavioral2/memory/3212-462-0x00000000045A0000-0x000000000565A000-memory.dmp upx behavioral2/memory/3212-467-0x00000000045A0000-0x000000000565A000-memory.dmp upx behavioral2/memory/3212-469-0x00000000045A0000-0x000000000565A000-memory.dmp upx behavioral2/memory/3212-472-0x00000000045A0000-0x000000000565A000-memory.dmp upx behavioral2/memory/3212-473-0x00000000045A0000-0x000000000565A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe elevation_service.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe elevation_service.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\e59840b 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\SYSTEM.INI 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File created C:\Windows\e59d306 CacheMgr.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2796 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CacheMgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CacheMgr.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005a1a39a89520dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000376b7aa89520dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047ef07a99520dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092b02da89520dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003ba63aa99520dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054059aa89520dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000051b7ada79520dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002b0a1aa89520dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 3212 CacheMgr.exe 3212 CacheMgr.exe 3868 elevation_service.exe 3868 elevation_service.exe 3868 elevation_service.exe 3868 elevation_service.exe 3868 elevation_service.exe 3868 elevation_service.exe 3868 elevation_service.exe 3212 CacheMgr.exe 3212 CacheMgr.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 804 Process not Found 804 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe - Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 3640 wrote to memory of 2796 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 90 PID 3640 wrote to memory of 1176 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 15 PID 3640 wrote to memory of 3164 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 47 PID 3640 wrote to memory of 3228 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 48 PID 3640 wrote to memory of 3644 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 56 PID 3640 wrote to memory of 3288 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 57 PID 3640 wrote to memory of 4320 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 59 PID 3640 wrote to memory of 4384 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 60 PID 3640 wrote to memory of 4444 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 61 PID 3640 wrote to memory of 3192 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 63 PID 3640 wrote to memory of 4860 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 64 PID 3640 wrote to memory of 5136 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 65 PID 3640 wrote to memory of 5236 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 66 PID 3640 wrote to memory of 2188 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 80 PID 3640 wrote to memory of 4640 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 81 PID 3640 wrote to memory of 4308 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 82 PID 3640 wrote to memory of 6576 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 83 PID 3640 wrote to memory of 5588 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 84 PID 3640 wrote to memory of 2796 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 90 PID 3640 wrote to memory of 2796 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 90 PID 4508 wrote to memory of 4340 4508 SearchIndexer.exe 103 PID 3640 wrote to memory of 3212 3640 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 106 PID 4508 wrote to memory of 2940 4508 SearchIndexer.exe 107 PID 3212 wrote to memory of 1176 3212 CacheMgr.exe 15 PID 3212 wrote to memory of 3164 3212 CacheMgr.exe 47 PID 3212 wrote to memory of 3228 3212 CacheMgr.exe 48 PID 3212 wrote to memory of 3644 3212 CacheMgr.exe 56 PID 3212 wrote to memory of 3288 3212 CacheMgr.exe 57 PID 3212 wrote to memory of 4320 3212 CacheMgr.exe 59 PID 3212 wrote to memory of 4384 3212 CacheMgr.exe 60 PID 3212 wrote to memory of 4444 3212 CacheMgr.exe 61 PID 3212 wrote to memory of 3192 3212 CacheMgr.exe 63 PID 3212 wrote to memory of 4860 3212 CacheMgr.exe 64 PID 3212 wrote to memory of 5136 3212 CacheMgr.exe 65 PID 3212 wrote to memory of 5236 3212 CacheMgr.exe 66 PID 3212 wrote to memory of 2188 3212 CacheMgr.exe 80 PID 3212 wrote to memory of 4640 3212 CacheMgr.exe 81 PID 3212 wrote to memory of 