d90a3d895385a4983ad5f538ef0499f9f62c38a7a44d2b1056d8fc9b1c93a69d

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 13:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 1.3MB
Sample260804-qpyt7a1gnb
SHA256 d90a3d895385a4983ad5f538ef0499f9f62c38a7a44d2b1056d8fc9b1c93a69d
MD5 f86c8a3885ae3516823672e13e98afe7
SHA1 10fb6805ac12223bd99095c902ed0a0e84b22da6
SHA512 be8c4d36d3c1f6b546dd3ee6d53a94637204a9b2a9d482c4553ba2045558f25497f747d330e1d1eb9231fb5a5a7e877231750d6599291e56474ab7a8351b7a55
SSDEEP 24576:mwfLrvi4cRIyDe3SUNaXy+WypoGHUnQ/tbw/2Mkjy6Fr7g0oH:F+i3DsX1WHJQ/lFTjN4
TLSH
T1E455121030D5CC77F4EB21B3843186746ABA2E817F0A295B7FC4766EE2771B6DAB1244
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3392	elevation_service.exe
5128	elevation_service.exe
572	maintenanceservice.exe
4632	OSE.EXE
2188	PerceptionSimulationService.exe
908	perfhost.exe
1228	ReFsDedupSvc.exe
3972	SensorDataService.exe
1392	ssh-agent.exe
5544	AgentService.exe
4616	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File created	C:\Windows\SysWOW64\OpenAL32.new	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File created	C:\Windows\system32\wrap_oal.new	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWOW64\tmp1744.tmp	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWOW64\tmpFDB0.tmp	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ab51af58e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWOW64\tmp1745.tmp	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWOW64\tmpFDA0.tmp	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File created	C:\Windows\SysWOW64\wrap_oal.new	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File created	C:\Windows\system32\OpenAL32.new	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c3c9fef41424dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a85637f51424dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008feb78f51424dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000005bb2fef81424dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002f468ff41424dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b280c421524dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3392	elevation_service.exe
3392	elevation_service.exe
3392	elevation_service.exe
3392	elevation_service.exe
3392	elevation_service.exe
3392	elevation_service.exe
3392	elevation_service.exe
5128	elevation_service.exe
5128	elevation_service.exe
5128	elevation_service.exe
5128	elevation_service.exe
5128	elevation_service.exe
5128	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4580	2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeAssignPrimaryTokenPrivilege	5544	AgentService.exe
Token: SeBackupPrivilege	1228	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1228	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1228	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1228	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1228	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1228	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1228	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1228	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1228	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1228	ReFsDedupSvc.exe
Token: 33	4616	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4616	SearchIndexer.exe
Token: SeDebugPrivilege	3392	elevation_service.exe
Token: SeDebugPrivilege	5128	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 4900	4616	SearchIndexer.exe	99
PID 4616 wrote to memory of 4920	4616	SearchIndexer.exe	100
PID 4616 wrote to memory of 3112	4616	SearchIndexer.exe	101
PID 4616 wrote to memory of 4488	4616	SearchIndexer.exe	102
PID 4616 wrote to memory of 4964	4616	SearchIndexer.exe	104
PID 4616 wrote to memory of 1604	4616	SearchIndexer.exe	105
PID 4616 wrote to memory of 1920	4616	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4580

