f61b44231f55365e71d0dab493520b550595739dcab802d01beb632e77e05025

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 16:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
Size 1.6MB
Sample260804-t28rpsdf75
SHA256 f61b44231f55365e71d0dab493520b550595739dcab802d01beb632e77e05025
MD5 1abf775945e4a187070d9b70521f384f
SHA1 fb1618cec0c1619d76c5465e77ff371de6edff1e
SHA512 998902eeefa0c62dd7b2b0654866dd4575916bee9fb10712085497910ce8cfa81e92d92a18f652e53c1dd795f56a340266b01293f79c20bfcbc7a2276190c997
SSDEEP 24576:fLv5qMr1nD7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:z5qMHLNiXicJFFRGNzj3
TLSH
T12475E01077D08036F5B324764A7E8669956DBD715F2181CFB3C02A2E9E70BD1EA31B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5520	elevation_service.exe
3740	elevation_service.exe
1600	maintenanceservice.exe
4248	OSE.EXE
4528	PerceptionSimulationService.exe
4744	perfhost.exe
3132	ReFsDedupSvc.exe
4500	SensorDataService.exe
5492	ssh-agent.exe
3300	AgentService.exe
3808	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\799be70b238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ec2638a2f24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001edee38f2f24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000032d9facd2f24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4684	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
4684	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
4684	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
4684	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
4684	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
4684	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
4684	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
4684	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
4684	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
4684	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
5520	elevation_service.exe
5520	elevation_service.exe
5520	elevation_service.exe
5520	elevation_service.exe
5520	elevation_service.exe
5520	elevation_service.exe
5520	elevation_service.exe
3740	elevation_service.exe
3740	elevation_service.exe
3740	elevation_service.exe
3740	elevation_service.exe
3740	elevation_service.exe
3740	elevation_service.exe
3740	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4684	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
Token: SeTakeOwnershipPrivilege	5520	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3300	AgentService.exe
Token: 33	3808	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3808	SearchIndexer.exe
Token: SeBackupPrivilege	3132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3132	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5520	elevation_service.exe
Token: SeDebugPrivilege	3740	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2392	AdobeARM.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 2392	4684	2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe	93
PID 3808 wrote to memory of 5932	3808	SearchIndexer.exe	103
PID 3808 wrote to memory of 4160	3808	SearchIndexer.exe	104
PID 3808 wrote to memory of 4060	3808	SearchIndexer.exe	105
PID 3808 wrote to memory of 1080	3808	SearchIndexer.exe	106
PID 3808 wrote to memory of 5556	3808	SearchIndexer.exe	110
PID 3808 wrote to memory of 5404	3808	SearchIndexer.exe	111
PID 3808 wrote to memory of 5828	3808	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_1abf775945e4a187070d9b70521f384f_amadey_elex_rhadamanthys_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2392