4308 3212 CacheMgr.exe 82 PID 3212 wrote to memory of 6576 3212 CacheMgr.exe 83 PID 3212 wrote to memory of 5588 3212 CacheMgr.exe 84 PID 3212 wrote to memory of 2940 3212 CacheMgr.exe 107 PID 4508 wrote to memory of 5048 4508 SearchIndexer.exe 108 PID 4508 wrote to memory of 1036 4508 SearchIndexer.exe 109 PID 3212 wrote to memory of 1176 3212 CacheMgr.exe 15 PID 3212 wrote to memory of 3164 3212 CacheMgr.exe 47 PID 3212 wrote to memory of 3228 3212 CacheMgr.exe 48 PID 3212 wrote to memory of 3644 3212 CacheMgr.exe 56 PID 3212 wrote to memory of 3288 3212 CacheMgr.exe 57 PID 3212 wrote to memory of 4320 3212 CacheMgr.exe 59 PID 3212 wrote to memory of 4384 3212 CacheMgr.exe 60 PID 3212 wrote to memory of 4444 3212 CacheMgr.exe 61 PID 3212 wrote to memory of 3192 3212 CacheMgr.exe 63 PID 3212 wrote to memory of 4860 3212 CacheMgr.exe 64 PID 3212 wrote to memory of 5136 3212 CacheMgr.exe 65 PID 3212 wrote to memory of 5236 3212 CacheMgr.exe 66 PID 3212 wrote to memory of 2188 3212 CacheMgr.exe 80 PID 3212 wrote to memory of 4640 3212 CacheMgr.exe 81 PID 3212 wrote to memory of 4308 3212 CacheMgr.exe 82 PID 3212 wrote to memory of 6576 3212 CacheMgr.exe 83 PID 3212 wrote to memory of 5588 3212 CacheMgr.exe 84 PID 3212 wrote to memory of 2940 3212 CacheMgr.exe 107 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" CacheMgr.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1176
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3164
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵PID:3228
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵PID:3644
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3288
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4320
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4384
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:4444
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3192
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000268;000000000000026C;1⤵PID:4860
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:5136
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵PID:5236
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵PID:2188
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:4640
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3640 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\2026-07-31_b8256fd225fbb4b4685dded72704b6c7_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe" "C:\ProgramData\CacheMgr.exe"4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2796
-
-
C:\ProgramData\CacheMgr.exe"C:\ProgramData\CacheMgr.exe" -as4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3212
-
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:6576
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5588
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3868
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2972
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3672
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4496
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:7136
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:4512
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1916
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6364
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4552
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
PID:1276
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4340
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:2940
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:5048
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2860 2856 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:1036
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵PID:2832
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2860 2856 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:1544
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:4272
-
-
C:\ProgramData\CacheMgr.exe"C:\ProgramData\CacheMgr.exe" -as1⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
PID:572
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 997702b33b215facbeea292d24a4c8226ffec432a852275f8bfad71ae06a1a8f
- MD5 298c813bbbdcf2c6a26fd80a96d7962c
- SHA1 0e63f6470013ddcf50ebc644148c85449a699fd0
- SHA512 19a0f21d10468238f3bc4466a8066a1b3356875c8db72defc6d8298874d2095b78934bfa9d701a131fea6f88aed27617982c0136a88cecf7360b70a229c10b1b
- SSDEEP 49152:hb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnGDmg27RnWGj:n3q6sjBND527BWG
- TLSH T146D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 c5c0cd6df603c5a062e39a385d99c680ebb9d0f55e1a2539fbc07573a0bb2f40
- MD5 56a5053b5422179ad6790a66a5d09c8f
- SHA1 54fa104793bf846eba1145b54146ac2a076b4e68
- SHA512 73745cf17b80a4b1fe1d50137edd08f1b696c1cfab1913746bb6ea3bed92a3303421ed2645f78626e7d38e97b23c9b48ceaf898d1de63352a247c5c0e5f7f59c