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5128

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:572

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4632

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2188

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:908

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1228

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3972

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1392

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5544

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4900
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4920
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2812 2824 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3112
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4488
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4964
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1604
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2812 2824 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 91a4c20ade384113157366157e37bfa5f299a556e19798dbe97cf629bf9b0f6f
MD5 d864558043861167ff97e7637bfccd50
SHA1 de721b5eb47f754a85046396c4792083df7e49eb
SHA512 6fb6fd4c7436195c567724e0e0c4d4a2d4c692b0f5984e3d4c90d8ad98eb9d95f1424988725cb2091c1b36865754d9b274d44fb8b284f3dc99b1e42e9846aa57
SSDEEP 49152:Bb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnsQ/lFTjN4:H3q6HjBELm
TLSH
T15ED58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 9e781660e70b512678eb40d04ddb94577b198cf05c16b796bf7317f843b24f84
MD5 9d0d98a5da141dae77efc67e0f4b73f9
SHA1 27ca5221313d18061c26ade8454efa0732985a31
SHA512 22d7a025b369978f903a08d4ed754168319b691c41352f4346f2b9098f86655c8e6715a25b2645f69497e18be6d0c4e878c05f0a210e62c234db1fe32c0a18f5
SSDEEP 12288:j1XLsswWkxy2lRq2czADGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:5XYfDtczAznQ/tbw/2Mkjy6Fr7g0oV
TLSH
T14D65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 e994cbe23cb5c97317cfe2fd65f05d94f1265fa4e6a9c03393d39a82b786fd13
MD5 7122a592043e6025c4ad3dd42d7c7a24
SHA1 aa481aeeddfc09640cbc7208a731f24bedd3c1e9
SHA512 d478ac6030ec39fe7b22cd52efa95d7456ef4fafae5243f2e26a727f40e79c33b9ef519bc378b69651d3f18aac1096769c50fa41b3e7cadb2643cb7a91218ba8
SSDEEP 24576:d0Le5ji0hmxLrM0nQ/tbw/2Mkjy6Fr7g0oA:dPji0AlpQ/lFTjN4
TLSH
T1FD859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 47ef0a39afa0e02acb2af0730ccf6edd9665b74db5f09568c40e83da90a8fa52
MD5 d25e5570ee706cd4d869bacd9048ad27
SHA1 4e729a6e8392966c9c20339131b4381a3b66530c
SHA512 c49cd58777845e563516d9c76debd28f69125b7bc8a873347d604419f073d460c62021a66523d0b8f257eeebc75a447e4f7583b32d02bc0a229c9b1b479c9093
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWE6q8wyu+nQ/tbw/2Mkjy6Fr7g0ov:1/ezSC6vUzPvxHjyNQ/lFTjN4
TLSH
T166755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a00868e07fbc0898e909cb30b7b18aea4c705af5c42c307bba6b65be1b242235
MD5 7e8925d10e4f9c1cfda8efcd44c51af7
SHA1 a24bb03af57f070164e4fce676e71e8a188d9b68
SHA512 14282a434629960aa0209e1435f55a1ee2cd580d6ea01c6aeba9e8564a06b29ed2e849fe4c2bea6357a6be171a297941882d6270931ac7b3ce6277fe7c5b287a
SSDEEP 24576:HVbqPb88hv/l+6fnQ/tbw/2Mkjy6Fr7g0o8:HVO88hXl+IQ/lFTjN4
TLSH
T170559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 34693183abe2b53bb7f3e1502cf8db18d8df88891f52bd623ff42b2572be3cc5
MD5 63630d9b1b3500743c06d43ad4ddb4ac
SHA1 2dd95391dd9dee2cb6c689d00976021d12d4ea17
SHA512 d424a0a28bc1b7b7bf15e7f5a19840818af693497dbf1bca3cdb32bffdd28c97fb6d1d7f6189764b85b9c0d9fe49c8b78465f0d695a2ffb9f20eaac96ebb4b3c
SSDEEP 12288:yzgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:yzAnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T12E5523796A14F89BFF2B06B15C8284826B7B0EC1BFD4A74E7B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 05d038b3ad7bb4b95996315cf89032dedb12a72538ba60c5aeab06e0401e33e4
MD5 3fc48dc72a8dc5d0104e14bcca5388e4
SHA1 7889bfda26790cef6797ab78487402ebb1ed2467
SHA512 32aa6c5e57b4a4f64b2c09937458ecab1d8c5ffbf406d3c2ed0144c41632e1544d9454f0a8a8d9f602a3ff487c74a9f4dacf475a32239be23425f022afcf1538
SSDEEP 12288:0eBNUbTVO86UnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6S:0JIUHnQ/tbw/2Mkjy6Fr7g0o6S
TLSH
T15175CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 382de7915e706d56a65a049eed84dacf4ccff2c9b682300a238a0d0d33ffea67
MD5 4d7a82c7dca2459187cc1f459e4fdc50
SHA1 95abe438fedf234cd395b3f48f0576aa4e4caad3
SHA512 b2fcd9cddb4691cd679687964fbab3fc8a20f4bc6ee212ec9eeefd06b891fb09c768dd0eb250a7d012b6a5f55a7906b3f8e99927f279ab097beabd9f21dd0719
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THH:ZQvGAdlCEL8c/yRNw5CpLm
TLSH
T190267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 83215bd9dea040624f12b16723cdae663c22d6afbfcdfe856f8f3c97e7beee09
MD5 d4ec588eb3b5ef694abd94441db0f37e
SHA1 61c87a628d664cb3e245e33d242b238beb633b96
SHA512 5adf7e0fc7e5256720998dd7dd3e6dbd01c5bfbc1001272d3f869aaa0ab82d7384cc1223a4703f269a61e9967343e96b2f950ed1afd1b0bf2fc329f90d359af8
SSDEEP 12288:HAwSfxL/2Dc39DLLmt0LDQewsAjpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgs:gQewsAj5nQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1F775E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b346174381d16e8cc21221f191d4bc798da96de06eb12ac206d533a0684feb97
MD5 59fe874bc5b7dfd1ae46656678cc9e83
SHA1 66f15ffc6b84b261d53e2ee342f7efa9bfef717a
SHA512 c04a0dd5b8e8ee001ab2826c934fc73dfff17ed3284ce0514c7811327bca6ee42c658ef1ee3bf157f8a0de8167b69eddd27cabefd1a865e972eecf08ef5f9054
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHWL:0UEtQevvqc2W1cpV2EI32
TLSH
T1C4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8e734269704ff59a39c817068afc9ce205093decdd31730c9ef49ca05a453c15
MD5 08ab804d4d0bbb1e77a13e353dc2b7d0
SHA1 0b951c9d0205bf545e82a194e8848aea66c341a0
SHA512 6e37c701b7ec861efb11af9e16c2e9a1cb08981e63ed9580ea6c0cb8fa58b52b6224f36d11184ac0603a8fffbf328296e5feba464a0ae9dfc3bfa4ecba39dcd3
SSDEEP 49152:DCbRquA/m2yL5zQfFiV+XenmE3/zZQ/lFTjN4:8oqtVjnmdLm
TLSH
T176D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b84573b96f51bf4adf15013c6dbe65520770e943f5b9ce3d4814649d31f0c2a3
MD5 c75aec6f1ed1e0c83b65ce77f09683bf
SHA1 a98b37aa7ba5142cff4a189e23d4e66e11b25a44
SHA512 74bf657c961552bbbf45d80a3c3870ba1051ae1078a1f1533dc88b4073e9b4e226f971a01f5b47530c69ad5912843213ba8c87ea137d4ce744c88ce3f3dedb82
SSDEEP 24576:nAhGLJIFoiwtA5l7S53ynQ/tbw/2Mkjy6Fr7g0oE:nAMyFoiq5iQ/lFTjN4
TLSH
T17F35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 3b595640a2814b771f9df3b745b1d5f87fe9504149d23184ea53ec5b484c38a8
MD5 c0786648df88ef975a2b4fb58667e57b
SHA1 0a47d5c9b2bd52d2700a57180c80ad139195c614
SHA512 b8fd3197cab508f526fa853f31b3e112505fabe72106cfe66beaf8214aa26095cf1a466331ebee9767334f12a10046b9cc1bc6f7a0bd3e249eb5f1a0634e4eb4
SSDEEP 12288:dmw5HEjsChN2BFgl0WDm+CeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMv:YwuHOWtnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T17865F14A36A45CF9EA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b52ea5cf1110840099f37af123183d2eb3a7bddb85941db0615b20f850a271e2
MD5 ae788a791233d2b28d051dce46855786
SHA1 3edd70da64ac2354576045ec8a1f9286c954d97e
SHA512 5db3c3ba53238ba5a01c7684106249e8503d2a8a32531225686e6e8304bcabdb381b43990176e812478aea856948f3b28d666a006cabaacca24bb1ac8a1c9bc8
SSDEEP 12288:9XZ1Iy5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:tZu8nQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1BC55126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d0d6d544d3bc3fa8cf6022b7ec4998b1e12b1b6e8fdc6bedc24d8b3d3ced9e57
MD5 d694b46b533ad9902e65706dd6fa5b85
SHA1 053932fca7ddbd6d058ac1818e73ed9fe7dced6b
SHA512 12f11f9b17c9c711ff87a38ba962b15c09bd877da12805086e450f8982637f419c8501cf1025a908cd47f4597fe9226bed49df9e2ed8da4582ee261c900c3864
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ur:FQRQyi36YOcPQLvw2gAf+PN3wLm
TLSH
T112667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a4ea85262f17e07804cd7d23171a235d4e56af10f644324e623ce23622a23064
MD5 93145330b6d07e1d0a5d746c546f85f2
SHA1 2038c8808fae1a65076324ddc6938f0f51c1e0b9
SHA512 59d0cdf03040f8d2fde2f448273c7b25169c2c99fac3013108250d1b3fdfdec79533e97387f886fdad70ae14303b94d6709ce96470cd21f668f86145b733a2df
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ur:vQRQyi36YOcPQLvw2gAf+PN3wLm
TLSH
T1ED667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e1ddf869524c5b0f8f5616d99dafe9021905c557fefe273ee5ba117ef5fb8bda
MD5 325ad99b2ed89c6c5f15cc6038ea2eac
