ae100c5a538cfeddfeed204c852de7515c3bf09b2805839904bb15705c35499b

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_db968151bc22b5abf378f94375f9fa45_elex_rhadamanthys_stop.exe
Size 1.6MB
Sample260804-fxkmeswwaw
SHA256 ae100c5a538cfeddfeed204c852de7515c3bf09b2805839904bb15705c35499b
MD5 db968151bc22b5abf378f94375f9fa45
SHA1 b2e187a376f2c181509ff44d7c8ca87a4c8c8473
SHA512 983821f0eaf93d7e7a2a71cf314a03f31833b30c275c8c261611389d8a0bc4ccfdce5820acca3bb7cd41f77ee84cdaf7daffc5e5e52ea4c2678c84a9394492d6
SSDEEP 12288:sa0wIk0BX3RKTemGd70ioGuVWW6oI4rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP23:saqDd70iTWChBMvjRA+iqMIjmJ8c+hE
TLSH
T12B75E01033D08136F5B329368ABFD724552DB8715F6882CFE388166E5E706E1EA31B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
2428	elevation_service.exe
2684	elevation_service.exe
1568	maintenanceservice.exe
2708	PerceptionSimulationService.exe
3348	perfhost.exe
1084	ReFsDedupSvc.exe
524	SensorDataService.exe
5684	ssh-agent.exe
3680	AgentService.exe
1308	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_db968151bc22b5abf378f94375f9fa45_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_db968151bc22b5abf378f94375f9fa45_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_db968151bc22b5abf378f94375f9fa45_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f4996588c618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_db968151bc22b5abf378f94375f9fa45_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_db968151bc22b5abf378f94375f9fa45_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_db968151bc22b5abf378f94375f9fa45_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\RenameGroup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_db968151bc22b5abf378f94375f9fa45_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_db968151bc22b5abf378f94375f9fa45_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5710540d023dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f5f4383d023dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e5731240d023dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3384	2026-08-04_db968151bc22b5abf378f94375f9fa45_elex_rhadamanthys_stop.exe
3384	2026-08-04_db968151bc22b5abf378f94375f9fa45_elex_rhadamanthys_stop.exe
3384	2026-08-04_db968151bc22b5abf378f94375f9fa45_elex_rhadamanthys_stop.exe
3384	2026-08-04_db968151bc22b5abf378f94375f9fa45_elex_rhadamanthys_stop.exe
3384	2026-08-04_db968151bc22b5abf378f94375f9fa45_elex_rhadamanthys_stop.exe
3384	2026-08-04_db968151bc22b5abf378f94375f9fa45_elex_rhadamanthys_stop.exe
3384	2026-08-04_db968151bc22b5abf378f94375f9fa45_elex_rhadamanthys_stop.exe
3384	2026-08-04_db968151bc22b5abf378f94375f9fa45_elex_rhadamanthys_stop.exe
3384	2026-08-04_db968151bc22b5abf378f94375f9fa45_elex_rhadamanthys_stop.exe
3384	2026-08-04_db968151bc22b5abf378f94375f9fa45_elex_rhadamanthys_stop.exe
2428	elevation_service.exe
2428	elevation_service.exe
2428	elevation_service.exe
2428	elevation_service.exe
2428	elevation_service.exe
2428	elevation_service.exe
2428	elevation_service.exe
2684	elevation_service.exe
2684	elevation_service.exe
2684	elevation_service.exe
2684	elevation_service.exe
2684	elevation_service.exe
2684	elevation_service.exe
2684	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3384	2026-08-04_db968151bc22b5abf378f94375f9fa45_elex_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	2428	elevation_service.exe
Token: SeBackupPrivilege	1084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1084	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3680	AgentService.exe
Token: 33	1308	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeDebugPrivilege	2428	elevation_service.exe
Token: SeDebugPrivilege	2684	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4508	AdobeARM.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 4508	3384	2026-08-04_db968151bc22b5abf378f94375f9fa45_elex_rhadamanthys_stop.exe	92
PID 1308 wrote to memory of 3028	1308	SearchIndexer.exe	102
PID 1308 wrote to memory of 696	1308	SearchIndexer.exe	103
PID 1308 wrote to memory of 2524	1308	SearchIndexer.exe	104
PID 1308 wrote to memory of 2336	1308	SearchIndexer.exe	105
PID 1308 wrote to memory of 3116	1308	SearchIndexer.exe	109
PID 1308 wrote to memory of 3000	1308	SearchIndexer.exe	110
PID 1308 wrote to memory of 3056	1308	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-04_db968151bc22b5abf378f94375f9fa45_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_db968151bc22b5abf378f94375f9fa45_elex_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4508

