fe746cb4d827dd7be85181e81806a1a85bffddc1d7de81e210ee0224bf2c2e8e

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_c8dcf38227905e0cf9440d5a0f975beb_amadey_elex_rhadamanthys_stealc_stop.exe
Size 1.6MB
Sample260804-rhv1dsgl5w
SHA256 fe746cb4d827dd7be85181e81806a1a85bffddc1d7de81e210ee0224bf2c2e8e
MD5 c8dcf38227905e0cf9440d5a0f975beb
SHA1 90f143c4f58c5dfa958f442b326b961a10768201
SHA512 e0a2c21045d1a7699f2c6cb4ce93fb2d05da806a7d40ab31884ccc317f65cc6c7075272e836ee036cdf0063ba0b217210c03df6ffde7f536b5a99beb7764d3a4
SSDEEP 24576:TLv5qMr1nD//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:H5qMjLNiXicJFFRGNzj3
TLSH
T11E75E01077D08036F5B324764A7E8669956DBD715F2181CFB3C02A2E9E70BD1EA31B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3644	elevation_service.exe
1872	elevation_service.exe
5668	maintenanceservice.exe
788	OSE.EXE
5492	PerceptionSimulationService.exe
4500	perfhost.exe
2692	ReFsDedupSvc.exe
5524	SensorDataService.exe
936	ssh-agent.exe
2768	AgentService.exe
5332	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_c8dcf38227905e0cf9440d5a0f975beb_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e117b29b238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_c8dcf38227905e0cf9440d5a0f975beb_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_c8dcf38227905e0cf9440d5a0f975beb_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_c8dcf38227905e0cf9440d5a0f975beb_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_c8dcf38227905e0cf9440d5a0f975beb_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_c8dcf38227905e0cf9440d5a0f975beb_amadey_elex_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000144eed491b24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf656f8b1b24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe2c1a4a1b24dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c0c3b4b1b24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db846f4c1b24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4936	2026-08-04_c8dcf38227905e0cf9440d5a0f975beb_amadey_elex_rhadamanthys_stealc_stop.exe
4936	2026-08-04_c8dcf38227905e0cf9440d5a0f975beb_amadey_elex_rhadamanthys_stealc_stop.exe
4936	2026-08-04_c8dcf38227905e0cf9440d5a0f975beb_amadey_elex_rhadamanthys_stealc_stop.exe
4936	2026-08-04_c8dcf38227905e0cf9440d5a0f975beb_amadey_elex_rhadamanthys_stealc_stop.exe
4936	2026-08-04_c8dcf38227905e0cf9440d5a0f975beb_amadey_elex_rhadamanthys_stealc_stop.exe
4936	2026-08-04_c8dcf38227905e0cf9440d5a0f975beb_amadey_elex_rhadamanthys_stealc_stop.exe
4936	2026-08-04_c8dcf38227905e0cf9440d5a0f975beb_amadey_elex_rhadamanthys_stealc_stop.exe
4936	2026-08-04_c8dcf38227905e0cf9440d5a0f975beb_amadey_elex_rhadamanthys_stealc_stop.exe
4936	2026-08-04_c8dcf38227905e0cf9440d5a0f975beb_amadey_elex_rhadamanthys_stealc_stop.exe
4936	2026-08-04_c8dcf38227905e0cf9440d5a0f975beb_amadey_elex_rhadamanthys_stealc_stop.exe
3644	elevation_service.exe
3644	elevation_service.exe
3644	elevation_service.exe
3644	elevation_service.exe
3644	elevation_service.exe
3644	elevation_service.exe
3644	elevation_service.exe
1872	elevation_service.exe
1872	elevation_service.exe
1872	elevation_service.exe
1872	elevation_service.exe
1872	elevation_service.exe
1872	elevation_service.exe
1872	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
832	Process not Found
832	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4936	2026-08-04_c8dcf38227905e0cf9440d5a0f975beb_amadey_elex_rhadamanthys_stealc_stop.exe
Token: SeTakeOwnershipPrivilege	3644	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	2768	AgentService.exe
Token: SeBackupPrivilege	2692	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2692	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2692	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2692	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2692	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2692	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2692	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2692	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2692	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2692	ReFsDedupSvc.exe
Token: 33	5332	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5332	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5332	SearchIndexer.exe
Token: SeDebugPrivilege	3644	elevation_service.exe
Token: SeDebugPrivilege	1872	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3652	AdobeARM.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 3652	4936	2026-08-04_c8dcf38227905e0cf9440d5a0f975beb_amadey_elex_rhadamanthys_stealc_stop.exe	91
PID 5332 wrote to memory of 1520	5332	SearchIndexer.exe	103
PID 5332 wrote to memory of 5632	5332	SearchIndexer.exe	104
PID 5332 wrote to memory of 1232	5332	SearchIndexer.exe	105
PID 5332 wrote to memory of 4728	5332	SearchIndexer.exe	106
PID 5332 wrote to memory of 3124	5332	SearchIndexer.exe	110
PID 5332 wrote to memory of 2464	5332	SearchIndexer.exe	111
PID 5332 wrote to memory of 1888	5332	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-04_c8dcf38227905e0cf9440d5a0f975beb_amadey_elex_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_c8dcf38227905e0cf9440d5a0f975beb_amadey_elex_rhadamanthys_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3652