- SSDEEP 24576:JXYfDtczA1sqjnhMgeiCl7G0nehbGZpbD:stcMDmg27RnWGj
- TLSH T174050129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 2fba227fef37c7beacdc3832b29f5d431958bc6553d1eca478ece9d8a3d2b47b
- MD5 7654be5cc3aeb9e29d5984e9f8c2ce88
- SHA1 7454d717cb6261a990ec87a55c9cdba2bbdddb33
- SHA512 15eab7338470ac11ab8ba977a2f9c7747063d2c4ae9ecdb9393bfac670b4e319df7dc51e61c7feec2b293e37b84c15e8cc1dcd343ce29744ef44a64678068da6
- SSDEEP 24576:B0Le5ji0hmxxrMasqjnhMgeiCl7G0nehbGZpbD:BPji0AjbDmg27RnWGj
- TLSH T1A4359E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 3ca7efa09dc18569cf6868030d3fc9a846e66b117ad9995c3d9bb4676b04f22e
- MD5 ca784ecd4126244b200b79e05e6db9af
- SHA1 b72b7ddac68b1a37d26ced8af50667335ed45cc0
- SHA512 095904e3628aed4c2d210b7d4d6ed66683edbdaef4549d0b48daa8e0e8bbbd8c308c91c5e15a2ec122380880970c98385c83967ea468378fb6a3bbd9bf031bb9
- SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWn6q8wyuAsqjnhMgeiCl7G0nehbGZpbD:C/ezSC6vUzPveHjynDmg27RnWGj
- TLSH T157755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 ed60df78af1964fe5d0ac9fb37e5d21709fca07cae077b04a231019f69f52544
- MD5 7e9b9c3874213c154ca0841efe06c182
- SHA1 b3c77d0dbc3757b1f016aa369d3b199ab5017ec8
- SHA512 4cba526b00046fbd81102f76ff812a4f6dc10822f0bd49c21ab4991c4169706ada0b0ef82e7bc412ba51b96783fb382ae8e4a29c4d3edec1f8f69563860d4156
- SSDEEP 24576:uVbqPb88hv/l+Y5sqjnhMgeiCl7G0nehbGZpbD:uVO88hXl+0Dmg27RnWGj
- TLSH T171559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 27ed445ea8fc5e8ccbebae61c295caaabde291cf59b592b6adef9b73f6d15e5a
- MD5 a1e72842e65afe59a56cffb90487f217
- SHA1 9f5951de05074fdd7938ce47e71619ccdfb7613c
- SHA512 fa57ab511a55524f4b98208a3cc8b1c40930503db4999879b4bb6ed7e210c9ab5341a61cd95b952cc8028c373407cf1ec7ecd88c0fe7b4ce4cd141c5694ce4ae
- SSDEEP 12288:fL+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fL+sqjnhMgeiCl7G0nehbGZpbD
- TLSH T1AAC423BE824C11CAEA7708B5C3E9F51DAC173E5698201C536A637DFDE6B5468CB39023
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 a1aad057d5c950dbdd864499c6cbdcb7bb33934f6eeac0bbe73b905728742b13
- MD5 6663545f7a22a604175cfe059c99e813
- SHA1 7a2411a2a37b917acf7d0d0dd91ca968f106d449
- SHA512 e5a709f4a0973fc723f4f749cc595e7e8d002300bba3ca1fbec823ed312b166d158aea8f9304fc955b2215ccb0c2296cbee8f5dfea4391e2ad72c2e22a46d841
- SSDEEP 12288:GeBNUbTVO86UxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:GJIUxsqjnhMgeiCl7G0nehbGZpbD
- TLSH T15A05CF7BEE28FCD2C27A8DB95791C600E77278314B21A3CBD165824EDE235E44E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 6555047b28ad8c0c41258b46a5e77b4bf0e6f0f5025a84a25b2a4cffea57e4f0
- MD5 093e9dc768f28a6b734362b4b7992b98
- SHA1 12ec3728aa80b98ace8114bf382d7ea19fed2002
- SHA512 3ceb846c9e262fa9f2b1db0848377cde404723754eb5b559a674070795e1e3fc2347333d95c39c45a73a6a63507ea6912d09f7796a715eb113cf0a857d44cb58
- SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THw:KQvGAdlCEL8c/DRNw5CsD527BWG
- TLSH T149266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 9bf51a310a69f71974e573836d9066e0acf21c705bd9f59cab2c53b161a98166
- MD5 7f19629762460a5959ecb5f2a0d59a5b
- SHA1 ff84a2935ba060554e37854fe15e47d0c47fe5bc
- SHA512 0b0a3f2daa99faa1cee8e89fd2093b9f196cccf01438d614ee7d20f6a97207139ad364d8726d41dda0a1ca3b2a62bc4583cf7c043a4007f1606f5603e22714b8
- SSDEEP 12288:xAwSfxL/2Dc3RDLLmt0LDQewsAj3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:S0ewsAj3sqjnhMgeiCl7G0nehbGZpbD
- TLSH T14D15E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 5fc563410b2321a918543ccde8935996329d413615c17851db3abb967a09456c
- MD5 2c7d8c7e3bfb5a8effb8b969e584d13c
- SHA1 aafc61d75a130ad5acbcc099bfef085d33778785
- SHA512 d4ae46b82efb418ec800b7f410f093b46396d7115d682ce55224f618e0d94ef46aa9cbbd15ddec537e4a9252002921b187c51352c7a67f0a416f841bcce16a1f
- SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHjVQBWG:AUEtQevvqc2W1cpV2tI32aB
- TLSH T102474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 4265fdf14eb5d144d339b207f4cc52cd9dfc1fb374e583bc649d5f29f4d8dbd9
- MD5 b3701cb6f6cc69a8dc7a60f440037c44
- SHA1 ace409e5b76d023855cf9a66c264aaa0af4a6019
- SHA512 09c62f838bb700ba8e8309d84e635903e8df7bcd2228b2276eb2d9f380f2f025952cc8d019eb4fa4c94479cfdd1164c477ec1f00e91bfe721f274cb5f178182f
- SSDEEP 49152:ZCbRquA/m2yL5zTfFiV+XenmE3/zrDmg27RnWGj:2oquVjnmID527BWG
- TLSH T117D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 148b202f0036004189c060fc5e9881bfbe93b363fbcdeddf4edfb03853d0196b
- MD5 760682d90cb566d1bf446b222b8d501b
- SHA1 7ff340e3b7e5412755b80dd21fa9c8065fa5ae21
- SHA512 74aef2001d494d471bd9498cf0cb2f51d09dd31dac51ac89103724317af5ef052510ad05cdc1d8d24e0b615af92d1c78ad4c298e3b0f7365e5d8946684dc421d
- SSDEEP 24576:/AhGL3IFoiwtA5l7S538sqjnhMgeiCl7G0nehbGZpbD:/AMUFoiq54Dmg27RnWGj
