73fb0b8a3b3c769e270aa51325f59485306121546cb3eaf58145476491c2eccf

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 07:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_8758a15762d3c6ffaec86fe6318c0272_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.4MB
Sample260805-jmvanaxyaw
SHA256 73fb0b8a3b3c769e270aa51325f59485306121546cb3eaf58145476491c2eccf
MD5 8758a15762d3c6ffaec86fe6318c0272
SHA1 bbb99dc878edd02d8f3fc5df14dbff5a13df326b
SHA512 3cf87e542416b4c28220e4f77edb817763b2e69a4899fc13c32b475d985b8fa0fdedbc5ccfb6819fce6b10c8733ef79d66dff8b893ad73ba468195b3d8e1ebfc
SSDEEP 12288:TKVGgM7KPlalttGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:TKVGgFEltNnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T12A6501393681C073D517117199F1C7B69A3E68A21BA066CBBBD80B3E4F783E1477934A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3232	elevation_service.exe
6036	elevation_service.exe
4872	maintenanceservice.exe
836	OSE.EXE
2176	PerceptionSimulationService.exe
4748	perfhost.exe
5864	ReFsDedupSvc.exe
4564	SensorDataService.exe
6116	ssh-agent.exe
2760	AgentService.exe
4116	SearchIndexer.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2864	takeown.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-05_8758a15762d3c6ffaec86fe6318c0272_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-05_8758a15762d3c6ffaec86fe6318c0272_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-05_8758a15762d3c6ffaec86fe6318c0272_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-05_8758a15762d3c6ffaec86fe6318c0272_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-05_8758a15762d3c6ffaec86fe6318c0272_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-05_8758a15762d3c6ffaec86fe6318c0272_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-05_8758a15762d3c6ffaec86fe6318c0272_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5953a8b1763f1d8f.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaws.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-05_8758a15762d3c6ffaec86fe6318c0272_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_8758a15762d3c6ffaec86fe6318c0272_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d7411afcae24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f7a67fbbae24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\explorer.exe,-22000 = "Desktop"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000048fbebbbae24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fdbc44fcae24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000030702efcae24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006b339abbae24dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000298eafb9ae24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3232	elevation_service.exe
3232	elevation_service.exe
3232	elevation_service.exe
3232	elevation_service.exe
3232	elevation_service.exe
3232	elevation_service.exe
3232	elevation_service.exe
6036	elevation_service.exe
6036	elevation_service.exe
6036	elevation_service.exe
6036	elevation_service.exe
6036	elevation_service.exe
6036	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2864	takeown.exe
Token: SeTakeOwnershipPrivilege	4316	2026-08-05_8758a15762d3c6ffaec86fe6318c0272_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeLoadDriverPrivilege	4316	2026-08-05_8758a15762d3c6ffaec86fe6318c0272_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeTakeOwnershipPrivilege	3232	elevation_service.exe