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2684

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1568

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2708

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3348

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1084

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:524

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5684

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3680

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3028
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:696
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2524
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 2992 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2336
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3116
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 2992 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3000
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ddef2aad6bba90b4630007482c14c2a2fd2b340fd51c14bbd650d40c254c4a94
MD5 60f3416418f1d9d6d13bb5fc9add2372
SHA1 f0c9bcd47095b474bc07f4fa1b913d47d6ec6a68
SHA512 b602f5f1d85bb008b60bf57d1c142c6d639907d487cbd3c9eb6829dc529bf7c0388a3039f7c3c7b43caf14286afb1d0db772649627c63fceff6014404997e6a8
SSDEEP 49152:vb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnjv1PiqMymJ/+hE:t3q6mjBKtPiqk9+
TLSH
T1C7D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 9f0aa90ec59a79c14d322718dffd3bfe846e4016a095c420505b9233b98e7c9e
MD5 d73731171c40dfb74ca31c5100fd48db
SHA1 c33d1d3c2921ca50d5777dbb25d39cbec928567d
SHA512 bc329e1e5f7c5547c6b0fb74b18911d7d26af9af24c1d7904e9a1ce3a44f64bcf0d6c40576356e2989cf919f3e1889094eaeae041c944ef786a3a05babfd9bb7
SSDEEP 12288:m1XLsswWkxy2lRq2czACrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzIT:EXYfDtczAbBMvjRA+iqMIjmJ8c+hE
TLSH
T1EE65013863E409F9ED67923CCCA28512E773B8554760E78B03A4996A1F333D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 f5386549339cd393c6f83c72d1ca32bb5a09771c60a64a9cee0ea3d76601c91d
MD5 7eb06f04e5b14ec4d0e53c2a5daa9d93
SHA1 fd075a1b0800095105f072ad3b64d89af5d056c5
SHA512 8571d842536079acbeed377daafd8d50e16f6763e290fc23dde462318386bf54ce6658cb128c7d807063680d528fe96c1b95ff76302f4932051073aa0c29f19b
SSDEEP 24576:R0Le5ji0hmxhrM6BMvjRA+iqMIjmJ8c+hE:RPji0AzOv1PiqMymJ/+hE
TLSH
T16A85AE26F5748731D073C0B9C5D2A68AE972308657308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9b5cb2bd72b52e828ce890c88c83942a7466ea336a16517d1bfc12ea65df41bd
MD5 b9bcc3a694eec0e982724f8dd1983fee
SHA1 fa387ef3f6faf8ad1bde3b065e2b4f7b0ff3b208
SHA512 3575a677f1e084468abc0df406ebe4fe497ded34e74a5b84d61ae4c2ad20a99962d5cd29c0a6c91259580f85db56720d1fffdffafa87a3d6e08e357083fb789a
SSDEEP 24576:5a7/ezSC6vUyD/aqgrvWj6q8wyuUBMvjRA+iqMIjmJ8c+hE:o/ezSC6vUzPv+Hjyiv1PiqMymJ/+hE
TLSH
T132755D25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8a9c982986316d04ac92eb9f226c1dfe9a4f3943e1b9643697a6c1a4f25676d8
MD5 218af959b1030650e3385367d8de944c
SHA1 b870d7da2c9ea2010548eda29dd42ea328be69cd
SHA512 83674a05dc97563602a54c6f46d78882468828be7abdc47dfd1e9bb01a202fb3522edbe4a30648455ee2e510ff6ea6ef82cbe119247520abebae56792d68c1e2
SSDEEP 24576:vVbqPb88hv/l+BhBMvjRA+iqMIjmJ8c+hE:vVO88hXl+uv1PiqMymJ/+hE
TLSH
T112559E66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 03a33195b8a96050bb86e3efa0e6a9d19104de53970b40ea7575d0529c46407c
MD5 57fb1940da187d911c8620239e6eae33
SHA1 bba0b6eb034cd1e90523dd575b1ce9f27c231c64
SHA512 4f6cca202132a603bfef794047019d4e6629ffdcaa1b46499aaa125c781cdb326c6ea7933ba6a470af2cea5a107e94f0e139f2561cfd004bbb4d635e6c118075
SSDEEP 12288:BG3rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:BGmBMvjRA+iqMIjmJ8c+hE
TLSH
T15E45233600A80A95FF733F3C6DEA57A3C285EC7DB551A203B51676DB563C1E0A88A607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 d9fe935534dc5d73efb4aa94d3460ffee9ce5f1ab19867006964441e38588e88
MD5 2608e62ed709ca50c1395f2e1593e7f3
SHA1 7130bcf8398ee5c402c012f1f1fa1d6a6f276290
SHA512 5ebcd743f754452bd26e051d04658456d57569146b8c9d92d9bb05cec5e63c146eff019bd9d7ac301ed2c23ebfe445d4e6dc86482428cabf2bdbeae3517aec71
SSDEEP 12288:ueBNUbTVO86UwrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:uJIUJBMvjRA+iqMIjmJ8c+hE
TLSH
T1E365DF3BAE28FCD2C67A5D785A918700D77278304B62A3CBE175834EDE235E05D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3599f06a451997bf1bf490c0357857ee0374d3e5989bccae3ee49f8f956d8ae2
MD5 f55e39d4e8b37e4777b19062766727f2
SHA1 0829a3fd22ec20fd25d2522f91a2fac895c87c7b
SHA512 2fa8d76eab32ecab8d85c14fb493eef0b3d207baa6e24f982179de78956dbf2f9a02ee5bd0f9074652e25dad4e9dfe8701e004aecdb3bb610fd42fdb62634dad
SSDEEP 49152:lQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THv:lQvGAdlCEL8c/WRNw5CjtPiqk9+
TLSH
