Analysis
- max time kernel
26s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 02:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
28 signatures
150 seconds
General
- Target 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 1.3MB
- Sample260731-dadjgshr7s
- SHA256 c0415606486d729f69bb47c53907c79bba089ceb6f90524ed7fb0b336117377e
- MD5 939e9d6cbef190218081e160f359f5d8
- SHA1 e1986c3936ba3d82201c60088c832e8710d96ec3
- SHA512 8b43a98403e492d7e658bda5d8d8bec5c22c949309faec8958c98ff5c892d27b9b3d113092ca50de2a4deb9d6023dfe1dc5750ff6a8e77c8c4434f25e66c08a9
- SSDEEP 24576:FUksqjnhMgeiCl7G0nehbGZpbD5vgIsqjnhMgeiCl7G0nehbGZpbD:FUADmg27RnWGja0Dmg27RnWGj
- TLSH T1695523B9750860ABCC324875C3D5E16DA80F7D62992058437A5778FEFFB64A48B3D0A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe - UAC bypass 3 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" CacheMgr.exe - Windows security bypass 2 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" CacheMgr.exe - Detects Reflective DLL injection artifacts 3 IoCs
resource yara_rule behavioral2/memory/6332-28-0x0000000004370000-0x0000000004386000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral2/memory/6332-254-0x0000000004370000-0x0000000004386000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral2/memory/5868-393-0x0000000003330000-0x0000000003346000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 29 IoCs
resource yara_rule behavioral2/memory/6332-24-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/6332-21-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/6332-23-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/6332-25-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/6332-26-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/6332-29-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/6332-47-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/6332-48-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/6332-43-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/6332-143-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/6332-144-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/6332-208-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/6332-215-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/6332-74-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/6332-31-0x0000000002E70000-0x0000000003F2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5868-415-0x00000000045B0000-0x000000000566A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5868-416-0x00000000045B0000-0x000000000566A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5868-417-0x00000000045B0000-0x000000000566A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5868-418-0x00000000045B0000-0x000000000566A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5868-413-0x00000000045B0000-0x000000000566A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5868-421-0x00000000045B0000-0x000000000566A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5868-424-0x00000000045B0000-0x000000000566A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5868-425-0x00000000045B0000-0x000000000566A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5868-426-0x00000000045B0000-0x000000000566A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5868-427-0x00000000045B0000-0x000000000566A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5868-433-0x00000000045B0000-0x000000000566A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5868-432-0x00000000045B0000-0x000000000566A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5868-434-0x00000000045B0000-0x000000000566A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5868-435-0x00000000045B0000-0x000000000566A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 31 IoCs
resource yara_rule behavioral2/memory/6332-24-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/6332-21-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/6332-23-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/6332-25-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/6332-26-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/6332-29-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/6332-47-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/6332-48-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/6332-43-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/6332-143-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/6332-144-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/6332-208-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/6332-215-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/6332-252-0x0000000000400000-0x000000000054E000-memory.dmp UPX behavioral2/memory/6332-74-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/6332-31-0x0000000002E70000-0x0000000003F2A000-memory.dmp UPX behavioral2/memory/5868-415-0x00000000045B0000-0x000000000566A000-memory.dmp UPX behavioral2/memory/5868-416-0x00000000045B0000-0x000000000566A000-memory.dmp UPX behavioral2/memory/5868-417-0x00000000045B0000-0x000000000566A000-memory.dmp UPX behavioral2/memory/5868-418-0x00000000045B0000-0x000000000566A000-memory.dmp UPX behavioral2/memory/5868-413-0x00000000045B0000-0x000000000566A000-memory.dmp UPX behavioral2/memory/5868-421-0x00000000045B0000-0x000000000566A000-memory.dmp UPX behavioral2/memory/5868-424-0x00000000045B0000-0x000000000566A000-memory.dmp UPX behavioral2/memory/5868-425-0x00000000045B0000-0x000000000566A000-memory.dmp UPX behavioral2/memory/5868-426-0x00000000045B0000-0x000000000566A000-memory.dmp UPX behavioral2/memory/5868-427-0x00000000045B0000-0x000000000566A000-memory.dmp UPX behavioral2/memory/5868-433-0x00000000045B0000-0x000000000566A000-memory.dmp UPX behavioral2/memory/5868-432-0x00000000045B0000-0x000000000566A000-memory.dmp UPX behavioral2/memory/5868-434-0x00000000045B0000-0x000000000566A000-memory.dmp UPX behavioral2/memory/5868-435-0x00000000045B0000-0x000000000566A000-memory.dmp UPX behavioral2/memory/5868-509-0x0000000000400000-0x000000000054E000-memory.dmp UPX - Executes dropped EXE 12 IoCs