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1872

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5668

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:788

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5492

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4500

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2692

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5524

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:936

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2768

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5332
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1520
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5632
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1232
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4728
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3124
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2464
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1c0a3a53640d6dd203abe7559664802fca0e2f1183a05f3f3c03397db93d53f0
MD5 123b0e73183280bec52918b036906740
SHA1 0c8ab75174f493d59f698f9ec353fd4ffabf6114
SHA512 9cc3ca315e1538a462d0f46c1c80ff9da50ebca29c378ed5849b89d3d1f9aa515428e3c84d8410f22643d3c30fad521488ef96dcf1e6e5519772d9ac54706607
SSDEEP 49152:5b+632BuPkFKRrdE6ohdstBhuXjfS4LWxn/LNiXicJFFRGNzj3:P3q6mjBQ7wRGpj3
TLSH
T103D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 f238f589ec7baddef8778c476b92894f6363aee61177f5d5cabbee3e35bbfbee
MD5 790d921d1dbfd862c313e1e4d6d6b2c8
SHA1 2e3de35f0513298eafdc7290892cb0d571219f16
SHA512 c9992d891dd9baf99f4c1db4164219b3b667e7808cbd9669b02063f7a5b91b0ef6582d01c0d0613db811ce9818a6f89590f5944b9b3cc4f6559bcf8575bc45c3
SSDEEP 24576:PXYfDtczA2r/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6tcNLNiXicJFFRGNzj3
TLSH
T19775012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 b7449741eb7789f2bff52ce802d4d08955161b855473c2bc60796b63b4d758f0
MD5 5797afc43404d967d981e3780b925d16
SHA1 aee9ab6d2622bfea8dcc78503e0d185ca61ae1e8
SHA512 cc6afbcb3abadf96789ffea8652a1de670c9a45766365ac2b52caf53dd55538d3bb3cc6868325596e14a0f845bdb873b4670a9405a51185b79e2b10e75d67216
SSDEEP 24576:V0Le5ji0hmxhrMz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VPji0AziLNiXicJFFRGNzj3
TLSH
T1F0859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 80a53d16d013f63c73f4b70bb5d1989b35967209494768a1fdef99505f78c9c8
MD5 235941c41750e80b6082bd7756a3eedd
SHA1 f90d2ca3ef10cc1647bddc86b345f554b5c2ea45
SHA512 4dfc487fdc82dcf4c973c6b7abc63b927fe032f409abc76c35d8e9846e1056c924bdf518cd40accb86406b796681661f279018598d563b5ad689572bcfacc569
SSDEEP 24576:ta7/ezSC6vUyD/aqgrvWj6q8wyuZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:k/ezSC6vUzPv+Hjy2LNiXicJFFRGNzj3
TLSH
T1EE756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e539ee460d75d3c41e947cff5d35f1d35a6dfe63d2fe73e637d93e13a9af2fb6
MD5 ab8c005441f136ab9878ed71828bc1af
SHA1 4e9a8bdef2dbb774b706337cfdc1a665ac1948b1
SHA512 d96d5604886d104aba914cd2c7d0f268c986ef674ea83318f0d5ac010e20c37cbba49b45840c644032b5679a32a7344d566e9f386a64a8041a6f2cf4d75ba21a
SSDEEP 24576:jVbqPb88hv/l+Bk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jVO88hXl+CLNiXicJFFRGNzj3
TLSH
T14E559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 3342264aef500ccb1e3f7b792b653b1edeb2ee7584fb2bbf97842ed232d646d5
MD5 21ac2e795fe6a9409c3de149da9162a0
SHA1 01239192d3e48b9338ace89b52832154115ba232
SHA512 eed634fba9bc632ee75fd4f45ca4db620c3795d6a888131b29508ead92389b454edf173568cf88d63ac348771d58287eead69d1db0e6c4e96785e59794de3ede
SSDEEP 24576:vGf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qLNiXicJFFRGNzj3
TLSH
T1415523D3468854B1FBFD003A867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 41cb310777f034ebcc734318198c8c6167f8859da063ea64218c90eb7150ef04
MD5 5e5206917de662ccd80d1193de0fbd3e
SHA1 94a8cbb0d0c16f2898dfb52306c78c35c8785d92
SHA512 0cf4d9de5293922e62b9946f942647cd04a3c7f615409e58caf224513cfa391b3279ebf5047eb2233b48c956d7ced15d7a362163b7238476316d74ef0d43f29a
SSDEEP 24576:yJIUs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yJIUsLNiXicJFFRGNzj3
TLSH
T15775CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e66adb5fcc4fa8790aedf56a9cc93d3aa630c4e6f020a30d8710d6f380cc9367
MD5 bc7223c990b4a8ebe0f95a8a7ba140b1
SHA1 84201c0c7cdc0bc09183e95e5e3611a66dfdaa7f
SHA512 deec462a8da2066d45b3d461c45144de6be545187c5bbf8cab9466d04ebf27ffc9da05c849747d3fbcc844277ccd70244eace1a6ccf3458cd38f2891cd9f5c72
SSDEEP 49152:AQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THC:AQvGAdlCEL8c/WRNw5Cp7wRGpj3
TLSH