T16E266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 2e590d5e843a677abde0602f136dfed4fa80cd86c987cd2949dc3a8060d27aac
MD5 7078156ff522ad3578b2a0f03cc80a79
SHA1 0ce6c2f2ad11d0ea1e13d8074f5478d45cef1833
SHA512 69c91c9654207aeedfbbf10ab0f3782f8687363cfc42ef9836c51ec71d685d956fc36a2ea3cf8623eb5adfa0f05182ca38a86ae6bb18fe7624cc8fea3256b93c
SSDEEP 12288:0AwSfxL/2Dc3mDLLmt0LDQewsAj6rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2FuQ:JfewsAjjBMvjRA+iqMIjmJ8c+hE
TLSH
T1DE75F031FA74D432C7BB0DB61B36C716542CB9204B612AC3F3A89E9E59342D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3b019252c514d1e6efc50c017967adad2715f162257806063d213a2302e0bebb
MD5 7ebbd7616e4863cdf7ce36789e460f0b
SHA1 f19ce2689b6cb922061a010c2c7bda67dc703df2
SHA512 0a25228bd7b8e0f42d349bb3952fbcb9fe4b13dfb6434cbce0d7d2ec2b7f9264754a7b1d40419b06c6b10120d9cdb0174e4c727120878fd3ee5cc761fbb401ba
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHGaT9+:bUEtQevvqc2W1cpV20I32GaM
TLSH
T10C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0624e8885a914b109646039acb2429fd9972dfc311786ca8ddfefb88c9b4a9a8
MD5 039fe10fdfec93ae23faff5b1d7eaaf7
SHA1 ee3259dd9b76f945b18a1f22248320dba6b84317
SHA512 7bd7c27f577801d9d934d4104add9ff20a217a67622fde6b542d11be2a599682c60c66766e9ac03dabaefd4223428a0627a03af7ae6e6e67839ea97c4ee20b3e
SSDEEP 49152:ICbRquA/m2yL5zQfFiV+XenmE3/zev1PiqMymJ/+hE:hoqtVjnmHtPiqk9+
TLSH
T103D58E1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8578d291103a0660076739e3b2b4398de3b095b57c2541369916d18aa289889a
MD5 dc77367839628e88435a7b990b3335b1
SHA1 7f0da3af46a576abc025ccd7efabc7d9a0e1e8c6
SHA512 452900a6617cee34016a8fdcb0f53fdc5b84f1a658edbb2a9c79b926bca336e47419536b670a7a312c9adb7488653fe4089a2a21a9fe7a9267c03c4a3847e2bd
SSDEEP 24576:TAhGL6IFoiwtA5l7S53IBMvjRA+iqMIjmJ8c+hE:TAM5Foiq53v1PiqMymJ/+hE
TLSH
T12435AD81E7F945D4F5B3AA7899B68171EA76BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 646edf1d297611fdd20503a59ca399a5d4b7d6ba0e9a29b2b70454fc90b99ae0
MD5 daa1613d93487f362b728196e5ffe1cc
SHA1 76db6eb3d07065326d1de202a98aafefe4b9d2f0
SHA512 591273c3acf9e56c071af94185f17992905e990d81484d24210d2ad915cb7194c4737772bd2d768d1dd4c080af7d42bab75bd40fead20b376cb5a692a3b7fa01
SSDEEP 12288:3yZ1IyqrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:iZuCBMvjRA+iqMIjmJ8c+hE
TLSH
T19255122A22E811F9E673173CDCE64742D362B866733193CF262552AB1F37AD11D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1ec2f710e16a8e7b39a428b289a6a40179a6ef66b60f3abe9ff98adb8074af8f
MD5 9d1bd92d73131f55c5a6a90770962936
SHA1 f8d95b161d405bf6c9c58cff8529c99d680ee76c
SHA512 bf84d7bfe8658d0e19eec45baa4a76104f481ad48f310c84aef515c583b36bbf76f27b29316ba2ee1dac0d47c9cccd3a6b85f89857bc43374698d6fdd7973c52
SSDEEP 98304:BQRQyi36YOcPDLvw2gAf+PN3QtPiqk9+:YQyiKanX+PNMaT9+
TLSH
T1E4667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 bc04afe25bf6bf6a45c7b5c862e45b898b9cbec41d552de7e7205c860903cab9
MD5 b5b0aa7cb04122d7393e1c1c92e8b4ea
SHA1 1b24212715aaaf21ea25068d15a8eb9e8be2934d
SHA512 8beac42b604fe3426863e7f4641882ab4c7112e86e88c8b23bc8b2bd8dc11b72251b9beac7747488fd73604a2369968d16f44da973901808d5222860e56d43f0
SSDEEP 98304:+QRQyi36YOcPDLvw2gAf+PN3QtPiqk9+:lQyiKanX+PNMaT9+
TLSH
T19A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8157a24ef5bbbe7015d22cdd0b671337f5ea5a223dc6dd41356fc49498eb88dd
MD5 f85e5adc2dd8f8a402e0f7048bf983d6
SHA1 02042402490dd8b53cc65ebda4e2854c8cd0592a
SHA512 e86a0c21332fbc30b9946e440fe25ac7240ef6be6322a49d13c8df6f91471edc5254dc60ddb5710a9edab3a76059e0ff85d09e97cbb66f7e4b910f1b6e90e68a
SSDEEP 49152:k68Qg55nhkeWu7PNU3/Ov1PiqMymJ/+hE:OthTRc/OtPiqk9+
TLSH
T16FB55A33B2F60099C44DE1769F4A873196D27C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6a558172fea78e07d85d6018c6b33b2efcfc22ec86bf91fcb708af94c6e62927
MD5 75072a4b81616184a3295ed663d8e591
SHA1 f2c22ea09d5971ac84736a1068e340fde4b20aab
SHA512 301932c86c217fa7ab95cfcf32deb9a193635d410a4a759017dfd5f1352f67322b3779cd9127b08c671426ecaa47e99c89d03438f01a99c7970dc4b19d7d2faa
SSDEEP 98304:9y5112gYy5azzVvU69nLKnhZdtPiqk9+:gLIHRWh1aT9+
TLSH
T13B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 edbc45cba2febfc1d12371f540169343bafdf2d7104ae943b44b2c73bf9af177
MD5 24f53b65d50cb6687a9f60e3815f9017
SHA1 f0c3ebf855e1b5928beac5df1135e390660e332a
SHA512 2f5367e091aa484380af79027bbdbebc185b40b4aeb058db4ce474692df9ff1583a45e7ad263f3266f98aab22c0660c1debe8de743f01976677b05344dfcdce9
SSDEEP 49152:zB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glWv1PiqMymJ/+hE:Fu6JmIxd2dWtPiqk9+
TLSH
T15AD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 409cb8b610d8a9c8a89c053a643889ff2dc422d0acef791ec8f73618b5717287
MD5 f84be6310f5e6f760f4ecf826fcc22f3
SHA1 a7391bd76c814085faa1c2e317e177530907c2e5
SHA512 8fd7926b33a30982e5119cf621fc0e14d70c0bb523b2e714f2e78fe53d2fc23158e417b1d9c0de183c3f9c0dcd784ae619d624f7d00f7c6df4ec866e9186be51