pid Process 7056 elevation_service.exe 7144 elevation_service.exe 6216 maintenanceservice.exe 1236 OSE.EXE 6580 PerceptionSimulationService.exe 1732 perfhost.exe 1324 ReFsDedupSvc.exe 1880 SensorDataService.exe 1684 ssh-agent.exe 3184 AgentService.exe 980 SearchIndexer.exe 5868 CacheMgr.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 14 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" CacheMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" CacheMgr.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\StubPath = "\"C:\\ProgramData\\CacheMgr.exe\" -as" 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" CacheMgr.exe - Enumerates connected drives 3 TTPs 52 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\D: CacheMgr.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\G: CacheMgr.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\H: CacheMgr.exe File opened (read-only) \??\I: CacheMgr.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe - Drops file in System32 directory 39 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\4130eda0957eebe4.bin elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe -
resource yara_rule behavioral2/memory/6332-24-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/6332-21-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/6332-23-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/6332-25-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/6332-26-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/6332-29-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/6332-47-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/6332-48-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/6332-43-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/6332-143-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/6332-144-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/6332-208-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/6332-215-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/6332-74-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/6332-31-0x0000000002E70000-0x0000000003F2A000-memory.dmp upx behavioral2/memory/5868-415-0x00000000045B0000-0x000000000566A000-memory.dmp upx behavioral2/memory/5868-416-0x00000000045B0000-0x000000000566A000-memory.dmp upx behavioral2/memory/5868-417-0x00000000045B0000-0x000000000566A000-memory.dmp upx behavioral2/memory/5868-418-0x00000000045B0000-0x000000000566A000-memory.dmp upx behavioral2/memory/5868-413-0x00000000045B0000-0x000000000566A000-memory.dmp upx behavioral2/memory/5868-421-0x00000000045B0000-0x000000000566A000-memory.dmp upx behavioral2/memory/5868-424-0x00000000045B0000-0x000000000566A000-memory.dmp upx behavioral2/memory/5868-425-0x00000000045B0000-0x000000000566A000-memory.dmp upx behavioral2/memory/5868-426-0x00000000045B0000-0x000000000566A000-memory.dmp upx behavioral2/memory/5868-427-0x00000000045B0000-0x000000000566A000-memory.dmp upx behavioral2/memory/5868-433-0x00000000045B0000-0x000000000566A000-memory.dmp upx behavioral2/memory/5868-432-0x00000000045B0000-0x000000000566A000-memory.dmp upx behavioral2/memory/5868-434-0x00000000045B0000-0x000000000566A000-memory.dmp upx behavioral2/memory/5868-435-0x00000000045B0000-0x000000000566A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe elevation_service.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File created C:\Windows\e59714e CacheMgr.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\e592fd0 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4708 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CacheMgr.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb0c190e9720dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000826a2f0d9720dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004193180d9720dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000099f2c50d9720dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d4b3a0d9720dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000977b3d0d9720dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031b3df0d9720dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 5868 CacheMgr.exe 5868 CacheMgr.exe 7056 elevation_service.exe 7056 elevation_service.exe 7056 elevation_service.exe 7056 elevation_service.exe 7056 elevation_service.exe 7056 elevation_service.exe 7056 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe - Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 6332 wrote to memory of 4708 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 90 PID 6332 wrote to memory of 1156 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 15 PID 6332 wrote to memory of 3048 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 44 PID 6332 wrote to memory of 3080 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 46 PID 6332 wrote to memory of 3456 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 50 PID 6332 wrote to memory of 3224 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 57 PID 6332 wrote to memory of 4336 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 