T1C1266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 6dd25a5d4c79d26d79167f53619e1c330db2dd3b6147882b882d3c59f5c53ed2
MD5 e7465476dc562a6c985e0b131d05e024
SHA1 470f692db45bb038840fc3d43c154e8f913b0380
SHA512 f4e4d211fe42fa1bcfb1143977cdef7d49e3d7144b3b4a66a8e3406dd2891a3edeca3f26d36ff33678247f4668488c367c9ccc7adaf89613aae98911e458d9e4
SSDEEP 24576:ZfewsAjy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FljyLNiXicJFFRGNzj3
TLSH
T11A75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 51376601608f3a9333b317e2d39afafd64bbf0ce7cb50da1855690be6f2a45d4
MD5 c96d7eae65197e578ddc4b46c270946d
SHA1 b8348f70bccc1e153aa57096062728c3fd1f9bdd
SHA512 b7c4badd28ea800d170c0405208a65e541d3e24760cb033e0c611eb4b3cd07ee90122a28a756ff3d8b478e1a4711d8cefca6153100343e04d758dc96d07c8fd3
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH+F9:OUEtQevvqc2W1cpV20I32y9
TLSH
T153474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6e2ddb6301cc9a9dafcd8f294cbb0172395634c1948b058b5a6dfd59eb51b8bf
MD5 fd42ce9db0b6f8a988d34d783f62382b
SHA1 cb6885abcfe11a558eb5a9da0dabd4375191aa30
SHA512 e9d9dab5fd45a1c58661bc604453702a2cd7fc4121631569ecb6a6c5f34af96e24ec22b52fc3923be5737e5c1ec516dde71ee8b9fe57ed8815059bbbf223dc23
SSDEEP 49152:jCbRquA/m2yL5zLfFiV+XenmE3/zSLNiXicJFFRGNzj3:coq2VjnmN7wRGpj3
TLSH
T193D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e759c249a9d61f03cb2f3c1277efb0f6eb02d64e354f4debe633d22f21e84177
MD5 2df05f691fbd9f7317e3340d26f05a8a
SHA1 db01ac73a5f8deb198b6072a44675d72fd97dd31
SHA512 f7ac40639cf666da563a5e902e5ee61b0e1aae792e6ad0147a5d2f7c9659fab3f0da91bff1ff6583a4d3c883653fae7ae9fbe482c8cf0f42d5b49e148afde310
SSDEEP 24576:CAhGL6IFoiwtA5l7S53t/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CAM5Foiq5dLNiXicJFFRGNzj3
TLSH
T142359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 ff2fdf6b997409ce6550c470349fa493369b836bc74ebe2cebd2e92c68be6d10
MD5 bd65e4fcd67e30ad8ec722b20c3129e7
SHA1 064d527df9701c6388fab01adc695df9be94ff72
SHA512 679c461cfb4b73c66be6c035cb80dcb3604eb19ca96a8234915cfd95d56f25d148b5bcaeff8c3708c0b316d5fda23fc8ac1f456c11a52629a24944574802b0f6
SSDEEP 24576:PwuROWW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PwSOBLNiXicJFFRGNzj3
TLSH
T13365F18632940CF9EABA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5920b93e8de32a0cbda61d195ccf208001f5f2935d70496a6e5498be4ada8a9f
MD5 749709bb54cf93d959d6e2554f70c13a
SHA1 c6dba6859542ee2b716c5b331606d65a18094382
SHA512 6eb6c4c711ac3acce1e2d14a344fb48c6134f3e2f3dcca77bbb69560fcf0dfabe3b72d73511dc365bf81e5c781e5bd4c28351302104cc94881375ab4114819ec
SSDEEP 24576:bZu7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2LNiXicJFFRGNzj3
TLSH
T11055129622C820F5E2BB413DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 43644f289943799a1d67c60176316ec1d7a2f9696717d836587d9c999131d023
MD5 a55078a8bcc60b6ecd28fdb89abda800
SHA1 d3e85b6f56c88c0e46214f7cf30730b6c3018344
SHA512 9f159406adbb6d100fd3847f6f2128c2b50ad1dbcde8a38f1672f9f2cee6d2f26696f10a4b67c14763c454c7454daccd41724ba2f72984118928b04601727faf
SSDEEP 98304:uQRQyi36YOcPDLvw2gAf+PN3g7wRGpj3:1QyiKanX+PNMF9
TLSH
T12A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 66062ccf60338a99a38c2d938b1fbf07aa5f530cbcd6eac2106590993ca9530e
MD5 f1752bd6120cc86aed2c7032b0086e41
SHA1 5eb4144d1d826d8b554aadc3c7bf0017be917941
SHA512 5d7e514e8e3e7977e27cd2670c19c0614b65a8aa7f393f94cca4a96f0ac2727634d9c2e23ed6487a9cd731c7c64c28204cc3bd3d035e040f30601d4aeeadf6f7
SSDEEP 98304:WQRQyi36YOcPDLvw2gAf+PN3g7wRGpj3:dQyiKanX+PNMF9
TLSH
T111667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1c5fc2eb31b16a3ee0ccf6ca6acdce6ea0a0bbb6dd39adf7008118652d781119
MD5 08eb51c4b5bee2861866fdaacd9f0c57
SHA1 d5211b0c6805413f64d9f9ce83b6b3d6d1a24ca8
SHA512 bf3ca0b311e9abeab29e3873c9257c8ac781110c4f2e104603a55adae6d8f865cc93bfb7b411357ec05943cabbfeca74cc1fede8732669b4735a593fe0c62882
SSDEEP 49152:o68Qg55nhkeWu7PNU3/iLNiXicJFFRGNzj3:ythTRc/i7wRGpj3
TLSH
T1F3B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a4321deaf730aec52f3d073789a8494074c12f2d35831f0298e005a55cc31ad4
MD5 6d9c457ecdc00c30ec3527e3cceb56db
SHA1 1834d5a1608898fff0f7891e22c92c7b52d79dff
SHA512 7e30fa83bbc6c525b48a284a83b75b8f1dd5e49e5bc49e8f9ae5664bd74530e06878203555a231c941843db1899c056bdbdf7bc745bb827f0067191416bacb8a
SSDEEP 98304:Iy5112gYy5azzVvU69nLKnhZf7wRGpj3:hLIHRWhZF9
TLSH
T12A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9c0100de487a033cc7696ca43d1f58119f2b247db76c629d3897de805a0b9b20
MD5 84044a92ce17f1dd6a70db1e3773fb0c
SHA1 627fa48fb6cb403ea4eb44f88a5b895667df20d5
SHA512 ed63da71ffbda143e508ca28a6094e9d81dcf1c0cba68c10d22cde0f20da876ddee66e871a095184a04fa2db773b7d1903c372055e226b61ad4807c8135cbb34