SSDEEP 49152:x1hpsNoJpF1A67U44CwH7R4x8v1PiqMymJ/+hE:xmifPqRHtPiqk9+
TLSH
T1D0B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bbfd39d76568eafdedd837fbf484d8505156719904ad94be59887dc724a82c43
MD5 53a4d92288b0ff4ec7dc3c703f20ab1a
SHA1 e3e395a16c522f338f1205f6f726a71a77876eb8
SHA512 9c6ee2c77c4032a918f5b47415f8cadd1db760e18c31d5c111719e4628e5e424b009bcb43886212fe00bc30bce55cdfe17205bafa9253f5b0b6609b363a8911a
SSDEEP 49152:OSuZQIY0Be2KkRVtOnks6NMHqJv1PiqMymJ/+hE:A5dKqi61JtPiqk9+
TLSH
T121C5BF13F2E901E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 000080e389ed368d6613d30182274c16c35f020b4fdb5bc7a3c9564ef2e60f5b
MD5 350b4978b11cbb6a377f63d87878072b
SHA1 ae7b893b946fbe1d5355b2737ffce643fd9e21a7
SHA512 7e16d9e3d43500188853f975d74014f21e1fb50820602a285083d574d33252c8c568a74e21a74564e78cff4ea27b9d925d0ecca4021f3aa767dc8e04eebb14f4
SSDEEP 49152:JhtSn8EApI0figjgiDn0AP5wYv1PiqMymJ/+hE:4X2iWphLtPiqk9+
TLSH
T16295BE13F2D901E8D06AD178C7468632EA62BC160B35B6EF0A50B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b2675ba1103e46d0d782f55aac1b7101ef6f1442c130538f96eb9e441e366e2a
MD5 ebd8103ab736af885e5b6ad9858a1110
SHA1 7c9221ac6bc670db0617e693d9f0c6d4f518fbfe
SHA512 1af89fe993ae00f4ea487f990b14eaa06cfc5131dc37351885961ba80376cd8ce56385667ffed9e341f998bd299784f82647052d9bf8f1448f684459bbbb3c0e
SSDEEP 12288:1vrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:1uBMvjRA+iqMIjmJ8c+hE
TLSH
T1A645233A00A90F86FF323B3C99D75392C285EC7EF651A203761A719B573D1E4284DA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 645778ae449685e672e519ae64560ffd7b8404902285e14ec24b4adbdc14dcc6
MD5 ea9937a023d8b58d1a6baf1ba0014124
SHA1 ba14389dcc398ba96e4323ff9391bc8cd4a5880c
SHA512 9b84c1c285ba47eccde4945feb38c72d7d3832711253b9112874e7ee91e8e044ead25f47be3a06d299bc2144b20c64e410e72d5b2aa57e1153beb862ca5e4b4e
SSDEEP 12288:n2rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:nvBMvjRA+iqMIjmJ8c+hE
TLSH
T1F745233A00A90F86FF323B3C99D75392C244EC7EF651A203761E719B573D5E4284EA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b7665519f94cb7f51b947285c1d89ec8d4028e8c93a798050573334795aa6e31
MD5 d90fdc3eb660934573f6a426e94702e3
SHA1 73bea8a24c93577b431feffb33ae27dbeca3e473
SHA512 3a6a9d77807e848c0c3af651e93a6894b9439cbd8b4430ea858786ce6851dc35e66a8ce911244ad8cf419a3031749b0a9076dd4d0d28639e535085910277d32e
SSDEEP 12288:xIrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:xxBMvjRA+iqMIjmJ8c+hE
TLSH
T15F45233A00A90F86FF323B3C99D75392C284EC7EF651A203B61A719B573D5E4284DA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 a19c504d13f36609940780d15c412b86d9d9445d4a2de56b6020122d5c7da877
MD5 c4eb170b548b0db36a898c033a61a4dd
SHA1 09231466763385aa266f662b0b3c937246b6f44d
SHA512 62d8289866cdd38e416a9f7538a91581cbeabd7c5e3718ff71d0c9012c2a4af2346402a172e3b347914df431527ceead59eb94db35ca3438c4ae36618c539f69
SSDEEP 12288:oVxrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:xBMvjRA+iqMIjmJ8c+hE
TLSH
T11D45233611A90AC5FD32AB3CDDA75352C395FC6DF732A30B7605259B0B392E02869B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 206b2462656be5671668dd3848396c8f033682450eb1f6ea66b6105d5b8c5b75
MD5 5ff746b9e2c598c80663e58661ed852f
SHA1 2e3787e1b1cb858da241c64593ff8a7f3cc6c59b
SHA512 c57ece4558a432f9e2fbd028f4180d840d2dcb416d645d93f7d66f28767635c212679c1078ce9932547beecfb06c0b7a4ec39c6424f3468da93af0763dd15a55
SSDEEP 12288:c5rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:cgBMvjRA+iqMIjmJ8c+hE
TLSH
T15F45233A00A90F86FE323B3C99D75392C285AC7EF651A203761E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b2f5ff6db2985872b307e3fe05754852e72b5245f7f689a215fa47cff10e4dd3
MD5 2439976504325cf838203867ca4765ed
SHA1 26f57f396423d814fa215d2f217e4b48f3fb7962
SHA512 06bd7beffebb0cd3d64e67f28d3140be73b206d3000f1038776724d28ee4906e95fb5be83411220d4a83c35a10d444c1d3043b8e9824f71e321b900f28e66b7b
SSDEEP 12288:jSrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:jrBMvjRA+iqMIjmJ8c+hE
TLSH
T11145233A00A90F86FF323B3C9DD65392C244EC7EF652A207761E719B573D1E4284DA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1bd961bf79311d3111231043d98fa5deeb206b38f8b78b5e2f3b8f26b412b744
MD5 62c7cd8dadb12efb9f1db8ea365a203e
SHA1 250100d2bd696be2a578b8fd8f6fb545a712c88a
SHA512 4e849151880eae843fe9e67b2bd8f1d23a4e8ca221f701782efb4cda5f15c8b93f87f5e4955eb31f21b2893676405de0005047b20bc25d387cb126de6bfcfbc8
SSDEEP 12288:gerGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:gnBMvjRA+iqMIjmJ8c+hE
TLSH
T17145233A00A90F86FF322B3C9DD657A2C285FC7EF651A203761E719B533D1E4284DA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 86c10ad878885a57ca38a501eb809c3092406eacdf9d7a963196a371be40721e
MD5 4f27a587af0ab25f6f1607b7cfed0435
SHA1 f6bf8c131084805d5fc1681dfda8b62b5ecdbd38