59 PID 6332 wrote to memory of 4400 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 60 PID 6332 wrote to memory of 4412 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 61 PID 6332 wrote to memory of 4724 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 63 PID 6332 wrote to memory of 4992 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 64 PID 6332 wrote to memory of 5044 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 65 PID 6332 wrote to memory of 5180 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 66 PID 6332 wrote to memory of 5220 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 67 PID 6332 wrote to memory of 6916 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 81 PID 6332 wrote to memory of 4128 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 82 PID 6332 wrote to memory of 576 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 83 PID 6332 wrote to memory of 792 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 84 PID 6332 wrote to memory of 4708 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 90 PID 6332 wrote to memory of 4708 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 90 PID 6332 wrote to memory of 5868 6332 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 103 PID 980 wrote to memory of 1948 980 SearchIndexer.exe 104 PID 980 wrote to memory of 1472 980 SearchIndexer.exe 105 PID 5868 wrote to memory of 1156 5868 CacheMgr.exe 15 PID 5868 wrote to memory of 3048 5868 CacheMgr.exe 44 PID 5868 wrote to memory of 3080 5868 CacheMgr.exe 46 PID 5868 wrote to memory of 3456 5868 CacheMgr.exe 50 PID 5868 wrote to memory of 3224 5868 CacheMgr.exe 57 PID 5868 wrote to memory of 4336 5868 CacheMgr.exe 59 PID 5868 wrote to memory of 4400 5868 CacheMgr.exe 60 PID 5868 wrote to memory of 4412 5868 CacheMgr.exe 61 PID 5868 wrote to memory of 4724 5868 CacheMgr.exe 63 PID 5868 wrote to memory of 4992 5868 CacheMgr.exe 64 PID 5868 wrote to memory of 5044 5868 CacheMgr.exe 65 PID 5868 wrote to memory of 5180 5868 CacheMgr.exe 66 PID 5868 wrote to memory of 5220 5868 CacheMgr.exe 67 PID 5868 wrote to memory of 6916 5868 CacheMgr.exe 81 PID 5868 wrote to memory of 4128 5868 CacheMgr.exe 82 PID 5868 wrote to memory of 576 5868 CacheMgr.exe 83 PID 5868 wrote to memory of 792 5868 CacheMgr.exe 84 PID 5868 wrote to memory of 1472 5868 CacheMgr.exe 105 PID 980 wrote to memory of 3008 980 SearchIndexer.exe 106 PID 980 wrote to memory of 4852 980 SearchIndexer.exe 107 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" CacheMgr.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1156
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3048
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵PID:3080
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵PID:3456
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3224
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4336
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4400
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:4412
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4724
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000268;000000000000026C;1⤵PID:4992
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:5044
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵PID:5180
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵PID:5220
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:6916
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:6332 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe" "C:\ProgramData\CacheMgr.exe"4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4708
-
-
C:\ProgramData\CacheMgr.exe"C:\ProgramData\CacheMgr.exe" -as4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5868
-
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:576
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:792
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:7056
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:7144
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:6216
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1236
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:6580
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:1732
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1324
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1880
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1684
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
PID:3184
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1948
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:1472
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2876 2748 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:3008
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2892 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:4852
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵PID:5956
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2876 2748 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:5124
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2892 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:6548
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 fdaadd721773ef95564424dd4e4a1685f4ae5d98d1aae17d1b2c8e5646401605
- MD5 142f1d0b1fd7210464934c08e9b830be
- SHA1 235b2e829184c9dea9ce572f467e899612c85503
- SHA512 500ecd7aa28badbdbfd8d4d1601c4a6082c2d1b29d0dcb6194208fd4d288099fafb4bc807167625bac17ed1ef2f60cf3915c223955d1fc9eae935268a4ddc360
- SSDEEP 49152:eb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnCDmg27RnWGj:g3q6sjBhD527BWG