SHA1 8146f571ab82e43207ba7d357b96e6c176cfdce3
SHA512 83f2baad28a4360933f8be30247ee46c80b91fa2a1db8451e167f8b5c5946410a94b2c87fe0048392356d436849ac7ec91f7445c1a9d9352e048e05e20293b87
SSDEEP 24576:AwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0snQ/tbw/2Mkjy6I:m68Qg55nhheWu7PNU3/pQ/lFTjN4
TLSH
T1D2B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6588f7c4ea02e95c1e98c1d2e992c45194b02ea74e94f3c862be54f555615757
MD5 a314c3547af134756254e1f9df980196
SHA1 ee07150c86dadfc345feb825b0c3b1ea56d3da66
SHA512 46f09ecbb5488af2be3724edd80778c057a920c3afa88a4e7569f4faf2ebec5c89019092222c2f51a3bf492be22f92a1fa465f1a075c3b4083ce8262818cd740
SSDEEP 49152:L3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk995:Oy5112gYy5azzVvL69nLKnhZTLm
TLSH
T19C167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 37ec49599b097526088b6a163926ef603a7065f098cb12d1f14e5968448762f1
MD5 70d10a8fcac161006a916230c0d3f2fb
SHA1 55df2083037bb4436453d9564eacaa72de0c7129
SHA512 f0b9ef18bf033ea32235a53d410699513a32d01fcd9265da318af57eb6d73a508cf684584d9d87a6930a4d5b0a268bb57131120e61f25b7f2367ba9e14e0b572
SSDEEP 49152:mB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gljQ/lFTjN4:Uu6JmVxd2dILm
TLSH
T189D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f57a5b1a96196f8dc3fcf9f1f1fa9e5cba769f3ca82cf447b772a9f27983fec8
MD5 8948b08455a31a3f2330c9af39e6d0ae
SHA1 960e076dd0b2433b8fa64b4089f49cf85661209e
SHA512 78b5f5c003c015e955bac3d00964e1ea93f395ddee2a61119a3db0e475f75455125832af77f4f91af8ed5ba2beda416b531269b1203470f66686206cb640c363
SSDEEP 49152:01hpsNoJpF1A6UU44CwH7R4xnQ/lFTjN4:0mifPbRdLm
TLSH
T13CB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 888fd8b6e29efeb10fda7297081404e4000bf15b11b1914072d64a98cf66fb35
MD5 1abb9def8888756be41eadfea7db4012
SHA1 f14370c2018c1e1fa07be40d8e7c84eee4c4e314
SHA512 11c2cf4206eb707085f9204521f8ed36777621fc45388b9149d3236192ec040ecb52ad2da1947c02556be16c8f46b194ccd878f04afca930007227b701add772
SSDEEP 49152:ZSuZQIY0Be2KRRVtOnks6NMHq8Q/lFTjN4:35dKTi61fLm
TLSH
T1ABC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e072a5cd9817bb9e1dec3d4b16c10f4666ec9ccee3cae6e98b718e84b5d1c04b
MD5 1d1db0040911c24b5a4ce9fa8fa7ab58
SHA1 303ea707e07bc50d9e1f959121c52099396e05b8
SHA512 9f75e435457f17db3bd2433ccebd15f6283e8ebad56374a45bce4a6e7ec75994710c2f22c63bed98b3a437c27862fd594792bdcd996040aabc464626eb5582fd
SSDEEP 49152:OhtSn8EApI0figngiDn0AP5wzQ/lFTjN4:PX2iyphRLm
TLSH
T1F795BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 307374b3852141353ff5c3e73947c44cc27635921a286e3c67b9badc62dfaf79
MD5 45746e3961c59bc1ee9f59d6c8008e52
SHA1 572b5fe86ad660f2b71ebab22f303065776a130b
SHA512 896af9df5d442392d86fed433458145fb688a978dd25e51fd78d1967026733450c90f9f517db5d2934f6b9c11ceac972938a7adb33646de87ef68e8e1442ac51
SSDEEP 12288:OIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:OInQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1455523697964F98BFA1706F18C828182A73F0EC6BFD1938F77482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8742c8fc6aaa8d36688adbb1bce5d0e04118b47b2ecd9c5704dfcec23dbff090
MD5 69b08666dba31f94252c13a95f11ad33
SHA1 60b180af386b27f23453f1788df0ee0ede8757fb
SHA512 b8fef54a7b290cdbe0a480a9df1903c3a0925af4f38d13b54aec779374815c7f69f09429ed7861aadb21d17e05f554b90e58c4d4e99dcd3a4a4bfe06118389d2
SSDEEP 12288:vFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:vlnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1595523797965F98BFA1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 eb4fa507e3364e35ea9d5ab2da95bc9e0d1522a85c02bfb4769f64a309ed53df
MD5 da902c1775fc0a94987f9fe0de1cb870
SHA1 6ede9bec4f1eea66b75d3515dc9e38f525fd2907
SHA512 ab30fa60f2e5dc4a61d0a26da1f9fdc97411058c57584dd0ccae17ea485ff9d4c5189d24d713d70a8efba2014f9700bd8cde78b2530d021fa356a3d53d67afd3
SSDEEP 12288:3vGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:3PnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1735523697925F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 02a5bca8a3927468570e253824967c96a87cbfc8cc139ea457fa10f46209624a
MD5 07baf7b3684077ad7edb57862860c8f8
SHA1 f4da2a7d264689d7d39b32fca06f2c9f03d4e1c1
SHA512 df2761d59c2a0d4aaa05a28b0bbc7dd44674714c11daf303bbe6b2e75b269d629e0696a37136935bca01054cbcf0ea0a6cb634edc53b575318743731ce42e851
SSDEEP 12288:SVSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:NnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1915523693B69F4C7F92742B4CC938142E77B3DC5BBA1A38F6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 32bd7a4c6b4957f0604d6533c598da7ee16b8c30ac367b229e6d50c678810450
MD5 7dba0e55f58d8647d9776c67aa2a8567
SHA1 7e77c0188eb6ccd2e787e26b631f1e11415086e8
SHA512 15a9a67442c0a46d602233d501b86b5de0c4e3c47a89d89d8305df35ec3cf32f7173a9e4a2660f03ae513729e96737c301b1571495152384434e199a36fd1427
SSDEEP 12288:yqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:yqnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1925523697925F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c7b2c5b66c1c16f2c5e55a56dfcd00c6977b879e81ad8c096b6d5f576e5fcdb1
MD5 b42288f0ae7562a231e89b731e4f348c
SHA1 63f8357cd976ebedb51a4c4ce8f3f15aa5dc59d9
SHA512 a5ea22d1b3643fc8ece032751cfe0199198d9abf34d091fde98ab4846e55f8d0e0431a3210e06ad938eb01b8563afc529698f6ca1870be106f28b7c454db3841
SSDEEP 12288:uxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:uBnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1615523797964F98BFB2706F14C828182973B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0d8a211da2f408e0eb886d5dba4daa4ea1042a9a39faa2a2bac163fe4c3d9a6b
MD5 a2b610a48bb3c68dfbd58c39a7996903
SHA1 675bedfe8c7a859d2dbdcd16f198d33a53f77404
SHA512 3eeb437baf11f29dfa079c2c8e5b534b76a80e06cce31f107430790f9ea09b1a044bcb942051a0092f035463511f854efc04393e829a41d507f8cbc65edad091
SSDEEP 12288:o9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:odnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1105523797965F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 b768cabc48f08f8abe42d0c2ae123d0c83bb43918ee52734f2e7ceba58f82419
MD5 f1d97e0067fddd3b2c80eb0be13c1c32
SHA1 1ddcda7bcb58584c8c29f49d83f95bdbfcc8e249
SHA512 7984ed34bfaa454a14f00320f57f43f7b52b8b689047310f59e0b416beb8b9c3e048826ce923c046912f88a0cd4ab644a1a6a49c2dd44cc4657d0163b70f383f
SSDEEP 12288:1iZwbDzzFEoS2cPvylGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:4ZM3zFVSOFnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1067501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 36a93064826c1381f4dbbc85c146a7b68eb7b1f8381cb0505e6c96ed314d299b
MD5 420ebcacc3fa40c5ea7d61ac055bb619
SHA1 4c61b200fd768020ebda08726170c660c71b75d2
SHA512 305f3a0e0616894bcfe626127ec247db415949624773e79f15b2bc53ecf2a0e075b23a4b8efb8014bea2320d80671b50aa6e55096b05edd17e984cb495809f61
SSDEEP 12288:RMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:RMnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1C35523697964F98BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0421df14127b7bb217b0ff3a8bd7d83ff8fc286a93f38494fe8e4fa7ba8fb430
MD5 8771bea65949e9336b85748aa80e518c
SHA1 eb059b315aea37383657dc32ff29fdf01f5b2e35
SHA512 bb532ad5fb6bdace9f32bd109412d66f8db8e50a7b534f5b23c77aaff464648ec7198d87d182371d822992985cbe6b420012b6ecb00ee2a5ef5a72e56edda134
SSDEEP 12288:VwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:VQnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1045523697964F98BFA1706F14C8281869B3F0EC6BFD1A38F7B4C1129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 e99e6757b2b9d63775866bdc07b0d894eb3a72ae9cbf3d547bebcc261b553cd2
MD5 39fa3069775bd244eb66c35435fd1544
SHA1 f27e1331514aa225225004f6699f8a114d353519
SHA512 b445477969721b6ed87903f39feced6d2073a71afa8447665766ae4d6303474a933b6528ebda26837aba79caaf9423392714e010c12473ce46783fd937ee8eb7
SSDEEP 12288:oyPz5L85GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:pzyJnQ/tbw/2Mkjy6Fr7g0or
TLSH
T14C65021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 81c098a52cb1c3c90749f5a30adc179f6c2aa3b8038b6d2c7c03a188b9e46bd0
MD5 463049f104625076518bdc4b0ab98d19
SHA1 7e6933b081e32cbda686a70c8be903fae685c535
SHA512 a167303b3a2fab5aeb5dcb11e596be873cfd700a204dc905a5d6502cbdaf74a3d23523216a614940498f30fd7f0decf72a642e5693b5dbf93fb2c2a9f4b03b32
SSDEEP 12288:ZMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:ZMnQ/tbw/2Mkjy6Fr7g0od
TLSH
T1505523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 889d0f5a3afed8cb8526925725edb9a9eb7edab28148bede2532e1ba534895a3