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3740

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1600

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4248

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4528

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4744

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3132

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4500

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5492

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3300

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5932
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4160
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2968 2972 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4060
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1080
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5556
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5404
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2968 2972 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 edbdde7dbd7ebf97793159a553a206654ab3f7645f4bbeee8af3460f76e68d0e
MD5 9c9ea4487019410d780ec37c0eefdb0f
SHA1 aa9e20dcfdbe0e80f8814c2b4cc843c58bdaccd3
SHA512 3312ecd169b38f09b204322b917899e1210cb54cd29efe5568e03361b49999e28cb7632f11daf25e54a08f8b1f25c846163ecd5311604b3c7137646940bf24ae
SSDEEP 49152:cb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn4LNiXicJFFRGNzj3:G3q6mjBb7wRGpj3
TLSH
T13BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 bf68f0e8dd72c41025b2e4efa0869ab58dfea70138e6ac7695d8a2035f616dde
MD5 879117fe0bdce5e812812394ea5c8e1c
SHA1 ada0c7e7bf2ad3bb20563564d9325c2fd46836f6
SHA512 74544d210c25231b2fbb91d52883be93e50002658f9c79fc4eedb08abce5be55691452dea418cabca95fcee373e53307ae398918593cd9c30a401daaa3ecb7d8
SSDEEP 24576:mXYfDtczA//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FtcaLNiXicJFFRGNzj3
TLSH
T10575012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 ead1680d5e7cab75f0fa556b66c65bc0e9303105d58ee066f11bb49c3bb3a8e2
MD5 61261b0709938762a05012c590f1d284
SHA1 977def0a05f76eec816ecce78c16c6983e334dfa
SHA512 4a0c72ebf110a8037b4f5ca6c97b2f20f7d5dce4e5f2cecc4f17b6f7155beadad2f6e0ef5cad4bcf00192fe058cfc7c3a88c42eb7433f718b666a9e8dc25a372
SSDEEP 24576:h0Le5ji0hmxhrMW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hPji0AzLLNiXicJFFRGNzj3
TLSH
T15285AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a44b97d51c6600979d34c2cff2cd89276f4c55f6963f93fbf7446f90db27f07d
MD5 f8807f7af7db3d948c7cfa6405f8a5f9
SHA1 7bd39cd6724729f928256951d51e32dfb86861bb
SHA512 cf0df56f32aa39f2141ec892c848fcc2ee54bc2460dddb936d7c7c3346ad1a4b0c13128d26d1d4c9eca5b1eba8e6ce6471323ce53b5b1ae29c991fca434d240e
SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWj6q8wyuw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:a/ezSC6vUzPv+HjyPLNiXicJFFRGNzj3
TLSH
T1A0756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7a70841cdeb5b7a0020c247cd50f2d9ff6fd085fd5e3c6a0496f3941797d80c5
MD5 f8acfcc598ddc502a28b266eb967491f
SHA1 8af70c0f4bdf2835a79c856ced85d190b5f5187f
SHA512 ba6a68ecdc38fe567a6adbc2cf57b2156f568c461b18ad425d51b6fd9908b68aa8f5d3b76a6b24087dab92d47ecf59d5eea03dcb78ad6457e421c21e04209e5e
SSDEEP 24576:oVbqPb88hv/l+Bx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oVO88hXl+rLNiXicJFFRGNzj3
TLSH
T19D559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 31865f2aae8533c31eeb9f54da811650833d568225d49a4d40ff9acd95956d73
MD5 5844be5927a7005e25aeecff7ce5ce44
SHA1 3baf632694d07f79ca36833e1a5a2a0f6b61da84
SHA512 ab5c38780b92c2a1abdde05db3efaaefe6f6936ef4c931772d3ea15a75b5f9b50e66ccfe5ac80ea3217b4e69bda708491800f23d2701e30c22e04bed95ef9fd2
SSDEEP 24576:xGy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VLNiXicJFFRGNzj3
TLSH
T1C15523D3468864B1FBFD0039867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 8ddbe12956d575b76b630fefce6ed87f9651c3825702d666fbed39e650a058cf
MD5 97690f8a70b4a26d2c07798ffd6fa1aa
SHA1 8fbce877a9abee7f67e259e429afdc4b060cea45
SHA512 2c1e5ea1d7b9b683bf5e3e52a1ebcfd18feec3ebd62505821c9d7fc18e29ea8c037809e1e0e114672927ac07bc8b40b8933d83d241de1a410739d357b005415f
SSDEEP 24576:wJIUJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wJIUJLNiXicJFFRGNzj3
TLSH
T1DE75CF7BEE28FCE2C27E4C7957518600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 712504a2ac11d22f7ea8f34dac3f68d1cf16f14aa847aaf048614006d188f76c
MD5 fcbcc1a003dd2ff00ab9d1b943ee831f
SHA1 5901a64cb9a38ad40db157f50338754bfc99c4bb
SHA512 6169379ff489756c15d8303fcdae1204d501bc2748dba7dce898c442323bc8346004fd4de2b17537e8b9699a8b05ca3474fb5f0b4d33e6efb44975dca14b4d2b
SSDEEP 49152:7QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THp:7QvGAdlCEL8c/WRNw5CA7wRGpj3
TLSH
T132266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 3322cb96f890e758b7d6a8601a92c29bae7886b8ca8e713ec6e50dea13d0dfb9
MD5 b86bf7277e5c9af570262b75e45d7b44
SHA1 e73eb15af257059a6b8d53cc9e41bf4b41874f25