- TLSH T1CDD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 2037777c75addc62179bc4ce71608217fc197ddfc60eef16e204701556886cc5
- MD5 b7cd737c2371104c9c69124bfabadce4
- SHA1 8f37af62b0c859b6b6367be61fc40733ac8de451
- SHA512 e0b56b8d3bba1294d49a6d5033e0ae12db81ce6670ace2f5504320717839358bfad9d8458ac4c5df9d1dfa8a1874412971c63c0dc908808cf8883af661b5e216
- SSDEEP 24576:sXYfDtczApsqjnhMgeiCl7G0nehbGZpbD:LtcUDmg27RnWGj
- TLSH T152050129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 63728f3b07aede08a64452cc5cde41631d388a474774bf0f579f1dc33ba2c89d
- MD5 be2069e1fd2cbe5f9bcc917c11137ce9
- SHA1 19b3591ba27a124d9f0b17767cbfe8584582e8b4
- SHA512 7cb4b14db87193dc3957016945ac4a4d34ee44e8576505caaa7c16bdf41259417ce2fc78bd5461ba4ef1bda91c6def3beec9a1cd067e609fefaa35830fb931fd
- SSDEEP 24576:w0Le5ji0hmxxrMWsqjnhMgeiCl7G0nehbGZpbD:wPji0AjbDmg27RnWGj
- TLSH T1CA359E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 361755693a299d42e807ef3f083358c95d4648efe02eeb7c06eef92ecf32e2c7
- MD5 c0a53e93e93b5c40f4b57e311fd65401
- SHA1 99b3ec5c93fc816f0d22658f65a09615632407af
- SHA512 9fa6f2222cc3bb4e1b29569cb4f95297ce16375d2847edf385d198366d094e1318475ff65889523db2309edf8e169276f8ad75c433f3eb152cf1ed4f95c6c406
- SSDEEP 24576:ha7/ezSC6vUyD/aqgrvWn6q8wyu4sqjnhMgeiCl7G0nehbGZpbD:g/ezSC6vUzPveHjyXDmg27RnWGj
- TLSH T1D9755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 435c2b424031f0a4acd03a597446f2abf10c3626e1733aa71278d0604f6adbcb
- MD5 69e05b345342d73a172621ed9ed274d4
- SHA1 84d40d8f606d7d084666d4f29fb3048ffe5e43d1
- SHA512 c155e42cfa4a4545e986e28d6533c7e7f554bc16dc2ebbd719f8824dc7c7f722438c907939e916d15daa0ea0ee5c820e7ddc06314d8863185d482848031ced95
- SSDEEP 24576:kVbqPb88hv/l+YNsqjnhMgeiCl7G0nehbGZpbD:kVO88hXl+sDmg27RnWGj
- TLSH T114559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 4b53bd07c4f9e3949ea09bed8aff4eb7ef1bd155d035b318913f974586f3c7da
- MD5 ede18bad5890b5b535f71155f571bcb2
- SHA1 082b782642a2a4c5f9b848e25a3718ca47439d7b
- SHA512 05134724cbe555d022fdd8a1bc58ee957d7024eff1aafa9c10dff1b885e0f5b44ad986d46f2c6a79f167f9ea1417942312a68ac453ff878450dcffc3516e68a6
- SSDEEP 12288:ELaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ELasqjnhMgeiCl7G0nehbGZpbD
- TLSH T1B1C423BE824C11CAEA7708B5C3E9F51EAC137E5698201C536A637DFDE6B5464CB39023
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 32c70f0813aab7226159fad572c802f1b06f352fd42097aef37d2b3e657450cd
- MD5 5dc4ef37615077b2bcc2640a9d6f5ccd
- SHA1 0240d4bb95b735050eeff902c90b2101f86a4b61
- SHA512 204672bcbaaffe8228a02be719e6bf68d5b91ff74ad0e0d2557d269cd11172a12e9fbd400124e3c49c1192616fa3cc1d661b21d15251cdf086529f8315199c15
- SSDEEP 12288:seBNUbTVO86U1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:sJIU1sqjnhMgeiCl7G0nehbGZpbD
- TLSH T12005CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 f2a703195b591ed053a2ac2b190ddfa43a81fe5eb38b80954dc6e5d628a30e29
- MD5 ff8b1d221bef1c36772e796c25a755eb
- SHA1 ae1fe8a9dd3aed1143dbc95f813ff0349171dade
- SHA512 7ce226badd38c93dfffc37551b54f1dae600ddd93841b47af222efa2ee91eec6489dd11ba10383cb194ee789c6ad980bbd63d072688e8d7dbc8714a01071bdd3
- SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THc:gQvGAdlCEL8c/DRNw5C0D527BWG
- TLSH T1DB266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 37e452ba3bf01ac14031ca311462f851e89c39396f143b0ec3ab3852b551376e
- MD5 47846e4b8f2950cf063ca3c67763157d
- SHA1 ea104aa9279765fc507508067937348cd37bec49
- SHA512 732521225053a99484ad7eeb93adafdc07ecf3650d0a9c779bc11409f358088eeb53227216feef7a63919158778ca7a6ef90dcec6719bb6b052de5cb5baa4ab1
- SSDEEP 12288:/AwSfxL/2Dc3RDLLmt0LDQewsAjXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:I0ewsAjXsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1A615E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 10f19115dc368b293655f5a74b9a0fe3e03115008e64c4efb6c98151ed1ea833
- MD5 5990654ba47bf799adeb805a584cda86
- SHA1 c2f8ae70f81e0a63a5f3476bd4551a7bd29c84d6
- SHA512 e8fe52ef1a8741f733a1c7dffc75e02dd1a78ed42efbda051e68b7cc223b5326f64c04947864db099d89f1145e12214949bb7c94b8a3cc91f87de0264f2abd1e
- SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHTVQBWG:hUEtQevvqc2W1cpV2tI32KB
- TLSH T1E6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 983c3f975959b2640eceef4ff51188ba1c9a3caf2502c57dbdccceafc41b3290
- MD5 b29f66858ece8a1f7c4028fb40286ea7
- SHA1 208533432d69b317d17dc8f7b02919f0ec5b484d
- SHA512 3af149ce4859b20c2760ebf68daab6ba48293a846a106ac9712a34a4720bd44b450ea2228a21a204e8e88ac111612e617376e79c4d5fde7aaceeb58cfcd86b48
- SSDEEP 49152:uCbRquA/m2yL5zTfFiV+XenmE3/zLDmg27RnWGj:DoquVjnmQD527BWG
- TLSH T1A5D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 c2d258b31cbed45ab0516e36bcb68e3bf5fb29150b0e73ccee65a80b1df748f0
- MD5 8ea69addc546468bd6ec4e500963435d
- SHA1 5bd008ebba6ceef7c620af91a9a3c5423866ef94
- SHA512 fe1db8521da63f00e3e6f3b25b55cad32f43a5046e25cc50c9d94c983f04176551445374c06a8f61bb22f95505d26a2b10c57d2ac0ce84f6796254deab821ca0
- SSDEEP 24576:tAhGL3IFoiwtA5l7S53UsqjnhMgeiCl7G0nehbGZpbD:tAMUFoiq5gDmg27RnWGj
- TLSH T1BB359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 23a750678084426e784aee2586d607cfd589465a5f110b00dc087395b4017c3e
- MD5 e496f3e6d656c11083b170f2a2977e5f
- SHA1 0cbc3d2538d95e6758521357ce0a6eb10b248ee7
- SHA512 0cbb15a57f204162369383639c79ff729c565ecd9d0044e0d63a3776130980daa1b5cad6430c8305238be16f83e0494639bbcb10be091066bbc6a9185d4b9a1c
- SSDEEP 12288:9mw5HEjsChNVBFgl0WDm+CYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:4wu4OWzsqjnhMgeiCl7G0nehbGZpbD
- TLSH T18F05F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 2a53313be283204cb09c55e2db78a8c4e89fb76655ba6aecbb83a62982a2b223