Token: SeBackupPrivilege	5864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5864	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2760	AgentService.exe
Token: 33	4116	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4116	SearchIndexer.exe
Token: SeDebugPrivilege	3232	elevation_service.exe
Token: SeDebugPrivilege	6036	elevation_service.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 2864	4316	2026-08-05_8758a15762d3c6ffaec86fe6318c0272_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	90
PID 4316 wrote to memory of 6132	4316	2026-08-05_8758a15762d3c6ffaec86fe6318c0272_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	93
PID 4116 wrote to memory of 1728	4116	SearchIndexer.exe	105
PID 4116 wrote to memory of 2820	4116	SearchIndexer.exe	106
PID 4116 wrote to memory of 5516	4116	SearchIndexer.exe	107
PID 4116 wrote to memory of 3876	4116	SearchIndexer.exe	108
PID 4116 wrote to memory of 2016	4116	SearchIndexer.exe	110
PID 4116 wrote to memory of 3212	4116	SearchIndexer.exe	111
PID 4116 wrote to memory of 3240	4116	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-05_8758a15762d3c6ffaec86fe6318c0272_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_8758a15762d3c6ffaec86fe6318c0272_elex_mafia_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\SysWOW64\takeown.exe
  takeown /F C:\Windows\System32\DriverStore\FileRepository\ /A
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\SysWOW64\cacls.exe
  cacls C:\Windows\System32\DriverStore\FileRepository*.* /E /G Everyone:F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6132

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6036

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4872

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:836

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2176

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4748

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5864

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4564

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6116

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2760

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1728
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2820
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5516
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2616 2612 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3876
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2016
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3212
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2616 2612 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9efa3c3495c3fb087d5e9852edef3a34f683dcb5466c95b89050dda9e0f69299
MD5 124d3c22a69e2a39283f337bd5ccd279
SHA1 5e3909eec005b0cf60a83bab21a1c6ea9aac8b5a
SHA512 eb00a4bf5d4e8068ff53dd38a55214f146e8a558100a34be761770132f89d81d762670ecb862c1dfc030fdd7d60cf8b1a2483514f4f13ffa2a65cf1c2c78083d
SSDEEP 49152:Cb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnDQ/lFTjN4:k3q6HjB3Lm
TLSH
T15CD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 25b1c700e397a4be80ef034908d03dabc533b7546c3b511a72f7cda5020c3c2a
MD5 4b526b6675d87dbc3baea23a67fdee02