- TLSH T157359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 460bf9b55cc7e78afcde5d915a401bc5e41583aaf1a584f9ed1df6983b9a2e06
- MD5 bc5fd0db187da4b80be1269930c0f2ef
- SHA1 fc62d5885c6a0e988c5bf75d22e79add92060708
- SHA512 ea2c5dfd7d7e44e430c575316af4ebd78cfadbfdc790ac84c7452ea9dd4bec2d206b0a2b1c111a534b32e5f04ee33528cd3ae07526178ef304ff3837ec5acc80
- SSDEEP 12288:emw5HEjsChNVBFgl0WDm+CgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:3wu4OWDsqjnhMgeiCl7G0nehbGZpbD
- TLSH T17D05F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 71e9f641a0920ad57e9e20a037c1a329f32691b6de8f1bac5db9bb468778c2eb
- MD5 7a5464464a099f13c23b67a3e81106a0
- SHA1 5b78bc716859905c63c94259233524b81bd4d60c
- SHA512 c834f7431ebb478b9a75ce2ead763643ac6a1c64691189f44a3f468eebdce18c1e18afdd161b1e513671b68190fa834299d11eefcf3ce47c3d62d435c0665069
- SSDEEP 12288:NeZ1IynXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oZuysqjnhMgeiCl7G0nehbGZpbD
- TLSH T17CE412AE239820FAE563417CC6E5D609E7333C52673003CF166656AA6F73AD44E39732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 573e0983423439eb01fa2cbe2fdb5c820dab5632823c5ad215d5126fbf02e37a
- MD5 74ba3e6971f16d1bbb5045afba485d8a
- SHA1 1c5ae36d3609cd9e972f96f6efac83c8797b85de
- SHA512 e68994443e8b8ff41d57b46b49149df7a70e37b7f8577c5c9d8222801a77343619a09e6e8dce40ec70b78b17b9038ede22f053c75a39d9c53d9bfacf985ef101
- SSDEEP 98304:3QRQyi36YOcPbLvw2gAf+PN3RD527BWG:mQyiKa/X+PNhVQBWG
- TLSH T118667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 5db9abcaeca6dcb9936fec7fdda3b61e792b41dbc27af9b3f6d356ac40ae5c9c
- MD5 b0f4f792831c84b36ffd03fa5d480328
- SHA1 b9bbf95163bdf24bf2fc0394a6e803de5404e813
- SHA512 b7e22d6faace97e4467be81508be31056fc34326b74008a9310a68aa15819fe0e05dc2834884ecfdf2408a8bc1c4739417488311f4c9f46a1826ccf8e2196118
- SSDEEP 98304:wQRQyi36YOcPbLvw2gAf+PN3RD527BWG:nQyiKa/X+PNhVQBWG
- TLSH T194667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 fb546fae9890e70180316b1bbbb3a1e7950443ac19055c4b58d6ce56e7f2b786
- MD5 774ae9afcebf0c5f74cf72f7da0a2be0
- SHA1 d096100511365dbe27cdc5c8222627adf7c9b3a2
- SHA512 192e959e7dce1feeb8a634204bcd91603538792b4d4ebe680475e5aec0c14f06bc7795391b3ac4d051b8a6082d9ee16de4aabdcad2caf2b0e64554dc59d79fc4
- SSDEEP 24576:fwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0CsqjnhMgeiCl7Ge:H68Qg55nhceWu7PNU3/bDmg27RnWGj
- TLSH T1BFB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 7734504e68c929d522e5e02db5b2e46bf2d817eca012961bc35bf01b409351dc
- MD5 7d847a45b9f2d571942fa91c59bf003f
- SHA1 f56f13c4db34fb00a23ed7673de652a80b42acac
- SHA512 72fcb8874dab0099db641ceec04a0ee9bb91c2aa1728d308133a7d5e378e8f50f1f04025ab2a1c9e373007427a4b747483500c6c4d5c55a0b6355daf4278cf11
- SSDEEP 98304:Sy5112gYy5azzVvt69nLKnhZSD527BWG:bLIHEWhAVQBWG
- TLSH T12D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 d560506e30df9324fc7d57f751102985641564be9d26bef2ab5f92e4b4e90e4b
- MD5 73bc14f5740dcf4b27e643040bbf134e
- SHA1 b99552539f36eec9a3e031cc8261acc36fe34447
- SHA512 0c653b6caa944d028d1101cdf06759fc6e14a1a75cd7cc2949cb575cffe155b07b9cab0750eb8ab7e45b7199ff49eb626cedb418c5eadc2347b433e086b22947
- SSDEEP 49152:QB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl5Dmg27RnWGj:Ku6Jmdxd2d5D527BWG
- TLSH T19BD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 0a9c632b87ae0dfd13e0e5c87c8034cc457ede1eadce9413fca96e8af2d52f24
- MD5 b4041160f7ad97141af9b3daf2b37f62
- SHA1 bcc4a9dda5e2fe5f21a1a214dbad330fc8d8b787
- SHA512 cd36904d2490e22fefdcd175958db52d982848d69f7a0903f817f33b52726613c5e0bf3a013102f4dbd2edbeed9d4ed9fad74ecf0ddb13689068e74fc41b5696
- SSDEEP 49152:D1hpsNoJpF1A63U44CwH7R4xlDmg27RnWGj:DmifPWRID527BWG
- TLSH T163B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 9ddb4887bedc1e1f81985630695ea7e1d72fb5e28593b2718fed643c99949315
- MD5 be9d72dacddc2b00054c25d58f8ebe88
- SHA1 1a58b4cdc3092061193a7c862a3b9788bf09066c
- SHA512 7c465ab05c83c3feba471cb054abe99668b6f682de97ae8b4b49d89b56cf19fd9b4092482b1ff4388d3361f1fb73dae145bffb75b2b7715974b4028ff90c7db7
- SSDEEP 49152:SSuZQIY0Be2KcRVtOnks6NMHq2Dmg27RnWGj:M5dKii612D527BWG
- TLSH T1ECC5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 c310f7ca5dfbe0d2a63210cae6763ee3ff2f598cde785bd4beef2aa57dd7bcc4
- MD5 885b5da536953544bbfea2987a1cc8b1
- SHA1 6dd8d8622831d34e37d0314f9495da742fbd50ec
- SHA512 7195d5e38d80a3cfb75be3c89a64607584f369f908d92dca50ce5b0e307191e57b7bd014c3c57fc82e8871939f7390daf3f580ee216f87676e8316e7f96669de
- SSDEEP 49152:phtSn8EApI0fig3giDn0AP5wpDmg27RnWGj:YX2imphkD527BWG
- TLSH T1CD95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 fe5f3ce3a4c7ab6753605f0795cc60c393b0fe418b0b3415049b7de9e86fc486
- MD5 535d5f2999818da3cbd80403a4c98a41
- SHA1 9e698244792aa778ca58dc3790a2412d362fe2ee
- SHA512 8b4fd1dec822ee75bf650bd64abdf28de35c45cd389a543c3d63c47c3a570c40b9eaad9fac5bd049ec7f5cc5b5e986f1783129f42b17f805df1586feb7ece81e