SHA512 362c601406d6e551b0f28e5296ad11d40dc8ceeb7d0bb0d4facd4e0818b14af2bd1ae1d41d34902c18f6bca61196b23f568482e721ea60f56093cb7b0e3d8e66
SSDEEP 24576:jfewsAjb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zljbLNiXicJFFRGNzj3
TLSH
T1F175E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 49eecad97e3875b2c586c8b2664dadba0fe0ce286876b9852018b9fb92984ab9
MD5 00abb402b379d83a3e7afc1ce03d09be
SHA1 da256f12069314c0ffeae2c8d087c15943bd5e42
SHA512 1e11f79f8f3968cedce3bd8de6be8530dbc31fb29446fdd47dff2e68aea7e4704bb88b5425632535796b33669b7747ba8425e5b0a49231040092392abb987800
SSDEEP 196608:TUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHXF9:TUEtQevvqc2W1cpV20I32V9
TLSH
T19C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 167e8a4b8ba647cd724cc74af8e0a5a8024c424cfa1a53986c5b69c81d69a98c
MD5 c0ecbd524fb1f1cb6bfad87ea8cac619
SHA1 65fbffcf0ee909489b8a90bd25b607363ee0a712
SHA512 548d2928928ea971fba8ca4db883d29561cc267da64910436d92a32a186fcea0840d514d12e4d243a896afab2fe54cae772befea3e8f2ef8d8c90257b10d64f0
SSDEEP 49152:nCbRquA/m2yL5zLfFiV+XenmE3/z7LNiXicJFFRGNzj3:woq2VjnmE7wRGpj3
TLSH
T1EFD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e8f27ea609043ece6924a3f021b8fe8b60ae419d0c9dae91d1e0c1d4218572e6
MD5 d60f2fce4e627233b23e4bb5a849be90
SHA1 40d52b5a642e1f581bc0fe0d6db9ab898026c075
SHA512 a6c2a7baeda87f8c9840493d2c39d38d3bb870ff7ba1592e67660a455351f27964e938fb549955ad2060bb37041b047f11d1615cd8bc89f5105662fc76814e32
SSDEEP 24576:oAhGL6IFoiwtA5l7S53k/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oAM5Foiq5ULNiXicJFFRGNzj3
TLSH
T1E3359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 2eaea3177ae80b27df45e5ecd24744d2816edcd1411940225b1dd75005f2dce0
MD5 48253184091810f2bc65be22dfe9b3e1
SHA1 ba88564e0cffc2d930c3f79c82e8dbb1297f8b2c
SHA512 9c0873565608339497a1807811fc07c90eb057bcdbec4a7198cb2445703dbbe584243e4142472e2e902f83054dc1367e28eb28f628e693d68ecfa93803306b77
SSDEEP 24576:QwuROWx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QwSOCLNiXicJFFRGNzj3
TLSH
T1AD65F18632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 40efabefb7eaa740218d32f63b093bef3dbc8975f9adf68d85a0f91f6500fb47
MD5 baf3b682f853afa908d036abb97db88e
SHA1 7ea54abd9e06b6029eafb002824692e30b9b1dff
SHA512 3f4b23e5fc2990e26015030f8b70ef6e22dd48bfe7c9d968dfda5b913df0a1868e2ef36a648170fbbacca9fe3779fd4dd38d2620aaca567e9a14ae1e11359cfe
SSDEEP 24576:TZuu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HLNiXicJFFRGNzj3
TLSH
T12855129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 68c3fec2077300825d50d8b8babc81739514355fa80f4965155b3ef28816da7d
MD5 36b0e14f1573889d5d80192c17137735
SHA1 8c88a2b6f9318f08fa46347ca3edc2d39a607e71
SHA512 8cc15ef3298663144a0897af48dde8348d291ba7ed1bd9e559d588811c644a73da245c71fca9da300bd169dc2e205fb8783c9eb6da8d074fd39228f9d656efde
SSDEEP 98304:EQRQyi36YOcPDLvw2gAf+PN3d7wRGpj3:LQyiKanX+PNxF9
TLSH
T139667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 efc48f220b52affb076dfc71cfd0aea8ad134eeeb5196d2037378eeede2f2180
MD5 a7ac7b99f53191081ebcce0b45cf5243
SHA1 089c39174d3e555b477a14cf323cf8d171fbc608
SHA512 c22fed74ba54fc357b2416b319e03ea2142dbed88734803c5a8edfb326ecfba4340197914fff8ae8dae82fc0db3f6bd82234b1822e36a1d81bb4d72be3c3d68a
SSDEEP 98304:4QRQyi36YOcPDLvw2gAf+PN3d7wRGpj3:vQyiKanX+PNxF9
TLSH
T1A2667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fa3a3547e717f37ac74a049bfe4fa1a47826e1f6ad723cbcd1022e2b590ffa3c
MD5 7d72e5309073c82ca617658c0da2eebc
SHA1 ea3063968b092dbeb5619221ca3c31b949004303
SHA512 560908c967aef80aba39f010e4ce958a9aef88071dd27e6bd9d99bd1bcf85488239ce6f2f83423a4c37e527f0365269b26aa89f79bc8222907bc8224ff7fb824
SSDEEP 49152:I68Qg55nhkeWu7PNU3/LLNiXicJFFRGNzj3:SthTRc/L7wRGpj3
TLSH
T1D4B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5fe26277e23fd80cc8ee9058f82fb2ecf4032df9ea275195cbd6c3c92e9971ab
MD5 edeeacb22af3c931b8580f6cedc9776f
SHA1 59126a626dcd0708583e7ed05427b0fa8f75e878
SHA512 1b1344b99ace02a6cf4eb63932d3131aeae7d346f2100b8059f31305fdf85eb3f43bfeea3a5fd969df3f4c76293546e2bc5cc3295f75e7b729a5cc38191d6a73
SSDEEP 98304:8y5112gYy5azzVvU69nLKnhZy7wRGpj3:9LIHRWhIF9
TLSH
T157167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bdfb3a7458b4d7c4bb46d3ba3b131fa60b7a534f4d3bf30cacba45d7a8934aad
MD5 77a470dec60d4ea32d68467e98c4c75e
SHA1 c8d9e47d2c41aa24bd4b4bd46411f1f288b45b80
SHA512 6c9b5314d2c5422e4534d86c37a32da8ee44201432683458a9db0a025a004d47650105483ba3b49c057d08b63f603c57f71957c80792ab497fea7db2550faefa
SSDEEP 49152:JB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glvLNiXicJFFRGNzj3:fu6JmIxd2dv7wRGpj3
TLSH
T1B8D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d6bd14e30e9f1778a7817553aa0ce06dad8b064cde71f1c9d229c1e180f88437
MD5 8378dd177c171f5b0a0610dea0b65d54
SHA1 81910e5a42a38e64351398198e3d39702ca60ed0
SHA512 206aaa5862eab8997e8fc029953c5f3659b1c8457eeb955b2439bf8a08e91ba40beead5becf0a9fd951fd3e4d2bed845041495ac76b9e4930716c857cdb99d5f