SHA1 17b6b47f0a29907814fbebf0306de4fb20d822a3
SHA512 036fb8e168f5540cbce508a0a127656edea32811a133b49dfb607c6f56b278fa4b8c662a1cd480579fe59d09df3024211b58c2fd9e4b1a4e552374dc26a6f349
SSDEEP 12288:M1XLsswWkxy2lRq2czAYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:6XYfDtczAYnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T10465F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 5ee5c49bac7f6a9e81cedfef92b869f1ac6d0fa5ab21505c487d6280fb3477f6
MD5 e9082e5a26185d99762a6438f4113aa6
SHA1 35b9a126a8b2d4f25934ae3770afa622b02f971e
SHA512 b3879eb5d87e1c38fd87b278170e3331c0f2d9a097e795483f2623a6c3df1eaaf70931eb7c8deb736ed990de6516c6021d25d7966c0ed5acb57c9e8e79f15f07
SSDEEP 24576:D0Le5ji0hmxLrMEnQ/tbw/2Mkjy6Fr7g0o2:DPji0Al5Q/lFTjN4
TLSH
T193859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3a74a69e57173db405e4c491190fd2dff7df3b6a30633bde93e06fb68912d06f
MD5 fabd3ac06ded00ccc6767cf3fcc8b28c
SHA1 98cd1f5697549730d285c5eac793988c2ee383b2
SHA512 cf469306bcc4ba97e5034bba79ce4bac8c96135add6e30ff3536d5faae8d06a1ccda5fe045379203aacb29b19a47f8ee37e72f99b6d56d78cade32aa03a1c995
SSDEEP 24576:Ba7/ezSC6vUyD/aqgrvWE6q8wyuunQ/tbw/2Mkjy6Fr7g0oI:A/ezSC6vUzPvxHjyNQ/lFTjN4
TLSH
T109755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b48ef20546819aa4fe038126ce944fe3eef1954973d0f300e16780995ed7a0de
MD5 4995eff039f92edb83cc908e9733b80e
SHA1 0e83588f5070bbe9445ebb1f60fb5a647a23b88c
SHA512 60e7703ae07c6c6728f94661165b2edbff94d8ac55189dd55361c45891843d2d2489718fd27c050a428a2e2bdcd4df1515a50ddd624c838a6760b043e0fd872e
SSDEEP 24576:NVbqPb88hv/l+6nnQ/tbw/2Mkjy6Fr7g0oD:NVO88hXl+4Q/lFTjN4
TLSH
T171559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 5fdde8c24ff6d8009983f514cfccaec946202f8bc43be28d538ad77d86caff3a
MD5 09db6a76daa119b438b09a7d033acd47
SHA1 932641677b8e1f71264d6c6e0e36ac287050b794
SHA512 b438369606ec175b18a99a39d949114c713730805f26c79fe377e3dc52ea5d5ca3c94eef5c0a02229537fc9b9e637b95af5a616b6677d9cee3c4694931e91bd2
SSDEEP 12288:DzQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:DzwnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1165523796A24F897FF2B06B55CC284826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 2b17c501967f734c3e26a97c8e5d8e3b6682f2b1207614f3bd815a2edcf727c1
MD5 05c1565e2d53b5e8122c4cd37659fc5d
SHA1 2e735a764b794d1081088251f3b0a3d4ec57afb2
SHA512 9d4cac97c66ce1c29d5a7bc7650b11959ba9f0d66f11d6ce3038863485f7f672280a68c581a52bfe28495b785f8b21793a456477d74a50b87d6879421393bbc3
SSDEEP 12288:weBNUbTVO86UvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:wJIUPnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T11A75CF3BAE28FCD2C27E4DB85A918640D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 312f681dafd068518e29824306b8f3cc7ed3d1e9e7477db880037a9ae2ac9ace
MD5 ea3a36e89600fd7d88072b56db73e003
SHA1 23c6f815624dfadbeb010790cd8324f7fc042dba
SHA512 66fa2d0ce15d5bbeb8b8ca556a310048105c5d663c0ebbf883bdb2a9d22daad9129be6a60dcc6fe3f03d8a01616e252d3f62d6ac368a7560c893915c77e174d5
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THP:mQvGAdlCEL8c/yRNw5CZLm
TLSH
T10F267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 4c0e652ac4a42724623cefa23c8cbffda4873e5ffc07da2811dfa5bbf1baadc7
MD5 4cb7def0fd7ef06475c2bc3a617ba7b7
SHA1 8d8ad305aa0e3b19ec4f7dc9bbe9061af5a1eb53