- SSDEEP 12288:mWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mWsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1DFC423BE915C01CBE92244F5C3E5F15DAC173E57E92004837A9778BAFBF24A84B39426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 f024ca42b6041a5c4aff13c5fa0f41cc846726d738fe7ec47018c0ea742e57b6
- MD5 4678b14d084718b737f997459a45dc9c
- SHA1 3daf5b2d3f2ad2ac26a83db2164ac251dc688b15
- SHA512 78000194144d64f734ef53fb5b8adce4e44ffbd9a1d6f5895515fde1056f4642610ff0692ab48c7ff9188d2bb934acb01b0473801a4cede94062ddb65a679fbd
- SSDEEP 12288:XLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XLsqjnhMgeiCl7G0nehbGZpbD
- TLSH T180C423BE915C01CBE92244B5C3E5F15DAC173E57F9200483BA9778BAFBF24684B39426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 67db1c026f22dab0e86fcda65417c37d37f811239126b7d244c2ec6612a6c301
- MD5 cd2243a3626d499c57b85a94ebf927fb
- SHA1 1f93182fb5c17ddf21ba8dc9f3588543e69e393a
- SHA512 b31df17cd466f970571474da241def70ab944aa2644d9e468f366fec97f8d8ae85027831082673c84a54447b9c16e8042c5562eeb6319d6367b77de83a8ba6e7
- SSDEEP 12288:HJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HJsqjnhMgeiCl7G0nehbGZpbD
- TLSH T15FC423BE915C01CBE92644B5C3E5F15DAC173E57F9200483BA9778B9FBF24684B38426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 2063555375f9dea918862fb2b5d849e1ae6836a72b6f0b4c7c61eb78102627f4
- MD5 595b4e66fe658d3e1f5bf39692435a08
- SHA1 ffccb12ce9a9060c35cfc19221aaba96a801c0c8
- SHA512 b01de7dfbf01ff00b09ad7d76ecadd0bbcca7cf1f536ef7be0a6505cf2f6d6e1669a6b26e012df7b77156b764fc005a44a6f4f05ed47a50fe8928d3a32fa1c79
- SSDEEP 12288:2VcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fsqjnhMgeiCl7G0nehbGZpbD
- TLSH T149D4236E535C01C6D87385B4C2E5E11DE8237D56EB3005DBAB532CEE9FB26944F38A22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 7dddd39527e4659c746b587a13bb399fa3e83a8392bd4ff088e195e75ab4054d
- MD5 c0ea6ab9f530c1b21748f21cb97c0d75
- SHA1 d59e51fc97f23a5b1162c7f7d49a0c80f75c06fa
- SHA512 d25fc544d2c4d5633740cc4e377cb666aee9282b6e847732b76453f8c0d0f3af0680c52dcda1f835e02704d8450689e6c4e5d0228b0ea68f1d3958888e4014e7
- SSDEEP 12288:uEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uEsqjnhMgeiCl7G0nehbGZpbD
- TLSH T149C423BE915C01CBE92644B5C3E5F15DAC173E57E9200483BA9B78B9FBF24684B3D422
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 b661ab899c349d1084cabc288c33c57c374f8d767ae1f8783921772944f46673
- MD5 3ec35d10d687240e61dd5a7c0e009434
- SHA1 1ca18a29b83388255757ad1269c698150fb70d40
- SHA512 a871513a3fcff4dfca7f4710eb78a9f343c39e534be75a077a10ac9672f4a1d89d6c9d7c30de3cf2b00445f335435b9c9eafb95f3e8d5527226fee002a55dd5c
- SSDEEP 12288:wvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wvsqjnhMgeiCl7G0nehbGZpbD
- TLSH T124C423BE915C01CBE92644B5C3E5F15DAC173E57E92004837A9B78BAFBF24684B3C426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 db45e28ba75b4d5ffc79dd45051de983e0c08fb623621e4cc50608b64c6b7fbc
- MD5 65a47fc35ce4f2a414494c023cb25662
- SHA1 ae0f655e7bc328ca9efd57dffa16bbd247c81276
- SHA512 283bcc5053e4a24fa70358104fbb9d1cae38c539b018c4325d72026ff3925cc2f27cd440d759fe04dca85376920a322094fad11b7cdc44192c9db6178dbc5ea4
- SSDEEP 12288:oTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oTsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1A7C423BE915C01CBE92644B5C3E5F15DAC173E5BE9200483BA6778F9F7F24684B38426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 82bb37e314fa7f8b12be95c940b05a4b821d2acbe849e05f47ac768c51f04199
- MD5 14c37d394c36b9c2dc246ea9f7efbe70
- SHA1 dffbbaa96dfa47c38528ea77c6ddd7a0dae130de
- SHA512 978fc93af8a8b6cd16b9f0c7d373e31193d31744d2ae4dfb84d4e28d1abab1cc06bc31a11cfd56644534920e42413ed02c15fb594e7bac1cb09c75364abff5d1
- SSDEEP 24576:vZMRzFVSOrsqjnhMgeiCl7G0nehbGZpbD:vZMRzfDDmg27RnWGj
- TLSH T1E50501A9B35418F8EC63813EC965D90AD5B37C1A0B70C61F13A5366A5F733A00D3EB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 b633083cec6a19dda03b06096c8d707504ca076d8ef2be35485df74ec59697f4
- MD5 e1285ee0c7141bc49acc94a49cccf1d4
- SHA1 4a3c56d6208666fb395d8818529441a26bf237d8
- SHA512 ddb233fb1203ca5bfe5eb47aba8296671db8286171de45c82bb37e6be44ce4c2f8451f60bda4131d6d64549c9254d4f73ced8793f13bb7237eaa76217cd8e0e5
- SSDEEP 12288:LiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LisqjnhMgeiCl7G0nehbGZpbD
- TLSH T165C423BE915C01CAE92604B5C3E5F15DAC173E5BF9200483BA9B78BDF7F24684B39426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 09b2ed444059e2d0580de60fbf34ef9e05fc6454062ea34698df0a56bb13bffe
- MD5 6e40ca06cb5fea4ee35184fbe4cdf45b
- SHA1 3cb6967a56e61e6a423d50252376d734b299646c
- SHA512 b8bfb01f9acd08a158c49b2996cbdc40b0da350780b2c87e650e98f0db73d79ed36fb3b1ba6f719d9a4deaf3fbd721e143739f8a06e2c7891435a990e155ac24
- SSDEEP 12288:9uXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9usqjnhMgeiCl7G0nehbGZpbD