SSDEEP 49152:H1hpsNoJpF1A67U44CwH7R4xpLNiXicJFFRGNzj3:HmifPqRE7wRGpj3
TLSH
T119B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c23a1329cf44d24dd96f61e495fe55da722dffda3a77dfb4beaf6bdb52f4fa0e
MD5 05d6ddd8802dcadc0fedba2b761d9106
SHA1 9364189e6c825db4a104cb488ef73642478ffc8a
SHA512 fb6d41ddcee4f18cb62a44302027e303116830611ccc65f8affd6c4b2404ed7d27f4e10fe0e648f20c1781bc78acd30c602b13bcd456df4ada1244850db4ccc2
SSDEEP 49152:5SuZQIY0Be2KkRVtOnks6NMHquLNiXicJFFRGNzj3:X5dKqi61u7wRGpj3
TLSH
T162C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e97952ba128f454d6d1a6a6c6911a6275e6d9f2abc826cd3979c57bbe4234320
MD5 8dd205a68b4818fbb90fffde416e92b0
SHA1 dd32d4667e255a92f024b454b9f485ce37457ed8
SHA512 d39507ee141a9f9bd673672e1c5665efff7b4b73de05d9f884e24b4196a5dad1305a960b68af88f2b475318b0a53b5595ebfaba92fea5455693cbf1de73042ab
SSDEEP 49152:/htSn8EApI0figjgiDn0AP5wlLNiXicJFFRGNzj3:uX2iWpho7wRGpj3
TLSH
T10995BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 794225d8031b5b1e36337ee97218627a77253fb580dfba6ad813a9ace17958aa
MD5 3345cf0ab14caa9e347e44ed488b0431
SHA1 afbd602599b5727ccafa115d9a5ce6acdf28b192
SHA512 a4d41eb99b6458b704b8148c907bceb07940cfb265d47087236d0c812679415f9d9f47aa039171fb16e864bde7218a8cd269e7f5b1827d3628259974d1900ebc
SSDEEP 12288:34iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3K/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E35523D3548955B2EAFC0039C6754428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 45b15cb69373a2b3d152a09c3f2444998461a772076ba490c2911301d1bda025
MD5 26e42a7674521bd503daabe5657fb688
SHA1 7da72a77c0219e49452f8207e165ab425656bf2e
SHA512 7079d4920f0e1c960ef514d0ef3b3948fffaffff563115bf5bde1095112e2b2b25e75809a5ceac0c3813cc2e2b83c0ac415d6fb1564efab5a1f2bd9c5307ad4a
SSDEEP 12288:djiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:dX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B65523D3548955B1EABC003986764428F5881E2DEB5658E3E3483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f3e68229384ee2966b3ec457180cdc5952786a50eb06f39225be159315da71d8
MD5 c9fe275b2a9c553dfcee1355c01aaea5
SHA1 244be0ed42a1e620964aaed28eb58dd62d3c01d5
SHA512 8507426e42b7388c63ddecbcd4bd1d0ad11223a83822f936b8c1417b0136bcde720be6f770b7eaf31d2d44b91ade5a1c2947f15ad5af075e2def15fe419b736f
SSDEEP 12288:99iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9h/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19C5523D3548955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 6bdbdbfd916b748da8aa06df5fb151604be96667200ac5022731efe18ea39fc2
MD5 014560fc97b7eb9ec4fab9ce77e0dfc8
SHA1 e5d40cb47344ec89de3104f431b64c5a69e41fec
SHA512 a9253b67f09b2e38957da0100ed211c06c33eb65a43a03ee8f9b07e1edf1a75b193a364c01defac4c6b5d0120c249538295b0180c5ba3ea8ef7f8b323316a9b2
SSDEEP 12288:YVCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:R/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16B552392168901E1E9FD803DC6764424F2A47D6CD7325AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 230d31900a326e008a2f64195603f9634b9ab6a7f6fd668985732fb2ded9510f
MD5 d1fc52afcee3e777d61cf65330f00ea4
SHA1 7a0c48d2039c125a2bbe83991c596fba8b9b0a2b
SHA512 61ddea6a398a9e271e5a991577c077fbf7c72ad18e2809bb4e974f4311c1f8a6d4f89922f75cd141ada0e6881dc97f4ffb8d8390c2ba1234a568047723674d6e
SSDEEP 12288:9qiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9s/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11E5523D3548955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 cd046793e14396217e4427e59eb2c0c404b0cb32e883eedaa39ae25b996623a6
MD5 ef77ae5c7a264ddbbdec091ef68a7af1
SHA1 4b3ede3a81e7e7c6adf7e80ffd7f977dfbabddc6
SHA512 30d93bb9cdb1f754e1830296926d78ef58792a36d740b755dd40027693c8c99bf43cee0f881d6383d42ee39fa1c6a803cdd7e67a85f0e1e026220853adf78a82
SSDEEP 12288:IHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Iz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DB5523D3548955B2EABC0039C6754428F5881E2DEB5658E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0fad0860092bfda1901cda405cfa7dd4018e5b4a8a2a9fadd3c4fa2af9f23cb0
MD5 ee87de53375129eb37169a1f97e2a603
SHA1 bb6448e7721e7d6c924a0dfe084aa7de57fc86dc
SHA512 8101b93b8b8669aea6f011d309c462190adb5457f462c8d3d67e4d5b96cde62bc1dd5560619bc07d8b218084078c97c95fe855a73fba1eca40f39f86e86cc6cd
SSDEEP 12288:BLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Bf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F05523D3548955B2EAFC003986354428F5881E2DEB5659E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 0ca7b94f81a12f059a6e265c50ff1472d78bccbefbbba9ecd104d5407c83e8c4
MD5 2fcb9027cce58f5cbf4043ac017ef90a
SHA1 bec242975937cc93ec78799699f0f82762632cc4
SHA512 43960b7584ddd1adc4a20a6cf9c8f092696c99dcef12ae5f9ffc7c0586a5ced93deb9320b8fdf924240d81e497848b10389dd27fb9a8e3f5eb4b864c07885dca
SSDEEP 24576:EZM3zFVSO3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EZM3zfDLNiXicJFFRGNzj3