SSDEEP 49152:DB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glkLNiXicJFFRGNzj3:1u6JmIxd2dk7wRGpj3
TLSH
T172D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0408a530ca8bae0ee8e240c194523d9c5ebf4164e2b76c36ba2404a96be69506
MD5 7b88bb66eeb2320ac43e2a479ffc9e49
SHA1 8292be2ba1ba8c07cb604e45e785e9ca743aba7c
SHA512 7459ba8a174b5946c47b6c0e94b2ddf729b49477e4780725e95eefaeafeadf2607611ae8d7795301240cfda23792d592600c2bbb10fff9f34363bc2dd195a17b
SSDEEP 49152:r1hpsNoJpF1A67U44CwH7R4xMLNiXicJFFRGNzj3:rmifPqRN7wRGpj3
TLSH
T1AEB5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4896ff62495e76b66ab72dd2f533eb8c2f74c253e5a386a9d99f981a27e1597a
MD5 4ee5ce3b04f5af3bb9d2fb0a9fe2dcc7
SHA1 6ad5b0727a3b325600e1e12b520053c9289d065f
SHA512 04f86a1a054325de06b4e657db082437669fb725e747df9ebe622b2ed135f4b1d7f977ca62c4d54de8a9e53f6362c1c776203cae71d7bb0ab2d11d9d0257f769
SSDEEP 49152:+SuZQIY0Be2KkRVtOnks6NMHq7LNiXicJFFRGNzj3:Q5dKqi6177wRGpj3
TLSH
T1EAC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 cd19bc227dff0b65969c79b80070c153c65e4eb36830d8478cdbb94a780f55b8
MD5 5196244603d5aae832c498c554570ecc
SHA1 bfe8fe42f0e9caaa776685d54ab51ef7224a5561
SHA512 40d0b5942ff9209b59420033f3b8ccd79775cd86ff83ca99b5c244e88381d9b390802b8583f77b546f9f4acd13741f59a6d784003c0fd5864abac9f19469d0b0
SSDEEP 49152:IhtSn8EApI0figjgiDn0AP5w4LNiXicJFFRGNzj3:ZX2iWphh7wRGpj3
TLSH
T1A795BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 607e3adfbf11def8daf17e5502a8fb133fd2ea7cbbce269151fa48d23b219d35
MD5 360d3f1b69771495f4c98ce38f2a642d
SHA1 9107862d0ccc8f4ccbe6257d9215b9c1e0362da7
SHA512 c79d5667e8b4bb676194d5ec3c28d3364fd97cf7f3dc1171fb37068c0348ed8c3515f6686106fc9ea3d58c12eb7847d8fe8f4f6b9b081d2de9245d4bcdf1189b
SSDEEP 12288:6ziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6H/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1235523D3548955B1FBFC003AC6755428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 905bd518c6f163e8b4df552e1060a59b6206c7c569726ebe4bf55eee007e95c7
MD5 9b4fb02eac4935a51bf8873e4d0419d7
SHA1 0c4eaa71660164e9ab45204d29a914b5a81288cc
SHA512 2d8c7ffeb204e4c876f87c00d5bf8b08c2a6cfc058163d76a3dab1815d1d392843d3a256906e91a710fd118217982c7167ef031b0686c4c6c1fa09c85e00f3e9
SSDEEP 12288:nEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1135523D3548955B1EABC0039C6755428F5882E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 0837f36df91d940e8c84f7c899476751e3209119c8f7c2b1a44d9df89c27f7fd
MD5 d043a930540df8de341085fe95e2ba48
SHA1 44147e26ffd5d6deb53a572954cc7b90e58d3ce1
SHA512 1e364cb66cf8fa90d87b89a2e8694c7411f8ba89ac8356d8a8c040cd7be29e0c996de1249779a8a4de2d6c04fc0a9b8099e31d2c87c79ed385c7895d89f04f24
SSDEEP 12288:kyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18A5523D2548955B1E6FC003AC6764428F5881E2DEB5619E3E2483D1EE27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 f9dee00e86b15926b352ab49dd72db51aba6276afcc8f7c3199d3ca71ab5a01f
MD5 ad76be5fddf64efb29e063f713527a87
SHA1 25f593ecc908b2a90c00382fd183de7510f542c1
SHA512 b7d5008b60749e69dcec32fb29723f3381ef123b39c83154f515b12cdca201f103826fce4497e8839a4a7d5b970c7933d558fb5c643ecff7b8e6ac01e4f47eb1
SSDEEP 12288:OVhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:S/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DF552392168900E1E9FD8039C6764424F2E47D6CD7365AEBD3003D1E5674FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 994c9faaf23330541f51cc07db666d41acba3c44053715366b18c7c7da1dbaf4
MD5 a8813c158c4da718fd4691659563dd39
SHA1 c9ae46ed25da325260e24ed27c7b050bff6719f4
SHA512 8f25bcc75c08046100bbbf805aef68bd4d60aa110bfb71aad7c7445c4b2364377457081eeb888c2ba89410663e638c2ee87a394867c7dda2c39f0161ef422b32
SSDEEP 12288:HZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:HF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A45523D3548955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5cf277a7cba005fa9358b6a4594ea2259206a0f8c935edb468b8bd68566357bd
MD5 6920bac49d4e98e8750a7c490aa87513
SHA1 96ffb3619e49ff684cdd1a99d030bb47d85834a8
SHA512 4ba4712d279170233be317fdf515dea50019d615f342569b7361ecf05126ef6b498301af6d3ae7d3cc137c530dd51649ac1d67617feb61919b15a9b400d7c8a0
SSDEEP 12288:xIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:x6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16D5523D3548955B1EABC0039C6754428F5882E2DEB5619E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 619e096a2922c00284b144c58b9dce6e83352a5fdfe21c7f6e41358a763d1301
MD5 bc53599ea66da74fddd544bbcf48fae4
SHA1 2d84a359f67dbc56775e49654dd172d6354d1c82