- TLSH T1D3C423BE915C01CBE92644B5C3E5F15DAC173E5BF9200483BA5B78B9F7F24684B38426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 c06d03026b6381e482bcb6b61fee73e87fd4ce212db4c3a9b942ee5803a66d68
- MD5 b251d88a9eb7f530b208fdcb4dd7c7f0
- SHA1 c9e8783fb88f7ee81055876bfc237c002e71d2c1
- SHA512 e16c28539f1dd2509edabb8da55490dfe39f633b3de0f84674817685a95ea1fa3607d040819c3fb23cc39c4eb1e2ec49d59b597e2e2913850259a16906898ba5
- SSDEEP 12288:syPz5L8nXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1zynsqjnhMgeiCl7G0nehbGZpbD
- TLSH T111F4025B73A530F9D1378178C5A29A06F7337C3247204A9F17A506BA6F736908E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 02975b36d340f63fca784315ffa7214ca799ded1ca7bcfffb2bb4b6caef766a7
- MD5 8df99659670a88706d77e02815986a0d
- SHA1 658cf7905058a4248801af73e80c6decf50ffae4
- SHA512 99718c3d322b0411a8f55cf2deb913f7df9cfce8cd5aa88073ced522e0f036d285e06eeeb08cb09a3e99ee5625b3490585b22bae7b795ca3a71d63f4e1865832
- SSDEEP 12288:biXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bisqjnhMgeiCl7G0nehbGZpbD
- TLSH T17EC423BE915C01CAE92604B5C3E5F15DAC173E57E9200483BA9B78BDFBF24684B3D426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 2301614355d575a0d8b7c2910d1b65c712512e5b828d83e7b108fa04019b113a
- MD5 859fe02dc86277e6bb58112c90d3ac44
- SHA1 f6a3859d0a29b1e4c2804b766a80f9b6c3bea188
- SHA512 911c267a34628f846a2893fa225ad784e88e59db0b947de1efb8eb5295f23851a6c894d6ef80bdb4f10eb28e7401d01a8b814c1c6c8e22d9ea96fbe20132ec75
- SSDEEP 12288:OiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OisqjnhMgeiCl7G0nehbGZpbD
- TLSH T1EFC423BE915C01CAE92604B5C3E5F15DAC173E57E9200483BA9778BDFBF24684B38426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 717KB
- SHA256 ff76c0766c2b70025b345c7671760fd49a2b06754a8916ad29641dd182fe2b49
- MD5 cb11c5dae7908284dbec4c04b6824086
- SHA1 cbbbd7c20405802269655356ebb057caca139ce6
- SHA512 d140d01b821cf77c52d8dfa64fbed69ea7268ffa286105bfaadc65d4a58967aefde739862547667d55675adcf8cf3902129edf63c35472f1f56b8d80c013cc31
- SSDEEP 12288:oyPz5L8nXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pzynsqjnhMgeiCl7G0nehbGZpbD
- TLSH T147F4025B73A530F9D1378178C5A29A06F7337C3247204A9F17A516BA6F736908E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 841KB
- SHA256 2ccfcf4b58d6cb233e1be7ed8f4208e998f149632c1d33837b8d36c60b8c49f9
- MD5 dc7dd2c778c0abdc774d1bde38404e94
- SHA1 b6680fcc784d1ab365381a821f643f8578d9e1d5
- SHA512 294b3244de438232e10cb48cff29fc518f14def79d3b68f423284e5a1b048b0846cb5d988dcf4c075b814eaaf9e1c782f2535771df10096b3807fbe184f99d24
- SSDEEP 24576:QTDaLl3z0zDZsqjnhMgeiCl7G0nehbGZpbD:QTuLlj8Dmg27RnWGj
- TLSH T1FC0501A9B35018F8EC67813EC965D90AD5B37C5A0B70CA1F13A4366A5F733A00D3DB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1020KB
- SHA256 ddaea57cf838da1f048db01aede89f6ad65dd03a86d7a5bd2ac4bd821fa80d26
- MD5 ae6f9fbea6386aecf05ab75e555ac08a
- SHA1 2016309537b3adf6ce1e303d81315aaa5f24bb50
- SHA512 c9e6dfbf5dfbbff824efbcacb338d2a521b0d770523015ac6845a95c45098a05b3224eec98c68b20859a8da97f3c9e33f08e6f6183bef61201a7d0b06b17883d
- SSDEEP 24576:j3vd9CHKy7GZNsqjnhMgeiCl7G0nehbGZpbD:Dvd9CHKyaDDmg27RnWGj
- TLSH T1A525CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 581KB
- SHA256 34e7c881957643f44626d066a534ff9240e86c40530fcddefa4c95ececf10600
- MD5 d1000f40923a867170d42e2e52497e7d
- SHA1 707f089d75003db0b930b29a2e9864a33b584944
- SHA512 dfc26795a8985ffab0441dd3ae739427d4288232a1f9d32edc4022b969b51aa66a81a7f5afc02d997a20c225235618ada8ecc1227b04ef175c9bca8ff227820d
- SSDEEP 12288:zpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zpsqjnhMgeiCl7G0nehbGZpbD
- TLSH T17FC423BE915C01CBE92604B5C3E5F15DAC173E57F9200483BA9B78B9FBF24684B39426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 581KB
- SHA256 7edb32767455c17bd7fab10c5edec5ceaafd48469e046e68090f9bf9df68ca16
- MD5 29bdc9eb14bd2268a552018f134a4d4f
- SHA1 6d397835c3dacd53ba6fedb7bf1d4cd0ba999846
- SHA512 264678a16527f244a59dff5ada07dbaa583491040e440adfd8f381103cbcbc92af8f5fe25c9169c1b30ee77d64f611003faf245b1f22bf81fc46bb63f0fb93e1
- SSDEEP 12288:4HXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4HsqjnhMgeiCl7G0nehbGZpbD
- TLSH T10EC423BE915C01CBE92644F5C3E5F11DAC173E57E9200483BA9778BAEBF24684B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 581KB
- SHA256 fa95e21773cb5238c484199242a064ea77a969a9198eb0eb85086d0d77c0445b
- MD5 9f7648bc90a9fb3366301063e48bf0ff
- SHA1 3a3dbef7f051a40d319887f08421c31618f1d39f
- SHA512 08253981fbe45a472dde1bb3c661ee8123809b6ea55c2f513e8120a0c6bc666b1d4d560baf18b3ff4ae9fcb9e13980bea84eea0f695ab97e6076a99f1ef16f31
- SSDEEP 12288:NoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NosqjnhMgeiCl7G0nehbGZpbD
- TLSH T12BC423BE915C01CAE92644B5C3E5F15DAC173E5BE9200483BA9778BDFBF24684B3C426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 581KB