MD5 eab4175e7825e9d5a387498753bb323f
SHA1 e03ed4f027acafc9b18855d4c5169fa920a453cc
SHA512 c2dc57e8a931b1fc22cb81aca0dab1f41315cfe1ec9c5693c599b009935e77953e401edf9588c3219e9654a4a248cc2e5fb1437c1147c3711ad9399bccc3ab56
SSDEEP 12288:sMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:sMnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1B25523697964F98BFA1706F54C8281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 fead0d6330039ac6ebf19e8d7f69ad3ae6b36320d1b786d6c47b32d702e5ef76
MD5 a6bfdc0f1402a4b65727d0cdd8780794
SHA1 52446be22dccb8e8d4e71b6883fbbe174758fb46
SHA512 2de2303764d5842ac09e3c5c71e730c52e5b8da2f8cfa868d79289aca29dcf0485a6cd48542a5da253b573f81c409cd691bcaf9b79c9c0639a296b520da6a215
SSDEEP 12288:EyPz5L85GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:dzyJnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T15A65021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 a5057ba036360e7751a1d7b1a1f5ab1974fa65bb3be024ca0befffd4ed6dad13
MD5 c8fb22ca418d650fea7b4816b73b8beb
SHA1 0154ebea8d793733f8eafec40363390ea6e46530
SHA512 7d30a6ad55bccffebad06dd59689e638745d7a4c47dc072aded9732a8dfd6385f9469637bf3642e20281ca5ae804f6275de097bc3b749109772c71475b6641e1
SSDEEP 24576:uT0aLl3z0zD/nQ/tbw/2Mkjy6Fr7g0ov:uTDLlj+Q/lFTjN4
TLSH
T1F57501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 acdb9607fec55e4f59b6ae20827b9250c55496ee885d8b0c3370426b74a4424c
MD5 e097b0b2d3353e80846a951c02de396d
SHA1 ce8fa601eda3e9d2f26eeaeda90fadf9fd687af3
SHA512 af7c9b8b9fdd1b2b38e7f97fbdd3358127663029e1d8518920b2f5423f2a1a3397a4adb26904fb8441cd8ab872f897770de019b8e05467d2c9982337ba2def0d
SSDEEP 24576:X31d9CHKy7GZbnQ/tbw/2Mkjy6Fr7g0o1:n1d9CHKyaRQ/lFTjN4
TLSH
T16385CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 4c5bdceb45b64770d435d952727295cb3471048d880811b7a98e4fd5926a16f4
MD5 e336ccaa53a958ad0df0c772953460c9
SHA1 68655f2f67b5b30b04a03ff473c6115c7c741418
SHA512 8ac6f9a9306f9ed6e04566dd1be80e0d0f841d7b18e36c9a3f7ec447c5dc831fbfc1b2da5ac734e3a8091c13b271389c687db9eb31433709a0ff48f5fce88359
SSDEEP 12288:QPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:QvnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1E35523697925F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 2a372974bbc15d55abf72b1343021760e13f64f560340bf4da115a368c07ac94
MD5 208ff1cd363eb82c0b61882db59355d6
SHA1 3f4568dad726f820af05364407c0ad83ea2077c6
SHA512 937e0442c4039da382dbec1ffacd76bc914681d3500044be1753076ef132799a94359c2f86c5c2751b2a9faa0a640b2e50cd52ea6016d6c33346b6b10d3addae
SSDEEP 12288:DZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:DpnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T11E5523787964F99BFA2B06F14C838182973B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 ae050ebff6b9bb48f2a1b29ea20d5c84489e9f4b2b2241b5f78aa0bb9ee928a2
MD5 27a3ad55f28de0acf5ba7bab517e0de8
SHA1 885109b5a2bc9b5f5c3e26439355eceb0c71498c
SHA512 be113762974be51589f9cb80a598a5aca7b423b6de237e7f8f64791d8ba4a70cd81bb24a9e1991577722dffb1b4747eed6f788d31cd3854c3226c67a317757bc
SSDEEP 12288:i2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:iWnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1995523797924F98BFA1706F54C8281829B7B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 c2dee5a1925e98944bbcfa36f94136acb9b0a44f5e4eaaaabdfcf95022ead860
MD5 9f3414d0fdeaec3c79fd4c8e2f9b99a7
SHA1 e4a01f4f5739d055304f90a5900ac8763fab9d09
SHA512 15ece4779bade837615a0cff7588a2018ff73f3d61d20e027ef6993c20697d9e42600fecb5b61b3ab6a5ccaad8e5b927c7c2742236812393b70dee1365e0b156
SSDEEP 12288:GMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:GMnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1115523697924F98BFA1706F5488281829B7B0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 7cc6a7a036025e559e9c188178c24d56c80c1428394d0aab2d18b848c0783ef5
MD5 282af1cc9224d1eaf8e451016e237c90
SHA1 0560b3c78fb694737eb59a283ac42bd3683df38d
SHA512 1272ed5f7c95ed281fb2cc46ad45893815ab62b6d813a023cd1b024dfc76e66933433144aa7b65b0780c5ae3a3069d0e61dc96d452649481bde70195c45a96e4
SSDEEP 12288:pPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:pvnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1AF5523697925F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 500305e1e5c5ef2e917bc1a45c4084892fb6d76ff2ff7b50d3428e6a9bdb1a62
MD5 083b0f78f20950b072cd216526d8ced6
SHA1 61c5f2808033de34fa0c4538239cf1ef9171941e
SHA512 e260c3be4986923b5766c453eafb9471557433b36b1dc372c0d166bf4b5fd784386a3fc408e8aa7de7c3ed21f9659794915fcf81b3592599c8a0ef427841fd65
SSDEEP 12288:LEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:LknQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1345523797964F98BFA1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 6f67d6769a0c5a8daf6b6c25e31f54d909e7bb27782ce9b290d4b6f2c713e9c4
MD5 644bb5c01024379373da4be203637feb
SHA1 3cc6291f4334486e2257e801681e5d71d5c3cd04
SHA512 335ceca45e3f463fd7ebde320f81ea4d6817e19fe6da115a3f3e41039e8caa8ed0972a6b94a44f2ff4b19a7c7d5dfded1361885f9743330506b13abe98d4df62
SSDEEP 12288:iqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:iqnQ/tbw/2Mkjy6Fr7g0on
TLSH
T10A5523697925F98BFA1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 962a0146a343dc6cea4ae1bc2d358a980e427208ba50526973c0d919db065541
MD5 1288d645ef35086bae6a054856db564e
SHA1 2f0162a0d2cea5139ad0b66144745333ef4524c4
SHA512 5eb710e52b957e602f57c51bf4e39c4745044aaac744548bd648d5281693bb4f9033146b4a6915aad4abe040b7496665a2214231e75fde29d7ad1b708e28fce9
SSDEEP 12288:Q3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:QXnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1425523697925F98BFA1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 156dcfd82c576c012bed63e36590e7e06aecb451e713845180a5bb13c649a984
MD5 87ae6ddc776688419600747646b1d540
SHA1 2865c5f715cdc5d3bbce0b6974ea81e1274f21ef
SHA512 84234f40578bac1cf8887a16e779dd4e4d6722f295c1bb42f96e18d7332ec34466aff0103cac70d83b05783d10a20012b93b02271e98be622dbe1185f0d6d26c
SSDEEP 24576:tfwv/k9RX6wkyAIgnQ/tbw/2Mkjy6Fr7g0oF:cMnYIgQ/lFTjN4
TLSH
T1D685DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c4e38d558e090793f142632e5f183efd6920b06d0d4522c94577ce6470e7abc4
MD5 9213a5f9be1c9f957cf5aafc67e7f060
SHA1 2c34e832b62dbd97876c452bf29b279755b68eb8
SHA512 4391b4d2af9032a8582501081371b31f95604bbe1de771e2c9b82889c0e71b01296cae10ab039925b13f03bdb6491bd5abd5b1d47038f904a0807b259401e97f
SSDEEP 49152:8YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0TQ/lFTjN4:iySzPQLm
TLSH
T123066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 bddb7a50c73d7c3ba23ee658d3ba69f68a2f54a0ac61cb810a27fb0a3970f19a
MD5 bff4979fba1d9f09a6012291928308aa
SHA1 2cf5417eded9b20ba9e61dd8749460806c5161a6
SHA512 4e188dd548a807a873124f6863045f4b6e2542b8badead9d3539359ee430f843fb8c5588e558a99e07a4bf3cc6ebae6bf59272a1e45d4c99d7e0cd97180ec60f
SSDEEP 24576:J47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYVnQ/tbw/2Mkjy6Fr7g0oH:J47JUQj1irIhCnDHUPfF/jQ/lFTjN4
TLSH
T1F565AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 ad84cba184912a2b15e4489ca3f61317ec07cddfe81760618c17204ffdae9361
MD5 40579810c230b93c11442cc89b2f3d40
SHA1 00b25164e05eeef3c9e9f2e4e0097b2d6677c354
SHA512 71aba018a2ce13919097dcd2e7269df1f5f5e78b6b64d1873c15868e7fb661e451ef70591b8aedaa3c2b0f0e8e594d07669a6a07d0a7445a54e6d8a2220e720a
SSDEEP 12288:Gssf8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:g8nQ/tbw/2Mkjy6Fr7g0oL
TLSH
T10D65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 845cf55f3b47d33fea7c4b5ec75a0c889b9ea13ef6a684c7272fa8b7b714ee26
MD5 bec4c1bba92aafa902fa52003dec0ef9
SHA1 54fec892635b836900fc4d04ad4da8ea156c6444
SHA512 c005233e74b36d3cfd9e24d46929109c26ed6a4e1d4104ac0374bd80f76bc0cb9c4d77ee26b2572bfa4eb1089c03bed773aca8d48dfafff03327d328ed61440e
SSDEEP 12288:X4AdSU3fR5NeItG64fORGV+CsBMUIbA71yKZvka:X4AwUPbBtqVzsBMDbeycvk
TLSH
T1A0552841762AD68FC6A940321E36D6CCA770BD01FE05AF0773C9873F9476668B6F5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 e8c7ad194c510aa54a5470dad4bb1c4afe87f5a901d26755b07c592f7742ab97
MD5 b918a589aa691a15b9fe9e3e3c83dfd2
SHA1 e861bb2c1ff1680125aa55869b1e264498581069
SHA512 9e3b38e043622c7f51700f638bedcc5973709bd11cb91b4a465a788dde91e2efffbfbf8750990c5eeff862731d38409dd6755b9be83e1aa386f5fabd54a50ac0
SSDEEP 12288:a/t9A6qfXzngobTf9sSjrWlAigjZRJkz/PG01QGfyrm:a/tyT/LfnjHigjZRCz/+uQoyS
TLSH
T19C553B01A5A7E35FC9FE50374232C6CDAB789C02BB453B0573448E38986797EB5E2792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenAL32.dll