SHA512 d92818ff0f11750c0a9c7347c0d94cf0a2005f1fbb4aa18d51b448fa5a2bcf0584a0157b2b0be9757464ebb1ed7256eded3539a7555e60b161ab174f1154fd0e
SSDEEP 12288:hiZwbDzzFEoS2cPvyWrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8ti:kZM3zFVSOPBMvjRA+iqMIjmJ8c+hE
TLSH
T1A165016573900CF8ED63423ECD558A16D2B2BC6A5770C60F13A8366B5F373A11C2EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 860c4833cbeeb4d7503bcfc3349469027e330d9dcb6c1b383329483cbd5ae356
MD5 aa5de6c39a5bf66e94527e708313ce65
SHA1 ee3c01d9a77bbb2e7ea586a5e166dc268ed17358
SHA512 2172b4eae9896fdfaeebb0c93f74373e2b5b19192ef7bf56b4ae4fefb456219cf559dc5b2b0ab2ca1b03f7834c974a09214b9de84bf7f29017f79ce97d64325e
SSDEEP 12288:wjrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:wyBMvjRA+iqMIjmJ8c+hE
TLSH
T10A45233A00A90F86FF323B3C99D75392C244EC7EF652A203B61E719B573D5E4284DA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a6091776e5eee570e22ea11cf69bcd327a094cfaa5ec486c6a4b88ef43b0d1e6
MD5 551e6d9a8576ab458b2593191fd61604
SHA1 322c11d376cb2567fa1848aeb0c440981cf490c3
SHA512 6f88c25bd04751af2e6fc49f95b1cce5378b6a4de16b07a3afd718314d3651ca6455d9daac63f67a0e38f4ba44bb528cdf4c74e01cdcb727e660bda4c199bb1f
SSDEEP 12288:XnrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:XWBMvjRA+iqMIjmJ8c+hE
TLSH
T12445233A00A90F86FF323B3C99D65792C244EC7EF652A203761E729B573D1E4284DA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 7d16c3e879749eac96cadf11841e45c0acb474063df3997b471d9ec2d27eae43
MD5 66688948e9ae2836851e52d5b4e9a629
SHA1 eeb650f15b107c55cc3cba937d85563bf53ae557
SHA512 b20e47cea41546c3c0fc49dc2ab0e71a3efde3c330f8821393b391853567459d1bb5588b06140e16d194e4db1907c03dfbebda24662e5a7a5cb447e4991c5d83
SSDEEP 12288:IyPz5L8qrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:JzyTBMvjRA+iqMIjmJ8c+hE
TLSH
T16155121722A521F9E5335238CCA21B52E372B83657209B5F276453BB2F376E05D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5f2a7c67ead599a3512582c1d9233712f564bad433c70aa98d8597eea2da72b6
MD5 98d347920d64861549815ea8aaf44d45
SHA1 3c2c07517e070de8077b74cda840b8f9060c588b
SHA512 10ced3c3057dd8dc84718cc3313682069caa9e2874c6bcb420bd664d43f5c09afd4fb9c29a4776c91a3305587c8b619d193ae5b2276c6c5f4dd2591ed87ce426
SSDEEP 12288:bjrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEVt:byBMvjRA+iqMIjmJ8c+hE
TLSH
T1DF45233A00A90F86FF322B3C99D75792C284EC7EF652A203B61E719B573D1E4284DA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 bcef12b2891a041712bab0a11dc4035485b9742850ab56bc557cbeeb4503b393
MD5 f70a206eff57690d2f693b19692f7db9
SHA1 d690824d151b1c49d5d65a6d816e26d8cd999bbc
SHA512 4ea1d3d1e3e5ccd2c42c325ca2e3950d7c3e919fca0e33e7c62b662cc8c8efe10b699d55317b4c495b3748a6b8049a76e9f0ce1ea8bbcda0ca6ac77706311baa
SSDEEP 12288:MjrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:MyBMvjRA+iqMIjmJ8c+hE
TLSH
T1E845233A00A90F86FF323B3C99D75792C284EC7EF651A203B61E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 6a0e4b0d55391f38f115a3ce1c9fb215889cfaecca20f5515657e15846024814
MD5 2ae08d7ff4517de00b6dced04ee2d051
SHA1 bfb59cdd75d98c55f35e5b1473f4902f262341f0
SHA512 1ab2e69fff3d6dd3f17d13649f2e5d80f735c1930a6764630e423dc58293a27493bd93479e349f743119b6a2b0f16ea4618d0914413c1f1542894c5dc095ef68
SSDEEP 12288:1yPz5L8qrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:czyTBMvjRA+iqMIjmJ8c+hE
TLSH
T13755021722A521F9E5335238CCA21B52E372B83657209B5F276453BB2F376E05D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 d6c0cc2f8622cc699efcb0193764429517a4914192df0a51ad8291f94af1bec2
MD5 2c452b2110f61ad409e9a84692a71e75
SHA1 d022d4e537c392ea5d2480987cc4a982ac6b6bb9
SHA512 e48648f8ea41f036bdda2339e6fb45c9e06189ce4fec552d730486a044368a410a6ea75490062d392783f67b07cc7493c7122c269806e9e95abc2f84c5c2543a
SSDEEP 12288:dCd91WYoaLHF3z0z04PDvhYrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8Y:IT8aLl3z0zDBBMvjRA+iqMIjmJ8c+hE
TLSH
T14565026573900CF8ED63423ECD564A16D2B2BC6A1770C61F13A8366B5F373A11C2EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 04c19efbe1fa0a6b64abf54701df103ab021bb9affc8a4706a0b50b8379c3442
MD5 7aa680aba4531b2607e6b820d03363c1
SHA1 21260f69d6a3cf446ccede9e5ef35f13b40ac29c
SHA512 523f6ec0a637ccea09513268ac6a6f7a9c498970a3194c24107e98c12019a672fe5b757b4006ff3da06128d11e45fbe4206a69966b211ea5526472e54cc1fc05
SSDEEP 24576:T3rd9CHKy7GZdBMvjRA+iqMIjmJ8c+hE:zrd9CHKyamv1PiqMymJ/+hE
TLSH
T18175DF90B3E414E8F1B39A35CD764512CAB67C5A1B31DA8F13A8265A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 56b844a71709a6c8ccf1e50bfe6b2c2efa4b55eda8e44773f6a898ac67d26fa5
MD5 2dd12b79d2bdaf7379cdfebfdd34968f
SHA1 a18df736f1f1a2e292c8f62cfade553f68af4d4b
SHA512 43e035b2928ffdc2f86402a4d632fddd7188e7fab4c9c8df50616aba0ebc61b727c29f5b69c081c3bedaf88ec88d84cf08d532301b36d500a9ef6cc5ecbbdf9d