- SHA256 83d93dbd877398eaf5b4a1a30b3f9d60ed22e998a7735f04d32938528847cf81
- MD5 5b75afaa7edb299cff2e1f8cb1d9cc22
- SHA1 4a53a747e8508c916d41b2c85c2b7f2c20056a4d
- SHA512 4d7d5516dc3b4853a2a1226838ab7fa70fc80bf3d2b27d56282f94641be5ef0970be765f75635ec02340ff44353e1664f2eba275228454a2f4c20a363f649994
- SSDEEP 12288:biXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bisqjnhMgeiCl7G0nehbGZpbD
- TLSH T14DC423BE915C01CAE92604B5C3E5F15DAC173E57E9200483BA9B78BDFBF24684B3D426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 581KB
- SHA256 181d4ef131bdee23446a1555927d9f2fdb57344a75f3ca1b425a87e7e5b15edd
- MD5 9a6efa361061456c9b766ced210f4b40
- SHA1 6f739bd8443b6deff69466728ab8ffc69b765374
- SHA512 4b465aba6582ee83cd9ba13ba6866de3207fc2473ccbc352894bc1714d10f4a0a262e05166de2fd3e9c3542990e6f5d6b4cb4034ac4f4909cd9ec842368f5c65
- SSDEEP 12288:epXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:epsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1A1C423BE915C01CBE92604B5C3E5F15DAC173E57E9200483BA9B78BDFBF24684B39426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 581KB
- SHA256 3d995a166a4d1b63f814442f8350d7b7a2e18c4fc2d4590fd55145fb80777f5e
- MD5 1485a77c67b3f9d84ebf002feb173088
- SHA1 8f72ac834d48d527f5664f9f9dadb10fff58a9a4
- SHA512 f97b73ebaf52475bfffa07d0a995a257e54dd9da5ea771c3dace47d682a2a6c53203017516000931bfeb1ca69af93b5561c05a1061f5543283949545b36d6a62
- SSDEEP 12288:aqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aqsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1E7C423BE915C01CAE92644F5C3E5F11DAC173E57E9200483BA9778BEFBF24684B39426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.0MB
- SHA256 5cfd91354afed78deacd189f695ceccbde22f92d3a34ede36a84eae06788bfb8
- MD5 eb1fa59d7623a3c80f64d59787a8c46f
- SHA1 8a0aaa7c7fb3098d94d856e120b19bafe20c561d
- SHA512 77e281068741b508b175de08619ed5e27627b4da2b61fada9008cfd95bf295cd33450af427d8be925efc1c35f950a13f8522152b1ddd5659f567c7a43427a830
- SSDEEP 24576:GfwvUk9RX6wkyAIesqjnhMgeiCl7G0nehbGZpbD:uMnYIyDmg27RnWGj
- TLSH T17D35D029EBDC04E5E177913C89B7860AF6B278591B31C6CF129A53AD0E33ED45E39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 3c3b32e71a979d46eff8ef5e26c0042a013de35e4b1da39687f2c3a483e0d962
- MD5 9b09a7426d269cdcff16cc9057bbc301
- SHA1 eaa7213ce900f41b3e0504418a0ab6bd5919ef1f
- SHA512 62b172e48ab78ded0b5483b71017206ec5b4128938dda628a634fb7e1e0da5454c6376211b21fc1dd5302504df6702a3ab9eecc4a5d13767aa30fbf59fe66ca5
- SSDEEP 49152:NYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0JDmg27RnWGj:AySzPxD527BWG
- TLSH T188066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 52684935a16016850a43de494c4f938109653e5cb5feadda37a7ad7f0cecffe1
- MD5 3fcfbc63d23268c58d29cde83be4a84e
- SHA1 fc7265c77e8a13f3bc70c98949e34a0d62694a17
- SHA512 aa70dd96d08556cceda5a552db9bd3873f1d3e0d475b2b51a821cf2ba0a448d1270bc067f7202936041ef59c57e92c8145c028b8ec00b729c91018f28b1a4daa
- SSDEEP 24576:a47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYbsqjnhMgeiCl7G0nehbGZpbD:a47JUQjTirIhCnDHUPfF/5Dmg27RnWGj
- TLSH T11665AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270437D6F63ED44F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 2e539c4b60d43a97d2bf63f51f13a8849f393021fbeb66d529bf15c23c1ffd4f
- MD5 ff3720d3a601665596dd4136ba99803c
- SHA1 a3bb2879f685c64b8c62468338ce7330cf6b7b25
- SHA512 178c21814748a2eaab7e045ab6604c6964168d8fde4ee1752c8038614b6b441edd806054a11721e56069aac13f29426b4699287ed820087a75be2d85eb08307c
- SSDEEP 12288:DbsfyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WysqjnhMgeiCl7G0nehbGZpbD
- TLSH T1BCE4015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\CacheMgr.exe
- Size 1.3MB
- SHA256 551b0dcb594dbd9642869fedbcca227b9cd6e3996467b21d1c83d3de1dae5a79
- MD5 b8256fd225fbb4b4685dded72704b6c7
- SHA1 a7e974b38bc06a29770993255b11ed579e624672
- SHA512 ef00803c5a524c36f519d5a043fa8dab00dd9e3a3bd7a0d736526e166f0be9fbaae0309a262dd3206116f714599da107f8702a1706a5db5c00bd4033ab8facd4
- SSDEEP 24576:vJksqjnhMgeiCl7G0nehbGZpbDHSbpa0sqjnhMgeiCl7G0nehbGZpbD:vJADmg27RnWGjfKBDmg27RnWGj
- TLSH T18655237A650870A7CC3248B5C2D5E16D680F7D6399205843BA5738FFBFF60A48A394A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\4ec75b4f957eebe4.bin
- Size 12KB
- SHA256 cb04aa3c950ba6115bbfcf62a92f591f8cf1f97d2a886f6682e844e4ecb86fad
- MD5 dc9838401d25244febd5637f60d2dc13
- SHA1 1a996edbf2b01d02f1a7b53d18d280b2125b580c
- SHA512 235923e970ddccdb19bd5af8ae507fa1c62d0932613677ba08f0a89033ccb52dcec53b7dd1942c1aed190da5f0c3af89f1ab575e09bd54e9f2a01cc88fd0ea61
- SSDEEP 192:DE+r+sFuOAhu6wU4umUqVm99Y/FzTh1Uc6EWTrn8NZ6ttPTDIeZySmLAugrZe/aq:bC+uBzBmPg9qCcmz8ATPa85rs/t6zc
- TLSH T1BB42D0C6F8C5268F000E2494C7097456C6A6E06B7C96D8A976F0CE1DE5C6DF63A32161