SHA512 b1ff287aa32ee6cbb3feb51dfe6565fb3ff7262340c0f6b9fd57427717cfd8d6aabc0d1cbc0d51e26e6d048940ad3ac14f5aa69340922b4b1dd5620f526137db
SSDEEP 12288:qAwSfxL/2Dc39DLLmt0LDQewsAj5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgn:/QewsAjJnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T12575E031FE74E436C77F0DB61B22C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 13f4825e383e38b9e72c729e567892395b25ca1926f04cff1a5310051dcc4c99
MD5 c994a7e8debc72754880f03018977da1
SHA1 c97e98b42e279439bdaa01925c998c8135eebad2
SHA512 560b621ac144211e1a4362cf3a1d901d1d9dce97628b1914ca7ae87ae550db8c06742a1699f69879ee64491da96f88e50d9c6b9c0a1b31df471cada0ba81f24d
SSDEEP 196608:TUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHmL:TUEtQevvqc2W1cpV2EI32
TLSH
T168474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 af96a8f7df88438b32681a489641b1b8be8250ac8815b73962bcb48edb8be603
MD5 2fcc556b60116a2a75bdc923111175d8
SHA1 f8bc82540bb37b26146c407fb51ac76f0b4c10cf
SHA512 18017bf734e1b3802a519a97b779cae0d717738b070946985b7f85499d79af64e98d85906ad5a6ff99785bd680ca8496e78a5d567aee77af63f116223c36848b
SSDEEP 49152:XCbRquA/m2yL5zQfFiV+XenmE3/zpQ/lFTjN4:AoqtVjnmdLm
TLSH
T120D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6eef1b19910a5aff3909dc9403205950688c3065dbf563dab88ee1b720fd637e
MD5 e4d0faef6d8318f3fa506ce1e975b5bd
SHA1 274d4a67024e5020ac88020082317e048d2ee10b
SHA512 4275bf4a13d73504e8fd5238c2f6607f819c581171080255400a31df7f5046cd6bf8f713a706d64ff65ad66185957681acb1563de22de8360f662cdd02055f92
SSDEEP 24576:8AhGLJIFoiwtA5l7S53ynQ/tbw/2Mkjy6Fr7g0oN:8AMyFoiq5iQ/lFTjN4
TLSH
T19135AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 7610404a64b9ea389617a9ffb2aca4efabda64bafc4032e35c27c2b60e5ea6e2
MD5 8a7d56b3ea5d8dd8dad4283fb3f1d680
SHA1 c97e6edd4f9b0cefdbdba3d3f0ff381fb0aba685
SHA512 2a4549b2a2d487ea4fae738bfc840bd7abd187c94bd6f017e1d0de672d39d031fcd7b666517027c9322020614dc5cd244dac764e4a41c4245620d837c7e1367b
SSDEEP 12288:wmw5HEjsChN2BFgl0WDm+CNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM1:twuHOWqnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T13465F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 41cc2062d8e6afa31c952ecf0f4380e87f3940b15bf6e54c7e352942e5108282
MD5 e7624b41eb39bc905cc3e7285aac56ee
SHA1 8b86c64ab4fe27523c51aa6ae6cb72ffaff198c7
SHA512 fe25d6ede043fc22d8f78efa810d2e250ca2d2e2f48f0e3b95b09944a4bc052ea2e1b85110c937dfe30159b0fbd8a6a23417f04c25390e15e5d35287149351e6
SSDEEP 12288:QXZ1IyJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:YZuMnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T16D55126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b68897f850f7a73123a9c04d428971ef5c13a85f21956c37f00dedccd9377d0e
MD5 239260c0faafccee515ed0c54cad4a2c
SHA1 e4f1abd4fd96d66c508fd44e09168e9f58e76971
SHA512 611f4431c5073adc25ed5e3d525f2153d0cbba48d8a9378d29d7d6da01822e33fe9c30d335c4c5c2546fb9904e2613ae43cfa3beb59eb59cae3e7b75182d187a
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uz:QQRQyi36YOcPQLvw2gAf+PN3oLm
TLSH
T1C3666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 79d16d9b4dd97f97c419376faa5c83d2ad3145a300ab9fba08ed3e3e2abeaada
MD5 1627f0307b57a4a108e217ce8fc0a99e
SHA1 c900b802cc8e5c2f160fd33130b1f29b21e80ca0
SHA512 50e8db56865bcef4dbc991a6ee14d3ed520cc8edc47046af16e9c26acb84bf9422039ff7bfdd31385daa88ecc841c28ca61056cb258e42230d81b2de1cab2ad2