- MD5 96e92ede6f51b395eb4c4b41668e199e
- SHA1 82875da551cbef3f06c5837ba961cb94978cd42d
- SHA512 65f82f6a46da44d90012cfd365a0def671c6b0dc406dd3fb41222f6eed26bbd400752b18b7fcdea4af2fd1396c4d9ba2b820cf51ab405eadead2f312725cf66b
- SSDEEP 12288:YeZ1IynXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JZu+sqjnhMgeiCl7G0nehbGZpbD
- TLSH T16EE412AE239820FAE5634178C6E5D609E7333C53673003CF166656AA6F739D44E39732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 432f6a29706ef06dc5fcb122d41eecff8a3d4c0c677010fed46562d67c6afe58
- MD5 e4638f05b62a60b11a42511a04cfb4cd
- SHA1 ffaeac61d76a6a112b94c858a6d677c1a195387d
- SHA512 8b872331b41198d3181b0965db90babce4fd39bb0bad8fe14f2d82e2e0a06bb6864df2a9c453401efa10fee9611865ff0ddc724237db6f2dfe521d30518ee030
- SSDEEP 98304:fQRQyi36YOcPbLvw2gAf+PN3lD527BWG:uQyiKa/X+PNVVQBWG
- TLSH T1A0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 94ae32cf546799d685c000077f3938c6c0ab091714480ab17b02786ced4101f4
- MD5 f7a17a2f179088ff320a9b34adae478b
- SHA1 6927f50d3bc220adaf344b18b5772e090884fdd5
- SHA512 d0160ac679d12bd106b1a86a5b00102e9db7cf49a8a77c0c155610476dfda67dd1e7a6d2ce50b9579e36e426fa6e9bbc2fa0d4c81c994e961d32e9b09aa620b3
- SSDEEP 98304:nQRQyi36YOcPbLvw2gAf+PN3lD527BWG:2QyiKa/X+PNVVQBWG
- TLSH T153667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 0091bc7e1ce54b68321af721041d23eaa1c6752e1249165114886a87ee111327
- MD5 2218316cff06c601a0a7473e56f12a03
- SHA1 0530feee88d60911cd73038126f9c241d5d3f33f
- SHA512 517af3f2ecaf218edf495000f6d536c1489e5fd43a0705ff8ae9d24a793a06dc76f2ce6cb08df099cf4391d62ace6489b6c65657e459dec6e5ac4d9aba4bac72
- SSDEEP 24576:RwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0usqjnhMgeiCl7Ge:968Qg55nhceWu7PNU3/bDmg27RnWGj
- TLSH T1F6B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 71a2406d880c44ced88bdc35cc68afac1f19df164ca0f496cf3184432294bc05
- MD5 c65d3d1501948219c1e5a9460876bfed
- SHA1 ecbfc26bb18c201108dc6032801e3c2bdb6a1a2d
- SHA512 bc3700784d2c6b1ad4b27e2f154060285d886e04b47822b0e0f266dcabe023c9a3127a8f404001403eef5d9f261aca01b0d58ea5f6aa478e6e6905c46b8a0134
- SSDEEP 98304:qy5112gYy5azzVvt69nLKnhZuD527BWG:TLIHEWhYVQBWG
- TLSH T13A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 6d61c64d698bea8a339769cec3b12e0d44379a2467c74e4949cafebcd0eea819
- MD5 587382862a14eae87743ac9f981c0d4b
- SHA1 0209719aa1ce0ab689db154454758b1c660b23c5
- SHA512 7742318d75b0bd472b3f5a9546684a8d699aa82432f1e0ccba5360d1d7f89ac0af6bc3e4a53c7394c26eac61897707f6337aac989ad7a560e2c89a90c662d22c
- SSDEEP 49152:/B+taZ3usBWOBr4tEGL0bqx0z+n217aau1gldDmg27RnWGj:Bu6Jmdxd2ddD527BWG
- TLSH T114D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 3af96466e0b3e31e9e677be50ccc6d1564efca298772033203a39955f3319334
- MD5 e8eca3ee1b1dd7f3f92859f6eedfeff8
- SHA1 a9a5fcd36c5ea0c748858b3264530467b75f9b5f
- SHA512 da3320cb5ac02973491985ae82a357916e52392e5bf846672b2cc7bb2159f2719228fba7eb1094c38de4ea22ffbd84b4dee9b29f95398493119f6357df7dc8cc
- SSDEEP 49152:y1hpsNoJpF1A63U44CwH7R4xJDmg27RnWGj:ymifPWRQD527BWG
- TLSH T153B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 8ca1ddce9fac5d60768ccb59437bdf59f24b15352e976557f7bb1e50c949fbe3
- MD5 67227a7e305e5cd97ccc95d44f76b02c
- SHA1 2d8c8820dc2dab5d6e52c65623961c6633e8d974
- SHA512 90aad09327bc852fd0ea0d16fb1540d51afa9feab478b3c9f5110ce6d1f7d9065a116f7120c42075802660e1724f60155290720831522aa9a55b15c842fd46e8
- SSDEEP 49152:oSuZQIY0Be2KcRVtOnks6NMHqSDmg27RnWGj:y5dKii61SD527BWG
- TLSH T1AEC5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 837fa7e9c1735add8de6c911518bd4974c8ff76887f0eba86620b11074d96e3d
- MD5 dfa67b998649698dc72ae42dd311501d
- SHA1 b32b8ff795bb59c6f495c2b5cce053d9b845cc0c
- SHA512 7729f3eea4ec8056fc82fdb11879daa50b4879b2033960c4779123d1485633ca3c27f72dd7b26b09f2cdc16b02b4c7ef2987cde9a3e765c6c98b05c449e86a87
- SSDEEP 49152:BhtSn8EApI0fig3giDn0AP5wtDmg27RnWGj:QX2imph8D527BWG
- TLSH T16195BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 1650016dd1223818d0baeddd84ae57e2ccc04b5df6defd4783cb423cbb95516e
- MD5 e1970e66bece323552cfe9497b187ee1
- SHA1 f7f9eaf5062919278ef8b663a85ba50da5365fbe
- SHA512 9f19e6fedf65a479232869bd8341a7ea298f6ced71b8249cea1d7998a0b2728f58c4d5bab92b57b58d04ba40a4bea76639e9e4f2329ff405a9c827f622105f5b
- SSDEEP 12288:miXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:misqjnhMgeiCl7G0nehbGZpbD
- TLSH T19DC423BE915C01CBE92244F5C3E5F15DAC173E57E92004837A6B78BAFBF24684B39426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 612353ebd1cedfdf8ea159cf54048001b63b3fb71f67f71ccffe13c5fecbbb1d
- MD5 07048c00ab9e2626991056511eadb2d7
- SHA1 6571689934a69e8d6deba3bdb5465f76c3b974a1
- SHA512 fda22f7dcc92eecc0d7c68636044649436304ff0e1950acda7dae2ee4953298d0021080f2dc473f30d3002f910518bdaf7fa06b5b56b38b6dda619f23e854404
- SSDEEP 12288:DSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DSsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1CBC423BE915C01CBE92244B5C3E5F15DAC173E57E92004837A9778BAFBF28684B39422
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 2a3118d497421bf1df3028f32a1983b7131f7f68a6f4df5708d5f89cb684552b
- MD5 1546fd959bc212692aafd25e25e8b30e
- SHA1 fe7a9571130a1a390cb18fa9fb40e69738c2c1d3
- SHA512 a129e3cb66f153f7987997e03b2cd4b95cf43c5549e0b92122fb8b9bdfa01df2aaed78355343f4769066d3e1adb610bfa5e0686522116e020fb3ab672014341e
- SSDEEP 12288:x8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:x8sqjnhMgeiCl7G0nehbGZpbD
- TLSH T181C423BE915C01CBE92648B5C3E5F15DAC173E57E9200483BA9778BDFBF24684B39422