SHA512 d3537c54c1cb9acb2056f4618642612827fded990abb56f38722d34900ccfb27fb365ab167394d3b7fdfb62239958a3ced4ea6ff744a0e06a73f96cdc36bf3b4
SSDEEP 12288:J8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:JG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12F5523D3548955B1EBBC003986754428F5882E2DEB5659E3E2083D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 b63a55df371486f4435a1620028f34f880efb3a648b48fd778cf21165f871579
MD5 88976d2825a4ec2529585ef4aae469c1
SHA1 6b35e715fbe6fc8882cab98b1f18a4c56f839bc3
SHA512 68b02a502f2bcf90d254adc39e560a07d06a0bccb5949f7db2dc5377f14073a8098e9364b67e441449fae1c8bf9a88602c83a57a3bc3b2217aef53c50eb626d8
SSDEEP 24576:+ZM3zFVSOu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+ZM3zfKLNiXicJFFRGNzj3
TLSH
T159750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ad10caabad0076acd11f2e510324b952f99eedf02e146da681530ac64a4263b3
MD5 30628ea468639e06ab94debc44718c6a
SHA1 b4b995b32a56ceac7d32b66cb875bbab4548646a
SHA512 feac0b39c8fa768baa1b78e94f4d0a447167743bffff8a57ce79362d0a2cd237ebce0fb6c35f9c1785a60945e97e1e719d42b1f9f2758ad4db41b880e282f5fd
SSDEEP 12288:q/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1495523D3548955B1FBFC003A86754428F5881E2DEB5659E3E2483D1EA23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 fcb13142c8924bf576d25b81aa03d1bfcee4475f89439c15c42c8bc56feefdf9
MD5 a6a707a32841d2c37068400691c9d688
SHA1 9f63e1a8658f8081c175183a15b8ff966af267c1
SHA512 13dc632f5bb7f3cbacd18b53560c0f4793ced71509178afb2ea228f804fbcbf366f095431eaf56ca842234be5ac26b27078441e38a6846184e71b4ec80f9b0c8
SSDEEP 12288:27iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2v/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14C5523D3548955B1FBBC003986754428F5882E2DEB5659E3E2083D1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 1b310bf5337cbc2ffa85bbdc91decfa8545984e4f4977c6b4d30bc8e12b3342b
MD5 48160e8bf7827ce9e413ad9cd4c7dd88
SHA1 aeeff304486265e7c3c1faaab73067d76ddf2178
SHA512 2738a75ea89e2fb904a3fcf5c9d4dfff0a3856d144cd99fa4d2a9348e73db1fba6cf041eef49e86ffc33a0fdb9d44e289e4b8ea57cb7d4cf4d09172154e4b59b
SSDEEP 24576:czyC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:chLNiXicJFFRGNzj3
TLSH
T1DE650247729530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 53f897e4d8087e0632ed4e14b268fad2682f819aac504822abb9a8f7fea1ca41
MD5 bf1847df3203c282d695b3442375e9ea
SHA1 4cd86d01ff87a6643cfe30b88a88d004e744c9d8
SHA512 18d05a4fa3861be4f5e7262a6e49a51295ad238396f316acd6e2868c24d6638ea6c5c558b1d5109fb37b2b085452bdec085b979b5722e9b0c4d139a8edecb786
SSDEEP 12288:k/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E35523D3548955B1FAFC003986754428F5882E2DEB5659E3E2483D1EE23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 03649ba8aaaa2795e2e65712279b4c191d4618fe36f8b8561d6b7c7fb4b35a66
MD5 5186027aa6bd97dfcac94a844db6c839
SHA1 6cc097eb99e8a86124566d9c61333e2652d8f623
SHA512 7be7db31e36cab00bea9254caaee4846a5e64c47fce64eabf68aa041f7e904840e61c42a3c5dae4428437021147215f86af934250667cd2008e0d4310845d398
SSDEEP 12288:D/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:DL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17D5523D3548955B1FBFC003A86754428F5881E2DEB5619E3E2483D1EA23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 2622ea44c9fc82ea16c52f5b016ce9720e7754fd862b9bae9a1829edf273a609
MD5 0388733abb9fd5451cac3090b03283ce
SHA1 c42d451928884882300bea23b439e84d23280c4f
SHA512 19c710b0f66b7024124b27a459e5f528851c6532edb143bc8be8a122b13b2b3f16841fc9bc3bb373e36b96dc7331bfbc77e78e7567a3895b022a170c4301f66c
SSDEEP 24576:WzyC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WhLNiXicJFFRGNzj3
TLSH
T17D650247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 09ebc46a402ed7db9d505c5abc2d946501528453ec93d306eb2daf6fdb13de23
MD5 808d4d3659eb7d05dd6895449f123660
SHA1 257f1dc4aa8aedaccd23eb61107cfa43860702d8
SHA512 c1a030e97f6ca8b5ed3617e6c73258b97eb7551b2d975af62fa473acae0501924f648cd3ba820fa9dd63bdf67fb860a7690bd598413ed43bcd3e7c32d8774d23
SSDEEP 24576:gT8aLl3z0zDE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gT7LljZLNiXicJFFRGNzj3
TLSH
T1677502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 72ad547f6fd6398ec202c97cb777342549cf9c4eef97afacb5bed9e70b1f7bb9
MD5 4ca2fb76d720a804c276173b8991e9ca
SHA1 a90f883aa91d99770b084c8faa9920d30eab44f2
SHA512 5430889fa63c89811dda67f429b8719f32d22327f1592494b444d1a53a0313d85acb61a3101091fb37c55ca4697a6a18caff7c68c3ce5fe3f7a8b56f21870b6d
SSDEEP 24576:J3rd9CHKy7GZA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Zrd9CHKyaKLNiXicJFFRGNzj3
TLSH
T16C85CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 2b5611e9ed0b6a60f9be1192672f6d32dd2c42494c66b27d2baaf31ec03e47a3