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uz:hQRQyi36YOcPQLvw2gAf+PN3oLm
TLSH
T193666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 74839dcf9af58374ad02a4d4d5aafe2a4a88903f0628160bb52407b1e8483059
MD5 e5b8f2b58a5c88bc97f319840084c5db
SHA1 e670792e3aa10f8725db9844356ab1f91dde9479
SHA512 817b97c3fc5314cd600ba8d669151f52d7b9d55f81f7a7ddcbd0644bc6625367a2275422c920cd82972d9a045ec2e816fffcb58632c4911ba7ff6eaec77be1b1
SSDEEP 24576:3wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL08nQ/tbw/2Mkjy6q:/68Qg55nhheWu7PNU3/5Q/lFTjN4
TLSH
T1E4B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 446941e028f61ab8423040f2bf36fa1e2d93c67e84c38832f09b2fd876bee8fc
MD5 18ca1478c5a5a628ac1fb8252ac4f734
SHA1 ecfa0d56e95f39a3c7d4e7572d234ef611343b43
SHA512 e77b889047df7f03cce681dcee22af21813b377ca23e9d90eed1763495a23e8e365b4961e487148bdc8de98b86dc042b3ae8b9e11bf78d8888d85085ee8539e5
SSDEEP 49152:y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99J:Ty5112gYy5azzVvL69nLKnhZDLm
TLSH
T1CC167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 94e5bfefce1a68ba661c8d96c29314dc2388b5ae79d725f3438194b571fb9416
MD5 5f1964c003f26dbbae006f04517e2fa4
SHA1 c8a1c389c24565a1c02dee6ac1e5ef64e4ca02a6
SHA512 f671fbdb3c0a70ff7200bdaefc48f449fd276fd8f8f726fb6fdd08f4432f3bf4a2d0288cffa2bfb4bd9489b3553e8474868aa1907e1e603dc8b914060215491e
SSDEEP 49152:6B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gloQ/lFTjN4:ou6JmVxd2dLLm
TLSH
T116D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 de04e1be33a11888440af0a5b3fe6427d9f9fde7978e6430d8a7d63fe923979f
MD5 f86c5c68d3396b130b4b7c2378bf3070
SHA1 a1ea39f86a08c62e4ab09b05d76c469815679832
SHA512 d02372dd96ce2723ff65c928510cd427d39530a0baef1863d101f87e3ea111994b27e1068365ed472588f047fab7b6cd52070ac32338e69baa93a23f2ce0e9d6
SSDEEP 49152:N1hpsNoJpF1A6UU44CwH7R4xvQ/lFTjN4:NmifPbRdLm
TLSH
T13AB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 de7632d891bee146c1ee65cfb5cdb823ab12bc51f7cd0addb03916de3048e93b
MD5 ae46f2742b941a4afc31dca9b059dc2c
SHA1 ef3f9b6ed9b34aaea19cfccaf0382ea2d6cbbcca
SHA512 2b8db2ff5f15b827be83087dac6ad1161e1b9c36f41aea80d343e95bf5bb530e88623f7abf2d4b71874feb4f205c9627f5d0a0ba35c8d288d84b8cc51d08cb17
SSDEEP 49152:fSuZQIY0Be2KRRVtOnks6NMHqMQ/lFTjN4:l5dKTi61vLm
TLSH
T1A0C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c0d5856bcc01efe16de65481271a151558a461e80711fe7259f25df6d4f8aac2
MD5 98769842c9f59e035c4e888bf236bf28
SHA1 f17f718c5a2107679a9ddf5cbbc40d667258b287
SHA512 d397d3fa35f90cf50a5ea9a17189e315528a37394d2fb5487ab025d399420ce145df634196a5b61cc6f8d37357c41a4261083a054a3d1ee42b0d61bd12baeb36
SSDEEP 49152:5htSn8EApI0figngiDn0AP5wbQ/lFTjN4:IX2iyphBLm
TLSH
T17395BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0e61347a3210414b4e08e2d0c0151e7706050609e01f47135a15c86e2ca814b6
MD5 07cbe5325c28f7061e39bdadecacd45d
SHA1 57532714031065de5f868a503e7665c427f190fe
SHA512 17ec3062dc897c1ea46af33d5237c6528dcd321d65f706e651e13fc425363cda7be91341c8914ead795f72c236049cdcb8143bdc9daa448b88225bac6d6d9742
SSDEEP 12288:S4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:S4nQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1155523697964F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 5633e096b7712684e254f356f81e56d000f3e8ee7868318701e4f1c6f3d4855c
MD5 fff615e0a27005ad99d4a7be6e4ab112
SHA1 848e9d38f6b27d47404acc676e6ad49fc93c780b