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 6d015c45a6b8a7c578dfa19444a63e036140074715a44db04aa00b57635d642e
- MD5 d5fbce00cc91cc2eea61b1e20f81524b
- SHA1 33e835765016ada324989f4d51783c65390bdf0e
- SHA512 82246f1c5ca9d8fc1ffc2c0b949de0106bea67f2aad2e38b7e2388001c258ee05f38e6ec46e2a6a7496b1dc5725ffff6e7ad398f16423c8c55c79fa627cf449a
- SSDEEP 12288:TVRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jsqjnhMgeiCl7G0nehbGZpbD
- TLSH T11ED4236E535C01CAD83285B5C3F5E11DE8237D56EA3005DB6B532CEE5FB26944F38A22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 4ada94ce95143016aa1c52d49ee589c80f7738d34863e40cedbc50acae6f1925
- MD5 f2b9bebc14c48329b2f08befeacd844b
- SHA1 78e2cf5726241d0a46b83f80078e39e82ca3f639
- SHA512 bcc3b6b39c5937571f91b2481409c6524d33a838900156dc1105c97c17e3d0270a2685f96f54139d1befd6c33a320bf966126779563c34b00f6b4d2c44fa6551
- SSDEEP 12288:u5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:u5sqjnhMgeiCl7G0nehbGZpbD
- TLSH T1E8C423BE914C01CBE92644B5C3E5F15DAC173E57E9200483BA9B78B9FBF24684B3D422
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 52b64542f1c33df739e6291e297608f9fe6d66527d59767181f8880f86af310a
- MD5 38711db9bda2e2edff63e192442e5f0c
- SHA1 e9e78241edb8b029db4db2ed1a3c40f28989a93f
- SHA512 f1b28517f95db49eb16aa5c5dc90a2f5975a9a21d5eef595aea2c8cf73cdcd13b6447858bd5a2acee4f09a37d1ba4ad4ca0afb1fef0120c4c59c6357aac0503e
- SSDEEP 12288:OmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OmsqjnhMgeiCl7G0nehbGZpbD
- TLSH T18DC423BE915C01CBE92644B5C3E5F15DAC173E57E92004837A9778BAFBF28684B3C426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 6f3d5cad45ab712cd29b777ecfaf5ff84d6b28fe0e47cce97b87acaba849e136
- MD5 59b4e0e1363ce3f91aff4ef1eb96840e
- SHA1 b4fe231c706e0f1b4407bdcf826e85ac3d23b50f
- SHA512 0002ed524910bc93ee8354c333b0a3f6d71ae273bac8a43591005bfedd68d60a7e450b436459a6e844394f785fae6ca4229d52eab429c7234c38fd36da6ea772
- SSDEEP 12288:jaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jasqjnhMgeiCl7G0nehbGZpbD
- TLSH T1CDC423BE915C01CBE92644B5C3E5F15DAC173E5BE9200483BA57B8FAF7F24684B38426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 1701a456a422147460f9eb1149f0e5fcab8f4396d5ab1666d0ecfd0c69981f69
- MD5 bf387d341d368230c00ee50a261558d3
- SHA1 9d06c868151b58a1ea6759c93e403a947b9a4b46
- SHA512 05f79198b74f499c07ebecfa89f07b589e049c1f05c7b052e3038d2b7171646bda2fa3367b4e204e47556cb1e76750e533a91ebf802a25c559b4444f74dbc099
- SSDEEP 24576:zZMRzFVSOysqjnhMgeiCl7G0nehbGZpbD:zZMRzf6Dmg27RnWGj
- TLSH T1530501A9B35018F8EC63813EC965D90AD5B37C1A0B70C61F13A5366A5F733A00D3EB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 ff7b7d694a614aac2ff545bc3945108f4ac4a0f7f2dac17e446dcb7fa3a070d2
- MD5 a581bbed5e86fc900d883a2a4ff1298f
- SHA1 19434e8595c1cbb06f376afc8aade7bca3725928
- SHA512 63246f768484c4267e630cf930a5e64cffb03824391310608952c4e7ef461e960bb3f4942c15c59f3da1dadb485760acc794a44b374b3cdbb2aa7424c9c0e3c5
- SSDEEP 12288:MbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MbsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1AFC423BE915C01CAE92604B5C3E5E15DAC173E57F9200483BA5B78BDFBB24684B3D426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 2c576343dd7c4c93a1200991dac508a2768df720c50d748494361a1b5145d69c
- MD5 be4be1fa7cfa22b28741184be1f3b6f3
- SHA1 06ec4b04260d7e8e9ef2e81012a4be12e76fb0f7
- SHA512 46ef0bc74983107f183e76f32a0092bf69433ede06dac18caa0125f22b0f13704c5aef8e8fa7f51bdabeeb731ade0a118b876675cc437923bf328188f877c8e1
- SSDEEP 12288:jXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jXsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1B8C423BE915C01CAE92644B5C3E5F15DAC173E5BE9200483BA5B78BDFBF24684B3C426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 49a884649f28a988a0f64a1223ee265a48f7d3ef6ade06c00d5e4a64440d9b15
- MD5 04742caccce141d0ad7ab6e14822d926
- SHA1 126577a755ff3ecc8ef97266b5b30412d62d50ff
- SHA512 3ecaf8bb99a407eaa363b87579ee253b2319b8ebfa3370f3e85672d04192b9956d15e6965594449e053d0244d78d7ca9a72556017b600f1503f8c0d75673f766
- SSDEEP 12288:XyPz5L8+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:azy+sqjnhMgeiCl7G0nehbGZpbD
- TLSH T14FF4025B73A530F9D1378178C5A29A06F7337C3247204A9F17A516BA6F736908E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 8d75a16716c1e66d78ab0e2ac6c78f0bc753d17853283319f62eaf3076c7ec98
- MD5 be93e4f8ef849364369f1e1c93378b17
- SHA1 56bdca95c77ecad120e2f88a919d7ed73ba7d15d
- SHA512 8cd164737e8ba2029e77711921abe9b8bce84d8925fa936310dc8370a2bb742177157d2c081acdb4ac2180e3afd294fc4299c5aea71c717fa19bb68042809edc
- SSDEEP 12288:DbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DbsqjnhMgeiCl7G0nehbGZpbD
- TLSH T11AC423BE915C01CAE92604B5C3E5E15DAC173E5BE9200483BA5778BDFBF24684B3D422
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 b8cd878f158be003ce3be141dbb66b6a9d867285d0bba136c15afcd9e011ec50
- MD5 894e19cabd5a0ab60086156598925d4f
- SHA1 b0637f838adf7ce6b14f2896857bee255c29fd4f
- SHA512 0ffce087b986590d0393a3d1589c011d2854153f739482b0ff2a0c551da53386c60fd039cda0c01bb4472745e85f9d32a071d0ace8cba74d0e68e5d814d696de
- SSDEEP 12288:mbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mbsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1E0C423BE915C01CAE92604B5C3E5E15DAC173E57E9200483BA5778BDFBF24684B3D426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 717KB
- SHA256 5b209defeac92812310e109b9587d9e47bcef73124d3a9404e0adf03af5f2cac
- MD5 9c24895673b8d7e6c4fb4c64f925550a
- SHA1 09b395772f6885e1947bb3f14dd6707092a7de6f
- SHA512 da78c00045099d6b03031eabf96b67b04d6b7aa7113db2eb32af0f0affe2b1a537b41df3b278900f59f74bed917eef8247b6c7228236b8517ea7f683cf3a813a