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 c68960b2760d3a2f0efcb861fa497c05d213d6eaddc4dd8a874e13fc3b24c6f4
- MD5 e105b9b39d34d6d24535238da01d3b8d
- SHA1 f3843fe5ac0ce717145c1b94d75368c51269fab6
- SHA512 a07aa682ea261dd21601b50f0ab32f85340484ef4624799d5ef90e204572381a33e46438c64c50ddc99c47c954f2c34bd7099bee5bdccccac0bca861e105bc70
- SSDEEP 12288:+076Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:H6sqjnhMgeiCl7G0nehbGZpbD
- TLSH T184D423BA934C118AF83605B482EAE12D780B3E669F1044C3BA5778FDF6B18D48F39517
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 f1ace62e696bebb32aa3298086b32f1b0a1e64d4e8ecafd5fe2fa4e07eec1a1c
- MD5 cfa8d23e08fca39ab9188132ef618879
- SHA1 48fcc1bd4a6cecbdc49af00c0af6924b896b7840
- SHA512 dc840acccf30b9e22e844caf73e5d2e095c71f392b8d91ca8c113b1ef7ee70133cdbbcf87df348c6e9d57ea40812391c489227dd748fc043e3ce967830fec711
- SSDEEP 24576:Jgb6bmBIi49WNNFpg1rSvFv7bYAsqjnhMgeiCl7G0nehbGZpbD:Jgb4mBIBhGFPDmg27RnWGj
- TLSH T159659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 dd2ca890c0e6812cc52076637a2cb3af2f22816e49c9de237a6a92fc16d4cfea
- MD5 2a23ea45d16302be5ff2321c272e3439
- SHA1 d86f21940f35743192bdede20c43639b7d6e6a7b
- SHA512 56b1f5687412a8c98377044c66bdffae2b2cfc01cd6d2ca1b7d35d12e8bfbf01e59bdfb4105226c1a67c08b220dd89cf0caf30c0cc2cbaffa35889be61231b12
- SSDEEP 24576:mG88u8FpJqH1bzria7/mrsqjnhMgeiCl7G0nehbGZpbD:t7ZFPqVea7/0Dmg27RnWGj
- TLSH T1F735016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 a634bcfbdd14d3357e19bef78212f3e302e079ee496da5f224db59e59eb78e1d
- MD5 152835cd55296f66eb881347ff55ee1e
- SHA1 e57c40ea9c0beb8e9d0fd43bf892dc12ee6ef206
- SHA512 7e2ce2399bd734ec2b0da9592fec93d0006dfbda1b8e3fd21d932f5c07eff398678e18eaf282a17eb2134f69713c8743682e2186ae223d8106e1c6b8bc0505f2
- SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjTDmg27RnWGj:nG05lO43bKD527BWG
- TLSH T14DD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 c6c2071b058a27645f4b69403238fa0e1e4708280a310ec56977c570d6d1a8d2
- MD5 3a3d9b3d1d177b770be89c1ae62dd34e
- SHA1 bd6de73fd99d7b69334dc58379502efd4a548db8
- SHA512 a93875704794d8d854c855a7202158a54d12f9e696e46ae1269d5e904ecd6d2b4b5efe76a7160347d1fae1db9afe5af8733c5748d63a70c17c7303150a7ce682
- SSDEEP 24576:Hfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnVsqjnhMgeiCl7G0nehbGZpbD:/a5POZ3BJt2pasx2+mbDmg27RnWGj
- TLSH T18F65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 31b99ff99bb175784143a67b126fb6e6d5a26f24bc590ae44ea59293bb9e4852
- MD5 1cb4a46b91aff4cf5e7547e97d89e7f9
- SHA1 9471a7b3e81c789e9f4de52dd97ea7b00dd06ff8
- SHA512 f2cd59b02a9d24aecd5448262775dfe6b892cc006f42c637ed2e753db66024285d04350b287f77f8f3e79705e1162188e732bf5aab57843f741fe1e782cf0119
- SSDEEP 24576:BNcwHdjbyQ4nLC18lb/EOjowL7FkjsqjnhMgeiCl7G0nehbGZpbD:BNc/zEOVHFUDmg27RnWGj
- TLSH T191857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 8f5b4714a5ef61dc7cb53ea2390467c325a2f48f41461bb69d2caac6b8c7bd8a
- MD5 d31921b6f2ba2886aecef1e585efe459
- SHA1 65f594bbdb4348d6594f0a2b56c2541f659d1c71
- SHA512 62de31530e8986e087a01551bfb7ed9231ade2bea1d556e9ead64b7b02a79cea4bd1bc98c36dcb2dd196c2812bd9e6b14af272bcbf745d5b055e89e6aeda6efb
- SSDEEP 24576:OTkNvNnaFeYhJNtmZBmhsqjnhMgeiCl7G0nehbGZpbD:OTMwBtOm1Dmg27RnWGj
- TLSH T17B55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F4E679D89E39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 804KB
- SHA256 44a87f186b1baf7adf7a6736636fee3cea3087d4224e626ebf38a801282236a2
- MD5 2bac55f80a62a52c5a47798283588c7b
- SHA1 c9a0b2ee78ac77b02e5114868985c63f9e58b460
- SHA512 ce0a82f4c50ced461684565980e680379ba1212d40c62508b5a6b2ad76f2322843d5ddd154c77363be0eea8500dc10ea83c91710946eb05229ff7001b5b0ac98
- SSDEEP 12288:HHvUrBFrEjwaQfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:HPUr+NQfsqjnhMgeiCl7G0nehbGZpbD
- TLSH T14F05F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 964KB
- SHA256 ba509136ea0c3dc4104544f0d510631ff8dfcdfe5fe189ad79b2c312d8c6a542
- MD5 25d4ed2ed22f852bbb3d41dbc5dc06ee
- SHA1 84a483c18e524e2dd24c01fe59b226ca642b6b8f
- SHA512 756e1f49586752cc85ef195c462964b7464e86af05e0021a34ededf33440faf74b4811e4f6fbca2a56ba42126ca483c9594d6e95256bfe2e4819bb7331d4db77
- SSDEEP 24576:5D3FHshBIYQgA2sqjnhMgeiCl7G0nehbGZpbD:5DVHeBIAA6Dmg27RnWGj
- TLSH T14325E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ajwq.exe
- Size 97KB
- SHA256 c9304bdeb206ac0ba59fdd0920a99b0e4b407f41629e1df1984005c1077befa1
- MD5 9091841826ecfdbcb8ad074ffdba43de
- SHA1 5ce3573e608c0a5e9b813a8abad44173f5788fee
- SHA512 c80e68609077cabc9938b3b524a4206d8f97827c9b0cb7f1eb87e5c5a71dc81457181889ad7ab48d9a1af7a93ff5319dbbf38e4a139668c04f865102ad850cb4
- SSDEEP 1536:axtKy3bBF3hJ3fW62PO4UKn6MWptJGB62C7Nj+fPVVF34w5nzo:By3lFx992SuSIC7dsF34w5nc
- TLSH T189A31232611EF774D060FABA80649DBA0AB536C7B870900D8676F341ED3F55B192F8E6
- MD5 SHA1 SHA512 SSDEEP TLSH