MD5 e4a4bf5bd8fc254567bf0711b1858617
SHA1 f33b248a7bcba7014588bde37e7fe1d31527b8e5
SHA512 89ab38cc69c45333fe062687d753d820d1bb1b01a3e7678865d6ce556db2cd2274a806b60afe9a51d27e026239aa14eb931c6fd41b97cae089a543bce2bd821b
SSDEEP 12288:NSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:N0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1125523D3548955B1FAFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d3ab7cbadb4ee5e9716443f29e5ac6e85d6ac3721390b01a384a7665845b4b3c
MD5 ff7396a2b3d77043629410794450bee6
SHA1 2d4f6237b56036e6ab2ac8428f2e807dca0ed6ec
SHA512 90e3b96dbb8d2a36b13474ba55bd3d058ca08582057bb62401dc561ffef5d4cfb723a137bea9088ece628176e1c93b5600b95bbe97f880473eab3f1829f34c7d
SSDEEP 12288:zwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14B5523D2558955B1FABC003A86754428F5882E2DDB5619E3E3483D1EA27CFEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 ee8a48580867ea5381e1931caf1ce6e7772c332eda6151673349ef6b47aa06ad
MD5 c0d86e999f923329a3f09c4475364ccf
SHA1 5c3fa660b4df62b71512f418065875d81b855dcc
SHA512 5176d264378bc618224af5c0e462f2160fd332d7ffae77677e71e21489cc9f275b18c8355f0f2025a6aa620b845b3b85fee73c63b7ba01a48d19c055afd7676b
SSDEEP 12288:rtiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B65523D3548955B1EAFC0039C6754428F5882E2DEB5659E3E2483D1EE23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 cc166a9dbaa8de69ead92c23496c3cb27bdcc57bdf8a7ded9384d7f8145b4e8c
MD5 57e93a55e9a79f9cb0beeb9498b0794d
SHA1 056f66185a3a6c7a461408f615224914b9274d34
SHA512 5e3718a9b5b0569884de8d21e3ae322b6c49162f4ceb1e2ba13c06c31ce225f79fecb90db813f3e84b1ff4cf5b2e50d021c4d95ae3cb9a0bf89070f80cc49fba
SSDEEP 12288:d/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1065523D3548955B1FBFC003A86754428F5881E2DEB5659E3E2483D1EA23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 4ddf1853e75b4d6a1f536480826e9ce0e0caebafe8496145b65f0d22cabc0d86
MD5 1abe6900f44ef4c3a91a2b9e6997838a
SHA1 457e2d1d0fed7a32575ee9ba4d410479dc7c88e4
SHA512 23eae7c3484f8cb0eab1a2f476e0949d89c249b590b519705558cdd015ee7e7ac8d12748dae1489e3f10dc30bd77f2b4726bf4f67004d9c619a286c734ab68ac
SSDEEP 12288:xSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:x0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C75523D3548955B1FAFC003AC6754428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 c2b964e228bd21bff8849683608341918988d119f1f24faa2e864e735c692aa3
MD5 246017e156e003199ef7ab71388e4107
SHA1 1d8f83cc86a2f56658077ee6a5def84dc62a242e
SHA512 b92f2b32a49451be867973dee99718d9ff3d8735d20a2c105feddd4f6f4326733ef27eebdd6b54a8eed31677567a1afe0906d9e8985838abe079315b02e909c4
SSDEEP 12288:hXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1075523D2548955B1EABC003AC6754428F5881E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 27d1fb73f4c603af50ed0502e5d4ee714a7b69ed4183347f7cce19806aa7e831
MD5 f9231e5366d54d55a94b33837b0026b1
SHA1 ea69cf8ba953812f2df0bdd26a39426d8ba6a96c
SHA512 83019556bdef2453e565e6fdde59cc2f72f274498f11af486c9867e6d3941d15388aa5700627f9672751ab826de8231febaeb5bccae079b5f3a923541fc7323e
SSDEEP 24576:gfwvzk9RX6wkyAI//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zMnYI/LNiXicJFFRGNzj3
TLSH
T1F185D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 dbd42fc85f6619e8ef831d124cd0499190959165a6c56c972b71d036fc79c742
MD5 ee8c7a82e458321197a54c64d7ff1ef7
SHA1 fde3f9cf7a525e3abe7fe624b78b885fb1f0611b
SHA512 8ba24a733352018aeeb21a10d153da5504b88e3b99e2104539bdfec91b001606bcec4ecb2f5ede13eff92a518e6d88093053e523023c0f18c330922d902d3b2b
SSDEEP 49152:+YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0YLNiXicJFFRGN:hySzPA7wRGpj3
TLSH
T12B066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 230594901d92f57138c18f4c6ed912d4223c185d81f0565cfb4ccbf270df4b86
MD5 7e1e7c84d0da734cfd7a8141e78242a4
SHA1 020527641fc737b0d6f709a35b28d656ded2928e
SHA512 92798524e19347935df3314d109dd7a9cdd7a583efbda68ff38291e172bae41983913db801ad46226f066a853587e360d83e077975fac6660423ff2665a37cd7
SSDEEP 24576:q47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:q47JUQjqirIhCnDHUPfF/oLNiXicJFFS
TLSH
T1ED65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 02c2e0ca45bc7f716fb1fd04e8da2361edcc45286b829bfddc693316465f924d
MD5 224d0941b452aa9e44e9622ef0d397e7
SHA1 3a871457d32bed9e99d04a5c7dd8e45a4776924f
SHA512 f21ca9a54a7730e6c5de67506648f4d35f0e4e03baf9b08ca03b84061d98216e9407dcf5f9eee7250556694d5b6ae04b17eae87256509e99ad4bbebade243572
SSDEEP 12288:+psfPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:X7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C565F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB92C0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 b784e83670e479bb9f0a07ee98545147718b495789391c7a321898196230487d