Path C:\Windows\SysWOW64\OpenAL32.dll
Size 106KB
SHA256 1797d150a2e23af4f390f5c33eb598c6f58d0454011d74941f5316add900bbdd
MD5 235355a8dd26903e75d5e812ecf50e53
SHA1 8316319341a0f9054e19e4a7b21df3dc49386fee
SHA512 5beb9343028790f993d0acb1007fd112b7e2ef6f9fbedfdb62b0140d2bbadf3b6368417ea19edb0bc8674d19418e5784fef4430ce1c329de8e83c304706d39ac
SSDEEP 1536:xYf99QAGcIq+pNocP6YI60qlW+kNvsy/mSvIfttnuQm6A41NbApkh:Hq+pKcPdUqWsyRIfttnu/y1Zk+
TLSH
T1B4B36C51FF824032E0C58E3D81A5CB969BBF19137F9254CBDF7419C85AA03D80A7A7E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b6ee9b094a322589c0634356cc55765643daaa7ab96d2080528737dd268bf780
MD5 8efbcfa98031dadd2f6a206b64b7b558
SHA1 6fd7d323a752881e161e5a417f11adb2f920bbe5
SHA512 da69a270d1f89db3f5829a0477297ef7274d72dd08030db3a6ee9eae31f597cc2fc4723846620aa39fb39f6e41403cef0d3cf2d7dc065d30591358a0b5eb65b1
SSDEEP 12288:6670GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:dUnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1985523756668F94BFA3B06B048928111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrap_oal.new