- SSDEEP 12288:uyPz5L8+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zzy+sqjnhMgeiCl7G0nehbGZpbD
- TLSH T1C4F4025B73A530F9D1378178C5A29A06F7337C3247204A9F17A516BA6F736908E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 841KB
- SHA256 89af73015df1aeca51ef8da8061c70120bfd7e660e1b4763892593bc53167d47
- MD5 3078e5c36b6d5b69a67f732da6eeed50
- SHA1 4478d9b334897e1986300588214fc8eadad6e279
- SHA512 c56c432b9ba312923123107cd5fb8a19a94f4e373fadd70e486847051c4af495d7fe85f5cfe874d57e19f7812ad36b086bca38653a771368fc946b19d2038e93
- SSDEEP 24576:PTDaLl3z0zDssqjnhMgeiCl7G0nehbGZpbD:PTuLlj5Dmg27RnWGj
- TLSH T1920501A9B35018F8EC67813EC965D90AD5B37C5A0B70CA1F13A4366A5F733A00D3DB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1020KB
- SHA256 e6a2f59277ca1bb7ca761278645e3c6a044dd86a007d00f9905f84ecc792f70a
- MD5 85a692282d2585d022a30f3786fcd072
- SHA1 5cc2ce409a63a045848cd83d18d4d16112debdef
- SHA512 66b4bf097a114e4486d522e9d3ba3aa416b25e8f29d46e7a33df12685a55e650159ca18d88c8a5f38434c490b524a7af061cbf626a57345a3f930c92cf69f5f6
- SSDEEP 24576:K3vd9CHKy7GZwsqjnhMgeiCl7G0nehbGZpbD:svd9CHKya6Dmg27RnWGj
- TLSH T1AE25CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 581KB
- SHA256 3ed63fa6fe60f7c54051f07e72e58904c94b9db844720002052a621c37c1a677
- MD5 9e4f878beb1be7cef5b8278a95d08c76
- SHA1 e0ccabb67216e54d9c5cbd8335ef765c11a2eaf2
- SHA512 28f23f0dfd6b0cbd1d661d36c2ce5552be95fbe8119566f0325f15de5735779040aab350fc751c78c76f48e51e6a9ff1e6f84087721315f11c0e74efcce679e5
- SSDEEP 12288:6cXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6csqjnhMgeiCl7G0nehbGZpbD
- TLSH T180C423BE915C01CBE92648B5C3E5F15DAC173E57E9200483BA9778BDFBF24684B39422
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 581KB
- SHA256 f1712311ace9937863d8f487cdd98591e3390e07116f1dcf98ffbfb9a8f4b001
- MD5 a783cc80d62587fb012d70a741746e38
- SHA1 559e4b03a6bbb8f71bae635aae33171a32cc6c87
- SHA512 8595301803f93a13ababb495cfbb120d2a176459bbdf507e977b9d355278ea6e1603035e19242fde41d2b7e5b1926ddef28133b7493eaf6c71d840e846673516
- SSDEEP 12288:geXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gesqjnhMgeiCl7G0nehbGZpbD
- TLSH T1D1C423BE915C01DBE92644F5C3E5E11DAC173E57E9200483BA9778B9FBF28684B39423
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 581KB
- SHA256 8d0b8a086e15ce0c0b41ff9669498f0bd632936f9c746a589a8e9f50166158a8
- MD5 13c5d312ff6704915c7864649d36a112
- SHA1 b7f924208950908ab93663e217b1ec26bc8abffd
- SHA512 a702ce6dad6290b5082490e5caa2d7ff1794c84373646007d19d3ef8a011c6a3b1477c48c329b6f695cca67b35fbe53dd9a2002d5376d68dd8fa1fc1e6e5f3a2
- SSDEEP 12288:DNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DNsqjnhMgeiCl7G0nehbGZpbD
- TLSH T168C423BE915C01CAE92644B5C3E5E15DAC173E57E9200483BA9778BDFBF28684B3C426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.0MB
- SHA256 edf0ec4bd0eb2ffa0618af401663aa3591a94eff6bc08066b7ee97eb3ce8d611
- MD5 7cf5aad26fa460d55fb76f7a176a190c
- SHA1 79eb7e005fba420b45d8c2302eaa8ef4188ed438
- SHA512 024f32f67b4233d2c09b6a379c75f34b68189822d1ef311b29c457d055a5a8efaf45702ea294fce7b2a4f68e7e6d72ed78b17936a7e4b0d7c8222a8eda60e56d
- SSDEEP 24576:0fwvUk9RX6wkyAI6sqjnhMgeiCl7G0nehbGZpbD:QMnYIODmg27RnWGj
- TLSH T18535D029EBDC04E5E177913C89B7860AF6B278591B31C6CF129A53AD0E33ED45E39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 32cb830bf511b14eec8ef5f5d47bc82fce9f3766561c2839bd88901ee0e4d76d
- MD5 27dcf4ef8a9de5eabb3a2a7dda7c1a63
- SHA1 7dbafcd9ec33a1d0acd3790abddf4e00cbc3edaa
- SHA512 b65f04facc23d85da455e4cc9f4d2789f9719052f3cdd3d16734870c285126d7491e0ce1c52b5d9d24e1106be79fcfe3012bbf6dd65a839c4d4713ce4231531e
- SSDEEP 49152:FYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0NDmg27RnWGj:oySzPFD527BWG
- TLSH T17B066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 ba3ad29be49496f18be38bca3d8e5ef955365f6c80e23346e90465b8490a973b
- MD5 ad7d1a7f00eda6bcc3c9953a8405a519
- SHA1 d0dd7c053aaa8ee6a99d3d603ce9dbb91f032342
- SHA512 17cbfac5fa8b6763a3228928465154c2fb8b9e2080677ece5829de829a2bf86483693142236de4776a120fdcc3f1e057f40f482b86424e83c8feed839ddb637e
- SSDEEP 24576:V47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYbsqjnhMgeiCl7G0nehbGZpbD:V47JUQjTirIhCnDHUPfF/dDmg27RnWGj
- TLSH T1A865AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 59a9bc59d0c5a7d213a2d4aeda33c5162b28933b355bcfd49d1a6f9140580ea9
- MD5 b71a867b07f02b07cb93b17bde686568
- SHA1 1aafac1f74e43ad3554b598b06e04e8cbc2b9642
- SHA512 21a8d62526ff48eb608069f294f029249cacab60c976723aa1fa7d0939f592c2381a47a72323cd5b325deb4c46817594636278a98aa190f9cc557b1adad459e7
- SSDEEP 12288:Sbsf+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:J+sqjnhMgeiCl7G0nehbGZpbD
- TLSH T1E8E4011AD29802D8C06E5179C3969605F7333C2697E093CB67D1F87E1F766908EFAA13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\CacheMgr.exe
- Size 1.3MB
- SHA256 c0415606486d729f69bb47c53907c79bba089ceb6f90524ed7fb0b336117377e
- MD5 939e9d6cbef190218081e160f359f5d8
- SHA1 e1986c3936ba3d82201c60088c832e8710d96ec3
- SHA512 8b43a98403e492d7e658bda5d8d8bec5c22c949309faec8958c98ff5c892d27b9b3d113092ca50de2a4deb9d6023dfe1dc5750ff6a8e77c8c4434f25e66c08a9
- SSDEEP 24576:FUksqjnhMgeiCl7G0nehbGZpbD5vgIsqjnhMgeiCl7G0nehbGZpbD:FUADmg27RnWGja0Dmg27RnWGj
- TLSH T1695523B9750860ABCC324875C3D5E16DA80F7D62992058437A5778FEFFB64A48B3D0A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\4130eda0957eebe4.bin
- Size 12KB
- SHA256 bceca8285de602469a5df2772bf7c6ee09059825eb993c5997c26edf36b1e1ee
- MD5 20b0821cca7df2f82cb9beb4f6667ec5
- SHA1 b5b0793e3932a89cbc36d7da77a4dfe7a7b8402d