SHA512 b7b0532e1204c66136fa50375a270a1b5931381e74ee22016a30768670f34be56fb6c08863977b1a15ac01726479994c9abced908133a4eab71dbb144dc0948f
SSDEEP 12288:ulGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:uFnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1DF5523697965F98BFB1706F18C8281829B3B0EC6BFD1938F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 18ad334efa522c3251f748e1912b9cb23d763b15497141eba3b93eb9213842d9
MD5 ea35cb0a3422f7385f988eb415f03fdf
SHA1 4036a0ba616a85e63604a871f79f568112f15ba8
SHA512 cfe65c113a7b99843125326220eea37f1ec0dafc57bbb46080ae998b84005ab0346bb036e3da252e5b98c4d12df23e43d9708a4d12931db087a90db258689863
SSDEEP 12288:d3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:dXnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1D15523697965F88BFA1706F14C8381829B3B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 9866c8e2e168d1c21eb9e22a12e3ccb38ed7e6559e78ed8f5de53b9ad98da3fa
MD5 49e97ef91c58c3e6d256bb0af7cfdf0c
SHA1 245d337f8b9d3c2f588b5c4c1f3130b6ac51f6fd
SHA512 2b6668e1e2746b0323dc7da5d83b90876fae6af5e7b12dc30fc5472d22b331cc9bc1d6783ab5a0cebe991b5e895364454236eeafb4adb5b356a8d53955d79f64
SSDEEP 12288:LVSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:8nQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1AF5523693B69F4C7F92782B4CC928142E77B3DC5BBB1A38F6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9da01a13e556a664a9938674c9e9f5c60024a2784bf5ebd43c39b4add45ba4a1
MD5 035bf23f5a567f236a7b87e7c86f82c0
SHA1 4f4e7894cad0a0d8dc82f7c2dd0a395ee61866c5
SHA512 7b44269ee167efd6b25ded92dcc8ac805db4f98e549b55e9101a4a3d03e3c82253cd99ea9b814372f877e6fb5de3309395f06144445f2c381151a3c427e458b5
SSDEEP 12288:+KGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:+KnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T15C5523697965F98BFA1706F14C838182AB3B0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 7cec7354db7098d3e13b3fdb80bd649d94e1fda2e34d9ed2e401f0d4d0186e37
MD5 3741f555a859957c0e12f08e953bac46
SHA1 cbf92a0da0686094e17c5bc90cff3cf3b57ec79b
SHA512 854975310368f40938fd66b5d15e10e5025e54ebedc564e2993863008bc599e9bd7c3d305ea09ecfba801a31f5d51487fed3e29e640e6606429c4865e479e961
SSDEEP 12288:SBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:SRnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1C15523697964F98BFB1706F18C828182A73F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ebb6043f233a308317d2c90b9748f2a2217f7a1f0e0796d7469a30b70a7c5366
MD5 341df2fe8d079fdfdd0c65a0f70d0f86
SHA1 cdb62326e214fb5b2914a81268b9076816500466
SHA512 f8cdd197505c3376f71701a703edef6deb4490fb970c43ec1126e78f9c30ddac21491d3561b03f983921aa750e1930e6233793fdd79193eb4d0dfa02f3ffb47c
SSDEEP 12288:/9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:/dnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1115523697965F98BFB1706F18C8281829B3F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 12ede31350616e11e03218484682254bc88da7332c928ff275ffdb178a7c6f44
MD5 e029e96b4a8829d7f6effaea5b619e9c
SHA1 762d9e05686602bb2efa9621edc297bc253a4753
SHA512 0e4980550b8d4013f6d8836836f4aef7a0cb97bdce51420cf8989f798f1139a94a740ac49e37baf863bb141a3f7e67fefb4857b6ff9eb485c0ab3ec4033be2f5