Path C:\Windows\SysWOW64\wrap_oal.new
Size 434KB
SHA256 a4e46e6d09c4b0966824a2f6628ebf738e813672692a52a0d63d982e1030ef4f
MD5 d494267bc169604fac5e3679b9a97fed
SHA1 c093ce5a4f7dc40f7f604945bd1facfb2c805c4b
SHA512 7cfcfb570ecfa974054b5285c7d6ad3bccf502866ea70789750c3748394cb0991d1fa6dec9c50a506dbc697953663ec2605277a4451098bb8cd6699c4e506040
SSDEEP 6144:0AswvHbkHO2Qc7h3Ckr6A6u35n4boFnugPoHy5AObO5rvbykp:0A9qNyin35n4WugPoEc9ykp
TLSH
T116949E01E591C0F3C4AA48785873975A6B790F6113B9E9F3FFF03C9A9E602E4553624E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2415b40ed22c74e093fbfba3bc8bcf9da702acee0dddf9fdaee9724e95a5beb8
MD5 66fe8a56adce85dd9eec47765a7a482e
SHA1 8cb1e20264e5dbd17e9309bfd39c09fdcd040ac7
SHA512 9521f210026b399fba7886db178aa82363e1bab8edc0857985f31e5f9ea4e8ca1c7e809d7c41d218f04aafffffe18d80488d3d0a6c9992a630123eed7316e9cb
SSDEEP 24576:Pgb6bmBIi49WNNFpg1rSvFv7bY+nQ/tbw/2Mkjy6Fr7g0o/:Pgb4mBIBhGFVQ/lFTjN4
TLSH
T17865AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenAL32.new