SSDEEP 12288:korGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:kRBMvjRA+iqMIjmJ8c+hE
TLSH
T17A45233A00AD0F86FE323B3CA9D75392C285AC7EF651A203B61A719B573D1E4284DA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 c9bb50c36ef9e121097f9410688917072b181b397599f53a14e37395efb1f736
MD5 054110cd1b3742a4628a1aa651c2b707
SHA1 1f1cd42acefcb83fe71464845ef3820b814cb0a7
SHA512 a6616cd8f75e744a932d6dd035373fcd91522fb821aae1305762e4025bc8b0d85d13e90d4cc49ec70696d14612e21405cccd057d48243008e99d54181f6bcf88
SSDEEP 12288:eKrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:ezBMvjRA+iqMIjmJ8c+hE
TLSH
T1F245233A00A90F96FF323B3C6DD75792C284FC7EF661A203761A719B573D5E02849A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 fac90f7669cb04dbfc955db454e58a68dc4c232103d622670db983c74d08a4e5
MD5 969ac74eb30502372dc138a7a6d556b9
SHA1 3707efff90315bafb60ad18fd15b54878322f444
SHA512 1778d6d877703f6fb34401212cde17168aa737c109e399417c61628c5c4f195139ab2af6e9b0f3c19ca6ccfc527990536667e7b7402ffb26799580a3fc9c6123
SSDEEP 12288:dVrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:dsBMvjRA+iqMIjmJ8c+hE
TLSH
T17045233A00AD0F86FF322B3C99D71792C244FC7EF652A203761A719B573D5E4284DA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 63b5df1e67ea047a4abb3a6bf69c28d5aa57d4734008b8c04d916ce226201d26
MD5 c28bd06c4c833aad66527de1e7d6fd4c
SHA1 56a1bdf0ba5f303820ee5f464050ca2411af754c
SHA512 aa2031338cdf141f07cfb51118e56e8009ac27836b696f607d19cc929fd4f588d2ca87cfac76d1f5a020ecd65a5b61a6003f93d7ea976cad8f26d611336811fc
SSDEEP 12288:9jrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:9yBMvjRA+iqMIjmJ8c+hE
TLSH
T15F45233A00A90F86FF322B3C99D71792C284EC7EF651A203B61E719B573D5E4284DA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 2ae651f286135da149690cf32c08b2797817792bcb9d8aacfd61eeee1d2b725b
MD5 5ba5153ebd356013c5957159be6abc55
SHA1 d7a77697a54ef5e910798825a101227e943162b9
SHA512 4d1cf4b19072c5f81a465cbdc79f2bf2dbd8690a0c8a284cab731975291a30fbf0cb78bb44a788897d86f417289f9f8eafc215b2d1748260923d63a7e9c4da90
SSDEEP 12288:rorGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:rRBMvjRA+iqMIjmJ8c+hE
TLSH
T13145233A00A90F86FE323B3C99D75392C285EC7EF651A203761E719B573D1E4284DA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 d195495bcee244676363e709671707115975d0f92d79d0aa8464dc69e569a620
MD5 186a5e65f911ad796905555de8f8b1b7
SHA1 a3c311e4ea083cdecb380c4946beb3032126acfe
SHA512 caaff238d6ecbb11d787c553fd854d3d81fc9ae34d81dc2c58c60f4bca908400d330b110e46cd15f8f0aeaf867d6276311c97f3ce2d9ecbe5219af91302bbb09
SSDEEP 24576:Vfwvzk9RX6wkyAIGBMvjRA+iqMIjmJ8c+hE:sMnYI9v1PiqMymJ/+hE
TLSH
T1A485CF29EBDC04E5E177923C99B7460AF2B178691B31C2CF125A53AE0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 fe7bc9edfb3a39d100af8dcd4fcd09d425752a8647647d9500b117f750a3afa4
MD5 11e9a379b48cae5736e324ecffa72d20
SHA1 17ad8dd6e08cd148ca6ae907004236d14f89a991
SHA512 7fce95a08333ed45968d6c457c16e9a1149b3f5ad942359de6d88f341f89c45f7ee4a5365199beb2d3b1f784a7cb1993b30757a07fe780fedf6c93f3e5cc2240
SSDEEP 49152:sYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK04v1PiqMymJ/+q:jySzPwtPiqk9+
TLSH
T1FF066C56A1A801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9cf662303813dac98c5e8c657e9add2b4ee94042974c386ad78f3d0aec270638
MD5 902529c8bca8bc0d23ef619cd2085fab
SHA1 29614fccd52b25c943a85cebbc7af4cf5ec92325
SHA512 51006d5b40e8dc39e7569d2903568a55918e8b0f234f49c309d6f5dee8a0459fe0b025b74e2127551bdbdca55e06b6a6508ef62a551a175fcfa4da6644c43225
SSDEEP 24576:547Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY/BMvjRA+iqMIjmJ8c+hE:547JUQjqirIhCnDHUPfF/ov1PiqMymJJ
TLSH
T13865AE1EA3EC01E5E1BA927885154A5AEA71742E1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 0a2ad23f2a19e620ec589388897af386fdaa35b0b40993dc24ec6d16a7cf8854
MD5 b4aeaaf42bbffe362f35c1dc8bee9f15
SHA1 c44ba0f1c3d46843993e8fb41af14a72abac005e
SHA512 02d095913cfaadff5fcc6627193a1060a0e8b9754412c873d0fcbee4004ee6c1415ca52dde5330261204d0bd4b3d348d261b7eba98f8be5fcd95368e4557fe02
SSDEEP 12288:zpsfzrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:0CBMvjRA+iqMIjmJ8c+hE
TLSH
T17055F11AC29802D8D56E6239CB964641F3637C2993E1D3CB62D0F57E1F3A6D05DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 c01f8126773806e4ab330561c59432c71b71755db0a8bdd1909ec93460683444
MD5 93f5ba1fd011d2f4a7721be13ce5f5d3
SHA1 7d5b66c20e75e8bfde76af31f10a3158c538b723
SHA512 9a6f0636e9f8c524894d19a4aaffd94c530143d518906886f6fea7c16e99ab0d4776dd46f5bbc5d78996f44abedf7cfb7d352b285915a1c39ca6c687ef9a3c9f
SSDEEP 12288:HUBzAU3fqwZOXgqWwHLZE41aBCu+m0mGpi6/O:HUBMUP14QqjS4aJ+m1Gpi6
TLSH
T1C8352850766AC75FC6AD40321E32D2CCA7707D51EE05AB0372C8873FD576669BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 223aedb7d706b032e2fca4cca019fceb80958acfe0390f7cecbe1c74600667e0
MD5 544243b376878420ddd4dfbb9a8bf941