- SHA512 5a3ada69b4957b7101b82da787adf333fa6ee30e7a52d241fa22583d7c20d43a7e43dd28e12401f7373c797f1021c7e5a08c7de6c2b8205ea5d899f4821fae4f
- SSDEEP 192:0WPjCuQQc1nMJME1P0zRWTPEtDYF/kVfJvB8nU2W0qxT4re7B48enB+x3Ir2Oe9y:0W+uQQcpCFCzRWDEeyVJCVzeiSXEGG
- TLSH T1EC42BF8DA289B7F783C15402EB129569827301D61D3245F8A7E8F72F263549DF718379
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 b49627f52b53fdd3ad43d85e0009591c95392cc4ff6c2bd3afdfc4d2677445f2
- MD5 b271395149bbc714c77f057b97b900d3
- SHA1 5fc63c9d1185fb5c53c634bc2814998a76db6c62
- SHA512 79b4765dc674233ae4824b77742c7215b1cab779da7a3668de7354542d24f874284c1a43b064edc3a3744fc0d7abbc174b70e58f7f7da3b4143137723b917c1a
- TLSH T19BD05E0E4BDD11AD9042006E317CD0C672399F51DC720F4C9039678164687D9BFBE2AE
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 d244b38b5fb2add8eac1697f6b426af57e17046492e522f8f7f2e8377f5db9c3
- MD5 603646928e9a9d0fbfcb37aeeb980596
- SHA1 a9936b6f2b4ec599681f3cfa57f76194303ef9e6
- SHA512 d7117d0fe209f98884d7826805495a5f7c510c2589ab390a98a22d0f0d7c0e05345cdaa0d62cc1b33012e0dbc4d40e5e2f060a4c9908590bc841c721b809e9a3
- SSDEEP 12288:G072Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/2sqjnhMgeiCl7G0nehbGZpbD
- TLSH T13FD423BE934C118AF83605B482EAE12D680B7E669F1044C3BA5778FDF6B18D48F39517
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 b23e7911d853e33b2fc9c8858b442684bd27b623d9086dcc52a27cade23dc2be
- MD5 46af22ebd4b8910eb8e51173f60d6846
- SHA1 6564c813d1771beb78c231656535cbbcd2590799
- SHA512 5fc83be90fce33cfaf0d7c8f4827a9ab18134632e8062cb057feaeaea8f0dde984e75e0944e44b950c0f721aacbaf582a5c8e5d9df701c3d542f74fc4d1cd3c5
- SSDEEP 24576:YG88u8FpJqH1bzria7/mLsqjnhMgeiCl7G0nehbGZpbD:b7ZFPqVea7/sDmg27RnWGj
- TLSH T1E035016577E401F1D477D138CA868667F5B2B8250324EFDF07A88A951F23AE44B3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 804KB
- SHA256 1c93d059823e83996aa5f34daae159a0c5f92117a6e47a7018e08dffe77c125f
- MD5 d7d316768046efe54ee08bee74f7ce14
- SHA1 2e1c35d630e8d808a1d89ebf1bd0a8c13d03336a
- SHA512 83375e2734bbc9c15cfb30ae9afce87d2ab7e79cb4202cfac63e9a8cb89d552b449810212340d4424a17ac392c0271a9fd06f57096657125b6a53c65af6f5169
- SSDEEP 12288:QHvUrBFrEjwaQPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:QPUr+NQPsqjnhMgeiCl7G0nehbGZpbD
- TLSH T11605F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 2b42e861da70aca229411e7d51dec21a8bfb597e2a1e2634dc5254d1e73cff51
- MD5 bbc39647e6135bcebc18f74e02200531
- SHA1 993abe230415fa4f11fba9e71c64c788a451fb9f
- SHA512 ca360ccadf653fd05d9dd2898f4fe9615603da1f7e877c65fac3f8b0c787bf4d5bfabb96e680e65a31689a0cb938da1b8fb349d787a16cc42a10cb5a366bf02e
- SSDEEP 49152:BBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjjDmg27RnWGj:iG05lO43b2D527BWG
- TLSH T126D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 f93788ae82cb6901ac0a6943cff5a946f73729eb653d2c3a528ad0b8401d08bb
- MD5 21f686271c2357229bf266bb52004aaf
- SHA1 ce5b228cdf5f40b9e8d9c4d2165b1070a5bc9512
- SHA512 54c87af4a06b6b87f5cdcf5f56589860a86bff8405ac56dbad239a1b1e2e2bfe74a3e147ab145660fb1825329f7b52b8e451d4b09b16ccbd154772078ae36489
- SSDEEP 24576:zfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnJsqjnhMgeiCl7G0nehbGZpbD:La5POZ3BJt2pasx2+mbDmg27RnWGj
- TLSH T1A365BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 074b6ec6ac6bdab80bab4be094370e832012f53386cab0834dacc1940a2e30d3
- MD5 3a8ca3ba5e864662c6895c7b0b66449b
- SHA1 3879a368f8fe1f5e9048e1bb4752db3c2814ec45
- SHA512 c69d5eac55536c9bbc643e8bfb5ed30b52a64d8fbb7a46518dac982e4fb8cbea0ce0d63b575f3f7856e67edc7924ea87518553df6bf38f158950d5761cd272e2
- SSDEEP 24576:uNcwHdjbyQ4nLC18lb/EOjowL7FkTsqjnhMgeiCl7G0nehbGZpbD:uNc/zEOVHFMDmg27RnWGj
- TLSH T1BB857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AgentService.exe
- Size 1.4MB
- SHA256 099d65506ad7d652d7c76011078ce505649c1aa9a92705cc25f25a1f79b48110
- MD5 2c96ca1a16c1deedb6d273e42115f5af
- SHA1 69656172a2c48a77519808a4a163a7c032b4f912
- SHA512 9b826a8f0eb468e83cc3884122cfb6ae16030c486a9924e62ac72608f35a967a8fc3bca6b5f4f8d253cbb088f0842cbc7a1daef1c4f2bf8cebf45fba7a511bc0
- SSDEEP 24576:Ngb6bmBIi49WNNFpg1rSvFv7bY4sqjnhMgeiCl7G0nehbGZpbD:Ngb4mBIBhGFPDmg27RnWGj
- TLSH T1E4659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 ec3f73af16a940d859db94b9a597986bf1d331fbef54c724c9905535ada2fb1b
- MD5 d4cd9ae7aa685e0911a160f001d5eb8a
- SHA1 14971cec0ebe635610587039ee440459ba031baf
- SHA512 a15caec1e5e3c06b64c9315db474a6cd5fdea7bf172c066a38cb7551709e3add11c77244ffca2d0066fe57d204779daa8c5f2d93fda7548f51dbdacc50828c8b
- SSDEEP 24576:sTkNvNnaFeYhJNtmZBmFsqjnhMgeiCl7G0nehbGZpbD:sTMwBtOm5Dmg27RnWGj
- TLSH T19155AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 964KB
- SHA256 83274f82eb1e116555f6bab53ad8dd06823cb321cfbab0cac4c64dc572b452f7
- MD5 c39f2c74573f6f8a083a30f176571db1
- SHA1 cf493e49da71b0509cce3dc6cb6f86928fe43730
- SHA512 faaf5e73dc4d12af6be9b0cf3e069c32fd5427f465887225b342e46e5d585055f28e934de9ff65abd787f0a2465ffaa62662042591dac67b890b88dc18334c41
- SSDEEP 24576:wD3FHshBIYQgACsqjnhMgeiCl7G0nehbGZpbD:wDVHeBIAAGDmg27RnWGj
- TLSH T17525E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\maih.pif
- Size 97KB
- SHA256 db39f2f497fff854d13e5c211f474a922e2c0425a635b4167bf041f1ebfa7ad7
- MD5 039c793b1ad13b4197b3a1c074ee66e4
- SHA1 43808a46582bb4e48be55b2642e6687384e81c1d
- SHA512 f56f6f07c97235fcabb3b2d40cc8aa5fb20b99011aeda7b3c6009ce61f93e46c387c662ffb8e19d0cdc629282181a405966f048ef8e4bf9da14a7f1bb2d99de5
- SSDEEP 1536:vlbsm3B3shgjVO+z4HwEInUT/N+vuTLVshWrpchPtwgZpDYzTZAz2Pc:v6YB3XtowEIKRTQPtNwzFAiU
- TLSH T194A3120E105BD587E1DA5AB465C069DB40C9309126D4AD7F05EE91CD8CBABEF32BEB03
- MD5 SHA1 SHA512 SSDEEP TLSH