MD5 7f4d95978f857d383ba9269880f4e9de
SHA1 bd95069d7c6351107bcfed9809bca39de6f524ec
SHA512 0bf5fe5165a040488bf1b58e628b254969d01a74c5847ba0bc56352ac191087090a45d0567cdb0a996541802bce907e0c0799f77948e0c637fd094a5d406d84a
SSDEEP 12288:wjqAWy5F38dyPLIakjvL9A8vFZBxWzxSmcaRMbRCP:wzW4IHhjvDB4NzcaRMoP
TLSH
T16E452850762AD75FC6A940325E32D2CCAB707D05EE056F0373C88B3FD576568BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 aea321dd92b36a6e2777c278be24b4c6193a248e8944fb9705cfc120e6fcba44
MD5 5398937e848308e93d6e26c3160db2b1
SHA1 3c4f4ebe0391a5ee64ac1c094cd1719c16c5d4d9
SHA512 f66b2ddbc432cb961a23bb3d907c19b81f8b61093bd060745352de5aaf0b80baa6c8c91f037bc4937c73db7923ba8198c2bd3c62bec8f440075e5840c0bd65fc
SSDEEP 6144:qIzLqXhIVgT2kUokwIKDexH8SDQcIuOBYnukjPIKDexHuAaHdSDM2zBmrcwM62+B:O4gT2BokwZHOZAaC9JEyE
TLSH
T1AF650A819537E38FD5F76072032A6F8DA764EC16B7055F26B3C8053AD82A725B0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 168B
SHA256 c11e2d310e3dbda176441892228b2252028327d6c6d5e70ff8423033dae1226f
MD5 161f651f416bcc2604ceeb4c8488ece7
SHA1 0e7b05861e6b04e4268b63566a50de0048ddfcaa
SHA512 b816476264370437bdd57bffbf581a7cc98dba829641b04d6998a88459afa466f544f937dadb8ac2933f9d87c9e4e9076d16c54fbf68ff415be0521452d88d01
TLSH
T149C0808641BF51B50F27004AB7753F51114275D3CB418A11F670778774F18010E5BC1C
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b9cc8a114cfd7bad5caf0ddd4d5f8741251fab10a385d54b9c1ac08b46a9bd8e
MD5 ba55919fdd823606137175894f8ccac9
SHA1 ada210811a1f14643e8e1f9cd5c6cf59503bf7e6
SHA512 cd282dc02a2502943cebdbae4920e201f7cdd7bb043eed848896d3f6ab0804f9a1c9001430760e10a0957a341ce9f6b4885ce05194636be3857ecb264a32e64c
SSDEEP 12288:xF7niJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/T/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T141552393568C59A1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1db0397afcaf9b69ccb147e58866795acb059a27eddd02916e421c4f6c31c527
MD5 9e0498ea4f1a5f7b26d4e1525dff836d
SHA1 30af378c8ccef92fe10084823060a572fe3a808b
SHA512 df9e84d9c21b57ce8f1bb034ae586880e91d8eef17938523e62b92a0a4816b9f7c0b9434999b6897082ee7ce2c576693dd11b5e03bf6a40c635bc1bb78dd1ec0
SSDEEP 24576:vgb6bmBIi49WNNFpg1rSvFv7bYZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vgb4mBIBhGF+LNiXicJFFRGNzj3
TLSH
T1E165AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 854098f889433a318f34c8021b6d4632cc20dd169924f959769c0f029b153da7
MD5 d51a0604d4444280aa6e5b846c341bff
SHA1 9579421f929d6426fceba46aa1c9c576600ab2c4
SHA512 7b36adc4f2e26e07f4865554bd6ab807c3554ec6291421960e7603039c17a542f5028ed93a1509f5bebb472fd8fcb346a9383afeeb1b3aa6e9e47ee6cea6192a
SSDEEP 24576:RG88u8FpJqH1vzria7/mu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:07ZFPqVya7/RLNiXicJFFRGNzj3
TLSH
T1A185F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 adf217db23ab8c6e797cf2be0145945619b5cf530b2328e61302295fcb0d5a7e
MD5 486bef537f21dfe7cb6831380ff7316d
SHA1 5f8511ccde8737f0160c6291b6bcc8f3dabe2e26
SHA512 209fc71e836da91357f5c4f177c8856333a6900bced8a6699d7e0acc3a8e8a8c5cbfa5e75c1bfdee334082ccd1e790329d630bee0d8b5f97bed02176d9a686f1
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj6LNiXicJFFRGNzj3:eG05lO43bX7wRGpj3
TLSH
T17FD5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 88267f6aa330b639fbf04a96047faa2df23c87582b33676de3fc041f42b4b31e
MD5 497e6718969092a2bd4200f04f8566b0
SHA1 d3ebec02f7266c16b3bb08f0a2808b5d6847819a
SHA512 cb0a0d997e86e9d7be85f4e5aa7aae2e4af6596a5c426bb6816b542e5667b097546d55c5626947a7d8c1b1ea94cbbbc6f1edeae883e089023fa937b40a883892
SSDEEP 24576:Sfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnY/TwSfVcYG3K/cJHlnFR+IGNe8jg:6a5POZ3lJt2pasx2+miLNiXicJFFRGNf
TLSH
T15A65BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b9a504d472c8d09f37d5c915ff2eadb6beec3fb3982fcb894391f5c3e0cddc87
MD5 5a731a4ae1e1da3f9587b6f9bf25c176
SHA1 48d8069e584fdd8349a81cf9b1b54eb7703bf413
SHA512 ee0dd306e28cb8580d0c0eec61982f87291fd053a92bce96dad5cab0170e35ec1801f0dd3ec5cb79bb994cd0c898e77b8f4d6cbfa8e4e7a02b3c32049b9f1d91
SSDEEP 24576:aNcwHdjbyQ4nLC18lb/EOjowL7Fk2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aNc/zEOVHFxLNiXicJFFRGNzj3
TLSH
T1E8858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 914f2aea33a0488b2c37fc396546040f34a961d53d22f4788353a3f2b77d28da
MD5 afd2ea2111153f7baafb4fe845b7784f
SHA1 d9b4dc59876fe4d50f8eebb159bffe226640e6d9
SHA512 a32257f11e88e6c55a8d698726722bd8d181b5e9dce46b86837e4f2c7a4c727973f123d4c0fd683f257e9fde13bbafc9ffc4fe1cb7cf05e5ef4cb697375757b2