TLSH
T173750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 fc64e5f710a14b4ad2e5feff4e1b49da9e33d89fe445d97ab8983bccab1faa0b
MD5 606466c278a1fcacaa042fcfb4a94ec5
SHA1 485e020e8817646a1bcfd77f6d108f7c0c6b4bb8
SHA512 319ac64c09a3e4bb3684aeca47bd8bd153c47ffefefad499f66e261c5c93933d935ba990ddb24c696885c9f9f57bfc191ba7500ada8cdc82c40aae319ed6fb2f
SSDEEP 12288:SUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:S+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18B5523D3548955B1EAFC003D86764428F5881E2DEB5658E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 454f4927fddb39f609b50c19e863ec3092b561a2f451b7156322c5d8f2bad92a
MD5 de05c42bf655ee5575781236f2a32467
SHA1 4518b7bd25132027ffdf79d927144679213915cd
SHA512 67e43773b4fcb754f9889115f6affc3a4a30dec82c3c4d75a04686ae7484253d0052f03b4c34dcb7b4753c97076e967bf5ea624c287733fbdff111d1239de720
SSDEEP 12288:iQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:iC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AE5523D3548955B1EABC003986754428F5881E2DEB5659E3E2083D1EE27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 405f62adfa19fe50555e0e4ed32818bce46c49a1802d586d24c25d9170aecefa
MD5 8d58951b1a780997a4c581156e188b3d
SHA1 1ae482fc526747bb2dcc3724b286c9998c7a475e
SHA512 64803e9290da96067fc484345eb5b71f904cd5d2960624b174902128aa027ca7ec395247ca490293b92b3f59355f250796aeae36997e28087ca9ea643d982485
SSDEEP 24576:nzyr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:noLNiXicJFFRGNzj3
TLSH
T153650247629530F9D17A4139C9620911F3B57C364B208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5394cc6c24e6cd0932f0632429b0a742558d90b482d29cabcce0fe4320274588
MD5 2a365d294c5f19d190de8aee6b67a755
SHA1 60a4b06f6cc41037bf804c8d258053f12a8b1d85
SHA512 5e7db0a18e9746984ee005b8a357c88507e9c707f177125d6596464f054065c3185bbaf595e54d8a6c8009ee7bb29b37de15ed3d655e3f3501eb7dba3c36aa47
SSDEEP 12288:gUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:g+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B95523D3548955B1EAFC003986764428F5881E2DEB5658E3E2483D1EE27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c2fb1b20dfd8fd4f9144ceffd62e048e8c2916ece8b815ea1d4bae07590002e5
MD5 a6347e7ff2d5c8e71b06b949d989940f
SHA1 90a284adb80b8e595e66fbdeea2064244457810b
SHA512 a203965f5a0aff67ab448ed1121b630643ee1d6e7edd4e6f4d8def748703bc0b005c766497650a2132e3478d65351bce5c4571b247b9d51ee13b3cb0cce2a0f6
SSDEEP 12288:VUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:V+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CC5523D3548955B1EAFC003986764428F5881E2DEB5658E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 0523e22732a52b833d6361f139d5381b9059c2c85e2eac6375a41ec5c7a58efc
MD5 a49d9b89090fd47b48e4f518630905eb
SHA1 e1117cc7fcb02c7d90c6944097e1e562952f7d88
SHA512 4c0721f9ca4764555fdeb85f61e9204ddc42498199213c2590526771b8bac628a8f149ebccfef817bed4dde538049614cf22064bb7047300a90bbc4cdef09c9d
SSDEEP 24576:6zyr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6oLNiXicJFFRGNzj3
TLSH
T1B3650247629530F9E17A4139C9620911F3B57C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 a6a79bdc7fcece182678faebad545b5af92a3a4df7702528467435e0a4fccdf8
MD5 cd2e8e9dc529c0b8239846fec08f32d2
SHA1 cb694f24ab3366e71e036e7e37776c3052b25a22
SHA512 f8ed2823d43c4d13c6e9eb3691467fb0646eabad49c67481ae3b755d9cd6b82a6c7e3270bbb4ac8e35d22a8ee576e0e22362cebe4829d98e50f345a4c93b31b4
SSDEEP 24576:WT8aLl3z0zDR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WT7LljwLNiXicJFFRGNzj3
TLSH
T1D17502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 6c7d59964d20c0d22c6db8928775d218679e726cb937c76c39da82a3cdf58323
MD5 563b607fa90ad66dcc1753adaa424167
SHA1 0cad23f0766e605767c89b65a26c94642edbea61
SHA512 fddc517a71f7ee9d62d373b6768c3bd7461fa3bec804ad5a7a63967ece130b1e319b8068d286a5eb29a31c26a29924a722ce79d396d11f98ac12cf8970f5fa9c
SSDEEP 24576:v3rd9CHKy7GZ9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/rd9CHKyaDLNiXicJFFRGNzj3
TLSH
T18585CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 b257be345c9d7da81698ab01a4302307250da0359e133c928258732da726b49d
MD5 2ce293c6e1d8678d9e391ab7be8beb78
SHA1 71ce79bd652b715a6384db3c6c54afcfc691a13b
SHA512 4c497a1f909ace3199a1f18b7a5a250cab0b5ea8a5fcda2451c9b3d9d5a990fef06f4286998ed9b941016f02bff6dc873cd19288aead25fb134c5f88a9559538
SSDEEP 12288:LdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:LB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16B5523D3548955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 49358592ea6f0cb35d937ed1449a2ccb776a2598412586ef34647a9acc041969
MD5 637a800bac8e7f31c29d4487190e80af
SHA1 5e30a3fa52b65925cd896306d5784866c56c1dae
SHA512 779160369b81aea6bbdc891b5b55830c554e4d8222fb92e42007ed672e3e1e7a44a1b67789cc1a32be0c39badb314417e2540163559fdc521da583b19a5be2e8