SHA1 3b848ceeee47b20110beb1eeadf97b49bc574685
SHA512 985f9cbbc71a7848382d350abb06f26f58f879a3629f3f9d6c3e320684773ee462ec1d10c0ccc8198efa80ec10649b8fb0c25f0f01ee4e7a969a3cd702222440
SSDEEP 6144:LKKXaExHQGIah1ta85T0RPtMxvTLth7+CIzstaBkJfhDaKlVRPtMxhpbRK1mdp:LKK7QGIah1Blzl8umb
TLSH
T17455B7816137E38FD5FB6032072A5B4C67A4EC06B7056F6677C94939D82BB25B0B83C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 178B
SHA256 93903d7c5d709b75596b0f1d5a1be3e6fa0740436c0de13fd57819faf6b19da5
MD5 26d4c0ee937db1a577eea0faf14a4014
SHA1 8ca8b4c28fdf4317861f65bfb35177a83b94d45c
SHA512 b1009fe0c8a0c3512b18c5fafbd628c63acedbcee06d4c4744a3585ed53a7c6bf8eefe04782ab9f0500db7f8b755227f8a85ae33c549c8873319ea36180e3dae
TLSH
T1DBC0128301BF50092FB7208DAD022FD220827910CB628A20B2306BD6B9A64221B5BC2C
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a66e28ee41068f22f11c033dd2502396cd830d177ff46e70bf63f3a86bb5512e
MD5 a7c66003d857ac2721701541a3515543
SHA1 db59b9408b1476e8fa4ca6f4e85ade421530954a
SHA512 0923a2b0dbbaf8091a8ecd0dc136a1fe597b09af98381a5b771af665c62f22285cb15047f3b10dc1788feb8004d1be0f822870b2daee862dd24fd139d344145a
SSDEEP 12288:eM77rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:baBMvjRA+iqMIjmJ8c+hE
TLSH
T14545233601AC0E46FE723B3859DB9322D249FD7DBB10E183B50A72DB56395D06C69B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5abf1be7929729fe00099e639a8848d14c8ae7a1808eadafdbfe142c273d5264
MD5 bb0e7c93bbec2a3631badcb78f82cdf3
SHA1 1430f066c9cd34c9513b1ac2440c6e6ba89f39b6
SHA512 a2e8e6e1c8e17c189a116dad110d2e305dd8c2a39b56a72f95effd46b4c16f9d5be5681842053c73bd651ac96b12ad666c660241d5cbe224e8d12ccb366c4ed2
SSDEEP 24576:Agb6bmBIi49WNNFpg1rSvFv7bYUBMvjRA+iqMIjmJ8c+hE:Agb4mBIBhGF6v1PiqMymJ/+hE
TLSH
T11B65AE1E22EC02F5E0F6E2B8DDAA4417D6B278161731D2CF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 fa28267acbddb46c16926fea3bac738b94efef80a164f6ae02bd7a580e0ad4bb
MD5 234704870a519520dd142293f585a50f
SHA1 70d50339448e645f9027637d98b2b8f091141332
SHA512 01ead4fb6b63ca913cfb314d1015f29658aad20c24d5f478b0388b3b5d71702dfca275d4bde696e64cff57d6df13e445ef9deb8bd4397badcb95284a5634bd47
SSDEEP 24576:yG88u8FpJqH1vzria7/mPBMvjRA+iqMIjmJ8c+hE:p7ZFPqVya7/bv1PiqMymJ/+hE
TLSH
T1A685F12566E102F1D477D13889864663F6B2B8251360EBDF07AC8B561F23AE50B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 b4a063a9514ec88b586c0359db5ba36828956e76a5f454b022f858928dd6bd94
MD5 1276b6ee493096a4af9fd42d343985af
SHA1 f954085ee5da0cee8744df440bb684cd9361f7c6
SHA512 a73c08e56b3acdc6e8d4921472b869a901fb42e063485bc350d07bcb51c7ff6f5f94d60be48c92ebe2e3bee52f12e53ca8f3322d37ebd27135d9a6233f7170a7
SSDEEP 12288:0HvUrBFrEjwaQCrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:0PUr+NQbBMvjRA+iqMIjmJ8c+hE
TLSH
T1E765E12F21AC1CE5E676A17C89868719E771B8661712D2CF02A1817F4F27EE87C3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 392baebdbd5943fae1c7a09d9c3b511dfe1632cc80a4fbdc38a8180bc9f0311c
MD5 7f4a767362cfeca150e3f38feace8636
SHA1 bca7be507946ce04d081cba83b7ac187660e7fa9
SHA512 60c03f3211a94b83d54d9dababbecefd708c0393270b9dfe3d7f52193e5d8861a7545f09640bd717e8994050e42279a412fc182ee0c2abddce2a5eb389efc4fc
SSDEEP 49152:tBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj2v1PiqMymJ/+hE:2G05lO43bFtPiqk9+
TLSH
T136D5CF6E62EC01F9D1BBD17CD9C6460BEBB23825033556CB02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7ad5f642a72cdb423faf882e52b9ad936762532e3ff1c027ff6b44c5f8768f62
MD5 5f067ecea0596bbd1714e30e508da8fd
SHA1 5cc1f207ec0eebb30400951983199289c5052696
SHA512 d1b87cdf5a839dd3a8be8a0544acd2a4d4ad8dcb429485a519442203660a4098a8d2eb89080c8164c2282937e02dce1fc4862f63f871117fc9d63734327ed40d
SSDEEP 24576:ufa5POZ3dpyWVM50JicR2hG0lasx2+47eidn1BMvjRA+iqMIjmJ8c+hE:2a5POZ3lJt2pasx2+mOv1PiqMymJ/+hE
TLSH
T1D865BF5EA2FC01D5E579D17CC583461AF5B1342653329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d188afae253aa8bbc3b4e8923b2311f0474102cca9f43ae7c87946f0aefd7ce3
MD5 a0ffc519810b4fc73ce303c754eab52c
SHA1 cebda0b0f540cfaa8e509625ded4e9d346740694
SHA512 5feba74e382dcaa0143b91883b88d159106bc13171456b35a05192c403f1c928186970f51c9ca1cff7e5c2015bdcfd2622c4d16a27c32b8a81ee67c342bcb26d
SSDEEP 24576:bNcwHdjbyQ4nLC18lb/EOjowL7Fk3BMvjRA+iqMIjmJ8c+hE:bNc/zEOVHF7v1PiqMymJ/+hE
TLSH
T1B7857C2622E901E4F5B7E1BE89779646FA717869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b8db6c9fc614d00fde588beb90d44df8d86dace8baf5cf499ee5d7069b68d124
MD5 f8feb926e889a89e2e9f2fb14ecb4876
SHA1 dcafed150030cd4fb1509f42e7e18bbe624ebb6c
SHA512 b167d80a5fee0a7c76e3c1e605432e92e6fcc98d6a1b9baebf0d24a55f954042dd73909d207af6a018f4981a3ac0312fb0be38f78d8c4dbf18c4108c26549640
SSDEEP 24576:lzkNvNnaFeYhJNtmZBmHBMvjRA+iqMIjmJ8c+hE:lzMwBtOmyv1PiqMymJ/+hE
TLSH
T17B55AF2EB6F806E4E1FAC6B5CD238512E6727461173293CB5290C13F4E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 00b68a4861d218b7a04d88aeb29ffee794f76bc066dbf2d78ade8c368eea2327