SSDEEP 12288:LiZwbDzzFEoS2cPvyFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:2ZM3zFVSOlnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1157501A5B39058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 01b52d49778e9545c8c7fd4c774750b28ea31bde6eef9ec3543fdae47bfbdfae
MD5 12bd9619c44cc15c4af3ad4acbb0d4f9
SHA1 597ccced1eba83ad221cf0a169c670dfe4613885
SHA512 521730613e41bdcaf36b207d6372005e6f1a5d7aed6dc052d9ccb683a411e3014fb2a268a5500004168850ce4289a274979522b5dc7566de280eb3d527a14c0d
SSDEEP 12288:FcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:FcnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1515523697965F88BFA1706F5488281829B3F0EC6BFD1A38F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e7cda9180c58bcb479d6d08c107a4d4f7e85c1863b3262e5933dc539170a54fa
MD5 2145bdd5de30ec2d381880d38812415a
SHA1 ee56dd5ea7504f99fd13206cb4c75b2e2071f683
SHA512 420d8d7daf1c98df9e58fc8e648cf1daeb6728dfcd489607059a32a21ad88b8223e72c4cd193f54d39c65a912263c5554b36f4bd8b8013f8d1080537aa8f3f67
SSDEEP 12288:NgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:NAnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1F75523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 ab79d66f829faa481675a487a4cbf7418fe7e21b0ef4d3b06e0bf276937222b5
MD5 201ad19fb82865f20e7ac768299e1271
SHA1 c24840026d32c9e63c9ea2994a934a05f192ad40
SHA512 418d8d63d187fb428786632b10b148d410f105a41311c2c6add395e1ee56400810b7d3c34d8c78f478f343c2db0a54bb8a574b1dda822720da01fb5505e7443e
SSDEEP 12288:VyPz5L8JGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:8zyZnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T13165021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9c15dc638714db65ddf556deb76d3f4ea0164ac963b0e54b5bb0cab9dc8588ef
MD5 d706a866fd5faa3829660679199c0e61
SHA1 114c4328df700b332852cc9066924b8fb324e571
SHA512 56f2e895b55c961b1d8e573628b427c4d31208778d9757e0ea803a3b16115dfbd464ce4a2a8129c971a2381f815474e511385c011493a03137d83e0f48499fac
SSDEEP 12288:YcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:YcnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T17E5523697964F88BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 bbf79397f80536d4d6f020aa0b2fb68a4d72833a2f1cec41de4cb68161e2ecb8
MD5 96756d6b53a78d6efb7766131ff0dd2b
SHA1 d8e6f9b90a8f69429485f5acdc6c5906619a2850
SHA512 9f168152a43837deda57802d556696b1e74811d3579f03dd43b311d5acb9a614e729a2d54c9da264bbe64163bac7523b8c0afce7e9646647dfdacaf9c294bc60
SSDEEP 12288:LcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:LcnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T11F5523697965F88BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 c3dd313da21f93bcac02f2397b77c5200a26298e5e57e26b575c6aa2a9f389ae
MD5 48285a5e7759357b2722eca5ca021d45
SHA1 26adb9e683afcd74ae036f2cd1077de09ca14fc2
SHA512 ece48f57ce97a5a7eed53847d98f0d1cb6bcad4f3b9badf7ec4f6aca76880b298eb64d82243826cc0425eb1e2be2e79da72a1b5a178511fce5d499053d69b7fe
SSDEEP 12288:QyPz5L8JGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:hzyZnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1A965021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 d8f86eb4de50424514ab11f14b2b054a6a362e653f7eae730baf4819689d48b2
MD5 fcce23f81a6b7003ae24579a2214e664
SHA1 179c8cbeee79e7e27f0c293de6fb129c58716737
SHA512 9ddddd300720067daab6e32559235c981f2ca2b37927ce1455c6864909ea4290f43e54554d0386a9d24832c697ce4bd338d306ede7df33694e247cfca700dc28
SSDEEP 24576:eT0aLl3z0zDHnQ/tbw/2Mkjy6Fr7g0ob:eTDLljuQ/lFTjN4