SSDEEP 12288:Q/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:QL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1375523D2548955B1FABC0039867A4428F5881E2DDB5659E3E3483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 805526a4cf16ed73012d0bb95d5853a07e8a86e82470dfe2d41ea679ca695f26
MD5 794e8f37eb0f41b045b1c5e0d94c79e0
SHA1 cd2fb7a99f04f8560bb0746de6e5ab0c0fa72605
SHA512 460a4d21ca0050d6074d23817760a9c16ce6da18f3719c5942fb021e3d0b91e54e5d20e1a76395fc967033e6057f73b1d13331ef8ffe6273ac0406c6d1273733
SSDEEP 12288:wOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:w4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A75523D3548955B1EAFC003D86764428F5881E2DEB5658E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 19d5a35115208b731c3310aa32203be07de788926b0b2be076fb207ffde4e1de
MD5 c8e8c40c60136263f793e063d6dbc312
SHA1 0bb59e3953170e1e54ea2bc5e79acad0c84a4bd6
SHA512 449252f71853e74b71aca17b61477ac762cc594d8cab96f1d709de85c686c62516c84786178edd64b3615d7d376b4d179eaa02fdcbb88f0049dbeafb07f7a876
SSDEEP 12288:6UiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18F5523D3548955B1EAFC003986754428F5881E2DEB5659E3E2483D1EA23CFEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 e31663069e56840bf59231849f61a275af5115e20a1594abbf27de463a56b8c2
MD5 2f930c16e7bd8baff882a1f54a2a1a60
SHA1 6b588c038017daeaa124e0066c60c054e526c9c8
SHA512 82d89c6bfd959ddba6892af68473abb53c08eb5066d21c154504c7620f5782bcdf66bb0b8d66a414006d9d5afc5ab1731d0569098a1be8f32023a5150e2b478c
SSDEEP 12288:6diJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6B/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1075523D3548955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 49d562da674c0240c64a21be6fc6577b39989b3045d6e2494e83a63bcdd3a69c
MD5 ce3480fb34f03e49cd11f74609ccb70a
SHA1 82ba2dd57e9e93c22aeede00d865cf7ca899aa84
SHA512 8dce11341172f4b9c2327fdfbe2b91e16c33e3f28c63670b7dd062bf43bf0bb9acb2e5284a20a8fd966953f599b76978e6df5a0acd68a98fa9ba3990a87deee2
SSDEEP 12288:98iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9G/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F65523D3548955B1EABC0039C6764428F5881E2DEB5659E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 7510124b81942ce160c441b9c51d7fb834ef70a21d628e297704034d931e0538
MD5 5288993922916247a418f557b5f12127
SHA1 d1169ffee928ec67a5fdcf67be8052c1f17aa700
SHA512 dea1faf757fa2859bac997070f396e9486e4c8616cfc05189339c89c67dfefda29bee9c5703f646196bef61447759f887f3cac94026aebc2f7201afd4fa9b6e6
SSDEEP 24576:kfwvzk9RX6wkyAIS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vMnYISLNiXicJFFRGNzj3
TLSH
T19685D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7c032fb909dbc64dbd5fb9c9a3c4bb2ccb1d35b2d787da7344433b405e44227f
MD5 9b05ac0e91384ae76c6b7ac2be1c8966
SHA1 1c3370c2041e9e94f3ccfe061aba5b151c3addc6
SHA512 66afe719e04df539db9ae7293071baeb2f144719de3e4bd6e0327a338d95548fd9ae74612c7195a0ef8f98f4881b715d6c1d8fbac256907871d9d1767a3c4d0a
SSDEEP 49152:bYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0FLNiXicJFFRGN:mySzP97wRGpj3
TLSH
T112066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d4d2b4f994bfe0d1039d410f0cfc4874e944681bcfc756aacaa69d84dc36d300
MD5 2b7d28c30f9371cb3c62c0d76bd5565d
SHA1 247ddf91148f7df015d67443814dfd2d28bde513
SHA512 e47d3e0715d4956ffc49ba23fe63ac07b7fcf58b892f657975e287b46f288fbd3525f125d671ec9c280f301d37a56468c7be964895395f0412f390a36acb7695
SSDEEP 24576:x47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:x47JUQjqirIhCnDHUPfF/VLNiXicJFFS
TLSH
T14865AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 d978516c695bc6cf4009741e95f6c3ec3e1486531485fa72d3e12697a7f0e2df
MD5 958719f6608d975f8cf58ee9a675d2fe
SHA1 f68145e9eb3da8adc90b585fb92e19e530c8fe3a
SHA512 ec7d6403c178add9ed3cd0afae28ad38c9ecc198bb98abbdbe82d3e95c2fa7988cedecb87313cf1a9e012333da55e2a255206799d1b5365eeb5dbafa803a83c2
SSDEEP 12288:YpsfkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Zu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E965F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB92D0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 4ed198dd694ac4a42cae9d47c7f189950eb40cc4cd600ab43267c89495139b29
MD5 126409846b72d8501422789b33adf2ff
SHA1 1a197a5713ca7af1f8c0807da2aa6708ea8d361e
SHA512 597a4b7edd688940944e2e7ca559cd054dc0dd0ad32568da58c811f4844855ab569c5c7fc860be51b94c413c44570cc9bf38f43b5ee89cddd8beca78c4693ca6
SSDEEP 12288:KjU5xy5hHrq35OwIC1ofpJYef0GOSCoYP1:KAxpufpKesGXX
TLSH
T153452910762BD75FC6A940325E37D2CCAB707D05FE455B0372C8872FD5766A8BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 8d44b57b52637790a62229f09e0b33a219c978ecdc4fec03f8b85b8ec596ba90
MD5 f5dd209136fcd9ef51e0fee7420b47bd
SHA1 c89db8f150f8fada1b466c1540a38bb3de52a4fc
SHA512 0798ebc77486622bbaacd1167847e699a16d03597bdfb05e7c6d382d890a75aabdcb2b05c6ada2cd0e27fb9335185878c659e0568fd60aa7e33ce9b76f880daf
SSDEEP 6144:39hu47D47AqPUubPvIRxmIL042LhXMKpvBgp3zxpa2QaKDexHC71xF+CL/cA9cWt:39qPoV0vQ3PatRtl+kUoFtT
TLSH