Path C:\Windows\System32\OpenAL32.new
Size 120KB
SHA256 87802322c8e63555c26fe473ce234ce7099745ccb28c02766c2224c726454039
MD5 2ad7b4f3c8d2bb686d231edff404b7a4
SHA1 f29676b96d04bd2765925a3834d9babfdce6a0b3
SHA512 51a6c8cfe30e34c37437e6c5f8c602aa0759b65559a82521e2dbcf8a9865b826077854acb6497df6085d67b4c66083ae5f0f192b743a4b6f77ce7b18f01bf528
SSDEEP 3072:mQG3kfDcDKLIjVUl4ZjxNP7ZOqCA48gstZLsFusbdLakZ:ejsxlUVZ7ZOPstm1YkZ
TLSH
T1C9C36BE2715510F9D4EFA378C9A20682D37278249B21A3CF676081562F63BD8BFBD714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 3379fde99db12f96e635a8c051ca55b5862d92a99638df15781b805403f2bcf1
MD5 9acaf28dc5acdd87ede17ab5bf49fa93
SHA1 4360dbe2236a9878e248fe2c6af822d15e98d94b
SHA512 93a237012918e2b71496ff687a31e3c45452fb2fe1445c9ff7dcdb52fdfbcac30c1e4e11b42eefe3a2a5e0e17acdf2afccf9075e88c44aa02b18a2872c498320
SSDEEP 24576:0G88u8FpJqH1Qzria7/mFnQ/tbw/2Mkjy6Fr7g0oL:H7ZFPqVva7/2Q/lFTjN4
TLSH
T1E485F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 170aa3b871bcc0b9e3a98b938a788efc456b2a8d790fd53049c5dd8bfba62ee7
MD5 168aa507a1d932679a1b2720884801bd
SHA1 2e564eae4b833731189e05530ca6b5655c579e85
SHA512 e75903dc1b1a5e991bdb26d2ad28599eb8d8334c3f9df7d747c61fe942d7edc3a6dbd62fc68451d9e2b065c012d9b016e700f29dd29127d541213a2779ae0399
SSDEEP 49152:kBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjBQ/lFTjN4:HG05lO43b7Lm
TLSH
T14DD5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cc6f6e7f19609a0ed03e82065c6f11f4b7021a379b6f3f614083d93b0913cabf
MD5 f2e68b1cf9f9bf99b2e1875e3101ad0f
SHA1 72c4e22cb88bca2a045f890a3757fc9e7bbfd7fe
SHA512 2ef5d04db6b4f9fb2c45a2f6dff57ca377c21dce21cf5b937c4749650b3d38e445285f54ce5fc655214472e0f39e2fc63f5a2053d6e56c47031233401b343ed3
SSDEEP 24576:Efa5POZ3dpFWVM50JicR2hG0lasx2+47eidnTnQ/tbw/2Mkjy6Fr7g0oo:ca5POZ3+Jt2pasx2+mpQ/lFTjN4
TLSH
T13065AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4a9a91d443cf53fe1ae608c88f7156055cb9267fa274edfdf273d154b42f0383
MD5 b56a5f8177c14740103d097d9b1275b1
SHA1 3369e180e6dd37382cdb2450a5e8369bcba30aab
SHA512 b75d766588ea560a778ecaab2a4f16a58d40f15c0e2f23c1ae2bde0f7d7ed63c5a04d97b7f1001901424fcf084f34ddadb87fc4b162c9556ff50885da8a3bca7
SSDEEP 24576:ZNcwHdjbyQ4nLC18lb/EOjowL7FkNnQ/tbw/2Mkjy6Fr7g0on:ZNc/zEOVHFWQ/lFTjN4
TLSH
T1BF858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrap_oal.new