MD5 0547f099ddf57962a83d8f3f315fa03b
SHA1 46b437ebb129168740118b538bacde09990810af
SHA512 6bcedbbb22518186c144acc5bb4ac7bc8d44b358843f067cc62fee029d7dd66d66642b179f04b49b8af7ac2b50d83412729cc909222005fc8cbc0a1d427749c8
SSDEEP 24576:FD3FHshBIYQgAOBMvjRA+iqMIjmJ8c+hE:FDVHeBIAA1v1PiqMymJ/+hE
TLSH
T12375E13DE69C04E4E57BD17CDA638606E37178AD032266CB129491BA5F2BEE43D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
Size 1.3MB
SHA256 02dd8e6e37b1ce16a2a1ab8d4565bd3f2f19e11c247efafae84837204797a7b4
MD5 bb5c911c43bfc1f756b8ab1165912338
SHA1 58c122c6ae554374a9f49086375112d9c9d8fcd6
SHA512 ad6f498d96bf3e920ce00e3f141b18c91dc720e060f0fcafe4a2a080aaa7083ceb1ed4501a5dc3b353e800b279c77b7fda8b2e3ec9c1fbac2de5fa21815a18bb
SSDEEP 24576:bwuCOWtBMvjRA+iqMIjmJ8c+hEUBMvjRA+iqMIjmJ8c+hE:bwBO1v1PiqMymJ/+hEzv1PiqMymJ/+hE
TLSH
T18955121A22A80CF9EA73563C8997C632E3F2BC153621D71F2760D69B5F372616D1DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
Size 805KB
SHA256 4b0ebdeee1af514810a31e4e7b540f269fa05bf409ef09ecfb5634b1af7c5657
MD5 f39bb42c7258d14358fad3e11579f3c9
SHA1 6c64b0832f50eb64d623c2ee77a39255b05161b6
SHA512 e47b6aa0114769b1277596ad4c240d1b40d06a9ddb5c977f3910a8068965e3af9d3087a8b28a9980aad2d4493afcc963061aa4d1ae2ae4088a9ac49dfe77d523
SSDEEP 12288:Rmw5HEjsChNVBFgl0WDm+CnrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8Y:MwukOWtBMvjRA+iqMIjmJ8c+hE
TLSH
T12005F11A32A80CF9E96356388597C236E7F2BC163A21D71F1760C65B5F37361AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/524-179-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/524-389-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/524-186-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/524-180-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/524-393-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/524-391-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1084-174-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1084-406-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1084-388-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1084-167-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1084-408-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1084-168-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1308-394-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1308-223-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1308-222-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1308-229-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1568-39-0x0000000001BD0000-0x0000000001C30000-memory.dmp

Download

memory/1568-117-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1568-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1568-45-0x0000000001BD0000-0x0000000001C30000-memory.dmp

Download

memory/1568-54-0x0000000001BD0000-0x0000000001C30000-memory.dmp

Download

memory/2428-14-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2428-198-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2428-22-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2428-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2684-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2684-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2684-221-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2684-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2708-145-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2708-121-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2708-359-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2708-123-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3348-157-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3348-163-0x0000000000810000-0x0000000000877000-memory.dmp

Download

memory/3348-376-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3348-158-0x0000000000810000-0x0000000000877000-memory.dmp

Download

memory/3384-53-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/3384-0-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/3384-8-0x0000000002680000-0x00000000026E7000-memory.dmp

Download

memory/3384-1-0x0000000002680000-0x00000000026E7000-memory.dmp

Download

memory/3680-205-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3680-206-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3680-212-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3680-216-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3680-214-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5684-200-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5684-199-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5684-192-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5684-390-0x0000000140000000-0x000000014027D000-memory.dmp

Download