T14755D8816537E38FD1F76072032AAB4DA774EC06B7096E2673C8443AD86A755A0FD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 168B
SHA256 fc5ea4f414cea8ac6aa337f3fb1bcc18cf09c1022873ba8793dcf966c741e9cc
MD5 e7571554e2ecaebcdadbe6afdc22b465
SHA1 c348ef70f02678bfdb6a384ce234bf38c6572431
SHA512 e32ce9a55f00000e84236da1d01bbda12a5ba53bc701325f7b2fc4d1870a11e83f86e31a91516fe5c1b8a70af944fa60d6319d6ed3b3bbda1293e35598d7247d
TLSH
T1C1C0800923FE51E50F3700CBD5413F5191427111CB41CE31F231770774A14010817C1C
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 0b2c1a1641b355acc27d28fcb37b1e82abdbdbd1decae2ba0621a830e16e2734
MD5 f1fe566f4ab257820cd43e78fcd3a7d2
SHA1 709a5e11dbf02a28dbef6014dbd718b43743a75a
SHA512 b666897bdfa57956dde42799c0c94e041d62e0022a63a94f1aacde0485a49e3a002a21d2ba4f6a8f746d630b92d8d57fdb5429e1cc3ad01ce0c04144d6ca4a49
SSDEEP 12288:WF7MiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:i2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16F552393568859B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9fb38de2e9bf731d3de4a8525828800b1a2422879b7a9aa6ccab803de858cfd6
MD5 e00c6685fb213e153f26baeaf5ec9c4b
SHA1 3b21ffb967bb2b630679ddb2ff3cabe0dca96284
SHA512 4036c9311afce09146c836fa80cc30e2b0d5c368452a187f6b7533d4dd2418b68a0d776d74e09841f2f8dee51ac9717e5111481e5638e52e759b968bb42663a6
SSDEEP 24576:Tgb6bmBIi49WNNFpg1rSvFv7bYw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Tgb4mBIBhGFHLNiXicJFFRGNzj3
TLSH
T10065AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 14b06cf625bdcef90ac72147fa813516a37c9037bd775d00408a740e88b4c802
MD5 cc0e3220ae4b1f8861257de61f8b2ec5
SHA1 8e28ef47eab1868aa622a3e8acd38969fd096b03
SHA512 2e8d4b1d52cdde85f251c38a8233ce07376be4b9d3d61054673db8164458bd66665cd17a6074f4f697d99422057fc0fa9947e0c85828820eef4e4cd6e89b43e0
SSDEEP 24576:MG88u8FpJqH1vzria7/m3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:v7ZFPqVya7/YLNiXicJFFRGNzj3
TLSH
T1AE85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5e8f961b78e68f72b678461d01ec24aa5a5a1252852ff4971f7bf640ba0e69df
MD5 155c148b7ae2637e8d484298e3f85327
SHA1 d4ce03a6f4fd63582e683985003128fd5da786c1
SHA512 a69563e6b3c464c8c56ed3c9a924db8316aab6c12c59574af85012c5998209ced73ecc07a2417022ac2b188c1378c2be26c30079f688282c3d4f4af50fc78c88
SSDEEP 49152:4BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjzLNiXicJFFRGNzj3:TG05lO43ba7wRGpj3
TLSH
T1C3D5C06A62EC11F5D1BBD07CD9C6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1bb38e8a8de2b1d163336dd766f4cda964cf905a4e8a6e772ee9eb851acc7fa6
MD5 5b2bbe247349d5bd9670afd5645e156b
SHA1 b3234c005e77e2c7d1fc4708f54f34e710337d80
SHA512 17ce5c764a6a7e91abe5168ae698bba90df687f0212c42e9edd6e7562a23f81cf6392b550f64a7a3659deb8b4c24d253a74fc17eb2c80c4fe74e4f6f64dd1450
SSDEEP 24576:6fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnF/TwSfVcYG3K/cJHlnFR+IGNe8jg:Sa5POZ3lJt2pasx2+mLLNiXicJFFRGNf
TLSH
T19065BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bc011a681160924fc9f70d6af212c36fb818ab4eaf8b5bafbc96072dfdd2aaba
MD5 605d8257e8b8b9257f9876347562bee7
SHA1 b8a2456b96a6013d98d372d603dd41089603743c
SHA512 8ab7a39f5030aadd6575d3e520d4d8d0769710924b83427f961427aa171644eb086224592bad9a987496e1cba583ee417d9e85b3beffcd25e907bcf8cfd5ecdc
SSDEEP 24576:aNcwHdjbyQ4nLC18lb/EOjowL7FkP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aNc/zEOVHF4LNiXicJFFRGNzj3
TLSH
T12B858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e0f87c5ae0b822329f78847f54b32d8e8bfb7df0e104dda9676f288d6fb03440
MD5 fae957afec0ee89e0dc881fb0b373514
SHA1 31b8424c4cda27979df5258a9c7a67949fbf2932
SHA512 330e1b493d0ed67bd382de26a17299bf982cde5cfc60ce804b5ba3a5b7d4b50a7b68291257064d8a81e4550c1a47df705497e91810a84ebacfed5ad4ea271f93
SSDEEP 24576:GzkNvNnaFeYhJNtmZBmz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GzMwBtOmzLNiXicJFFRGNzj3
TLSH
T16855AF6EB6E846E4D1FEC675CD238512F6727861073292CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 c1e943a62573871b6da41d6d04421b01703c65d2402778979a36fe649448ae3f
MD5 1a71121c1b38a41ec2c21196c6d46540
SHA1 8b97c9b508129bb8a994172054508f04a8e18aa3
SHA512 9204737f43a944d049fc5a57f7ac5bd81b12b402c1b5bdcfc1ebacfd483d8f22fd4300f0e3c7840b6b2890056c78a143e25a9d52ef712a592e9bebad0d35f2d5
SSDEEP 24576:IPUr+NQV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IJQVLNiXicJFFRGNzj3
TLSH
T17165F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 d855d9ad2ef950fc4f61ec5446d781c0fb53bad6f57e10cf46a3c0b76a5fc029
MD5 fd3815784ec6842e621aad4171b2390a
SHA1 c7463d4aabaa4ceeade1089d07bb241606503914
SHA512 727a879b97fc0c6c36983407ddc0f88587a32609c170e245c2d02be375da15dee0137ed0dcdbb24fe4f9e82fcef2839cf82442aba30ccf671428304b4c0f4bff
SSDEEP 24576:rD3FHshBIYQgAq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rDVHeBIAAqLNiXicJFFRGNzj3
TLSH
T1EA75E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1600-66-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1600-39-0x0000000002380000-0x00000000023E0000-memory.dmp