SSDEEP 24576:XzkNvNnaFeYhJNtmZBmqr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XzMwBtOmILNiXicJFFRGNzj3
TLSH
T12655AF6EB6E846E4D1FEC675CD238512F6727861073292CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 971e46f94ae4bbb75c3349b4d4243099e768491ee60aaf2c6d35ff6ff87a3c1b
MD5 9bbefcaf5f585e88a246292b4704dafa
SHA1 b729556a1e2543dca8349d65edab56cff7c5c8ac
SHA512 e1769b7cc3a1b384472b00c730f3e43e464e9e263cff9fbdb1979103cbf9ff8356eaa0f8ccbafbca6e3d2e377cde20e036c268984eb42cc670ba656f39c1c4eb
SSDEEP 24576:7PUr+NQK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7JQKLNiXicJFFRGNzj3
TLSH
T1B065F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 3bcd3043ee83faf317798d6f17aacecc2f534b9a055c3a962ed6ad7f85d48b42
MD5 aae385816b59b278cb3ab779dd9cb38d
SHA1 0590ffb028edeac83085fce36c5d8af010200f7b
SHA512 c6d66ed9b864cdd568f5aca7e2cbb0e7a091a281f64dc9d6f81a3a0b954791a89173bd3a227cf20a83db33e5c2e35a8881ccb6b45c52c940436c525091f0eb42
SSDEEP 24576:OD3FHshBIYQgAn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ODVHeBIAAnLNiXicJFFRGNzj3
TLSH
T1FC75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/788-294-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/788-143-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/788-150-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/788-144-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/936-400-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/936-203-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/936-209-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/936-201-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1872-214-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1872-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1872-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1872-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1872-25-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2692-176-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2692-385-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2692-177-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2692-183-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2692-417-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2692-416-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2768-215-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2768-226-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2768-222-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2768-216-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2768-224-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3644-12-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3644-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3644-19-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3644-188-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3644-20-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4500-375-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4500-166-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4500-167-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/4500-172-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/4936-0-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/4936-1-0x0000000002530000-0x0000000002596000-memory.dmp

Download

memory/4936-6-0x0000000002530000-0x0000000002596000-memory.dmp

Download

memory/4936-41-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/5332-404-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5332-231-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5332-238-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5332-232-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5492-156-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5492-162-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5492-154-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5492-361-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5524-399-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5524-403-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5524-401-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5524-196-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5524-189-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5524-190-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5668-42-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5668-139-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/5668-44-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/5668-55-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/5668-141-0x0000000140000000-0x000000014022C000-memory.dmp

Download