Path C:\Windows\System32\wrap_oal.new
Size 455KB
SHA256 5379373cf3eff41cdd8c912c65e27e1bd492bd84238d19a093aa846c9b1ce909
MD5 549347bcd4aacd63243d78e8f869dbb1
SHA1 efc00d2a7c5acfe17b8a58023826e6840aef39a6
SHA512 c6789376d05deb8c5050225c37c023055c107a72b49afddfd3f91e7e7429d38db9346e2e5d38986c2000c3828389cfbe5d74d80423a79eebd0367bcc81137cd5
SSDEEP 6144:ING0FBd3thlYIhSJyYvb3ahwNDx/+IJcaxjCz0G5suFrtxZO+jTyWQqlMfhGy6We:ILVkoWTNV/Qz0vWtxRHQqlM/kb
TLSH
T153A47C91E19184FAD1ABE1349A52AA17F7397C440B3847CB43B0A8711BE3BE469FF354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6f1a0459c25cb9f83abb717da39caad1663bbe751d5045aaa44792fa276d6a1f
MD5 820ef0438f2e438e4c8003b9f6a1f746
SHA1 fc0419acb84ca2fb7904f043446672d783b3dc90
SHA512 a4e89ca5e48b9520b5f634c547f87280b31f7311d0ab8714b4e8bdbd8e6c29d49b7faaa4e5dc735924fa2c9a2d325e95f7ec7e84a899c7098b325d55fbbbb045
SSDEEP 24576:38kNvNnaFeYhJNtmZBmXnQ/tbw/2Mkjy6Fr7g0oO:38MwBtOmXQ/lFTjN4
TLSH
T1CF55AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 57036670dd51737393a822d0e70db615c498d3b851b19e4f530475aa133a29e1
MD5 d2f0254315638882d649f693c6d1ad53
SHA1 4611b098b057f033c48e7578a7c903e1000b139a
SHA512 bcf0ddd06fdca5485e7b41c4458e301e5e248598ef783fe5239261cc6cef5d571840650aa8568def3593800814e204f3fb9abeafdbffacbbaddea64ac9c72bc3
SSDEEP 12288:0HvUrBFrEjwaQBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:0PUr+NQRnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1E265E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 f39933d923c9c8bccda483b50a3f26abca17d24422e467d203e43877a8ecf312
MD5 533ed433ffcdcf0496f91e6d4bb8ed71
SHA1 8b98d68f3dcee44ed3fb77bc22b7955abc9bf415
SHA512 ac0eadf26f91b40b06b2d7b8956f9814ff2aba32173c2c47ec613088332fa7800d9fb6342b91018d04b0b2c89a9a37c78b2a9b009bafa41c8530ffbba1b14aa1
SSDEEP 24576:wD3FHshBIYQgAonQ/tbw/2Mkjy6Fr7g0oz:wDVHeBIAAoQ/lFTjN4
TLSH
T14275E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/572-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/572-50-0x0000000001ED0000-0x0000000001F30000-memory.dmp

Download

memory/572-39-0x0000000001ED0000-0x0000000001F30000-memory.dmp

Download

memory/572-47-0x0000000001ED0000-0x0000000001F30000-memory.dmp

Download

memory/572-52-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/908-79-0x0000000000930000-0x0000000000996000-memory.dmp

Download

memory/908-310-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/908-84-0x0000000000930000-0x0000000000996000-memory.dmp

Download

memory/908-78-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1228-423-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1228-89-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1228-95-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1228-425-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1228-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1228-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1392-115-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1392-121-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1392-329-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1392-113-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2188-67-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2188-73-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2188-65-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2188-295-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3392-22-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/3392-14-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/3392-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3392-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3972-108-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3972-332-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3972-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3972-102-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3972-328-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3972-330-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4488-414-0x000002C10A810000-0x000002C10A9DA000-memory.dmp

Download

memory/4488-428-0x000002C10A810000-0x000002C10A9DA000-memory.dmp

Download

memory/4580-7-0x0000000002440000-0x00000000024A6000-memory.dmp

Download

memory/4580-363-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/4580-77-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/4580-0-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/4580-1-0x0000000002440000-0x00000000024A6000-memory.dmp

Download

memory/4580-6-0x0000000002440000-0x00000000024A6000-memory.dmp

Download

memory/4616-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4616-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4616-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4616-333-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4632-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4632-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4632-278-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4632-54-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5128-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5128-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5128-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5128-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5128-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5544-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5544-138-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5544-133-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5544-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download