Download

memory/1600-45-0x0000000002380000-0x00000000023E0000-memory.dmp

Download

memory/1600-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1600-59-0x0000000002380000-0x00000000023E0000-memory.dmp

Download

memory/3132-423-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3132-185-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3132-179-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3132-178-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3132-399-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3132-424-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3300-224-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3300-228-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3300-217-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3300-218-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3300-226-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3740-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3740-216-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3740-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3740-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3740-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3808-405-0x0000000002FA0000-0x000000000323E000-memory.dmp

Download

memory/3808-406-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3808-234-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3808-233-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3808-240-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4060-496-0x0000026423500000-0x0000026423683000-memory.dmp

Download

memory/4060-409-0x0000026423500000-0x0000026423683000-memory.dmp

Download

memory/4248-49-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4248-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4248-318-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4248-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4500-400-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4500-402-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4500-198-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4500-192-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4500-191-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4500-404-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4528-371-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4528-157-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4528-159-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4528-165-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4684-154-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/4684-6-0x0000000000C60000-0x0000000000CC6000-memory.dmp

Download

memory/4684-0-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/4684-1-0x0000000000C60000-0x0000000000CC6000-memory.dmp

Download

memory/4684-7-0x0000000000C60000-0x0000000000CC6000-memory.dmp

Download

memory/4744-398-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4744-169-0x0000000000880000-0x00000000008E6000-memory.dmp

Download

memory/4744-168-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4744-174-0x0000000000880000-0x00000000008E6000-memory.dmp

Download

memory/5492-206-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5492-204-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5492-212-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5492-401-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5520-190-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5520-22-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5520-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5520-14-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download