TLSH
T1467501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 f055c846e6ff059abc0bf0f95fff9b2c0b3f0eefe5068bc695b85d2b011d89f9
MD5 3e5f110aa5e4f7dd57a0234127995d6f
SHA1 6790ea9e513361ac9a06c80a5185afb49de57de8
SHA512 a3e4b6d7f4d680c66095696cd9d1ff67f0ef8b829abf8570af15e76a2e75cd0550b027756843b4bdb98674ba2166a90210d34d09e7f3c8797bf5330f430ea512
SSDEEP 24576:531d9CHKy7GZjnQ/tbw/2Mkjy6Fr7g0oy:J1d9CHKyahQ/lFTjN4
TLSH
T1F585CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 6c5c8bd5cffae821ab446936c28c2fb91fe61f1029dcb0980a7d455513816909
MD5 ff00175ab00fbea302d066408df7338c
SHA1 eb8b7a3a43ecc582d98f30a949ed31f424ad010d
SHA512 da921a361e425a9e1323036310ba5824fa25c1543c3510a410855a8f3e9cf3209896520f4fdb86729df077b1a529ff4151568655ef7e84d82e5fbbe19081405b
SSDEEP 12288:UXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:U3nQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1625523697965F98BFB1706F18C8281829B3B0EC6BFD1938F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 ab9e71317c09636687ae5d3243f567a6a1a53f2b24d34578d336ff43ce3d8e6a
MD5 19f1163b6b42e030758c5140bcb58fef
SHA1 4d9303b42f152d4475e09196d9cd1dc188084528
SHA512 3af4fb0d92a7aa06439994deaaa7786c785ac59a77c8551e2e7fc7a3a49dee195a4c823690f34dad66ba2d74d806cc6f269be6fe2f03c674dcb65cc0c30d1063
SSDEEP 12288:spGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:s5nQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1DC5523793964F89BFA1B02F55C8381829B3B0EC6BFD1938F7B481129967D39406DA3C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 8f543ed179cbd31f1a0607fc971d34822e54f326385a2453115f0a8a2274c6a8
MD5 3e2014c5de6de9e2639f48f05ed032bc
SHA1 fcbbf1f14b7c7e9fa3cd804609903629ab4f7e49
SHA512 f458d18619c5c4381c636c366366b66870f7e82f0119e988efe8131ed0c988172b8a2cd1fac5d48519782f991af778a524bf61470e2e7810a068f34ae4e8309a
SSDEEP 12288:JmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:JGnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1FA5523697964F88BFB1706F58C8281829B3F0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 743e89b929fa10bc3440f8dc1ac004e99ef801d27c8646c3b3539aca2ac7f47e
MD5 0785250436a6b75a6a6cc564b61e5959
SHA1 cabe8087205c0c8a7ea07f7550fd731653676227
SHA512 f18ff6367b4fed93e7cc4b4fb42e27fa13f3a3ca06a1dac1663183d4d0787981324c8403e669d6a8d0beefd2af88844607bf350f0e955898384b99195c240258
SSDEEP 12288:OcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:OcnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1695523697964F88BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 2f1197adee10f18215fcc1a499c9bee8654611038dd0db108b411f9ef054ab0e
MD5 965bf4d5fa436324b8e7a3b69f3edc16
SHA1 2ec3277406f4249b5044bc1081b93f6d215e907f
SHA512 0d761f003e45780fc917ced84d9b962c67f663115bceb4b981919dfe5b7171642643b29545db7c43956e92768de7861498da7d36c4461fdf9e2b314ab86f6026
SSDEEP 12288:6XGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:63nQ/tbw/2Mkjy6Fr7g0oI
TLSH
T12E5523697965F88BFA1706F14C828182AB7B0EC7BFD1938F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 7b0351281d1024a95e2b373800c14cab03b3020fa1b52e0e9555ab56e558c197
MD5 641a4a5c68020f546727dde04a0b3f7d
SHA1 f260d21ee3688cfc7b3fdd688483315ad5f3a918
SHA512 eaa5209d8092eabfb27a875479402f5c88591f07aea683c8681667ce367b7b4947a8d15b363d418d3252cf6bb8541c096f042f79a2f965c0d1829a3dccf1fe92
SSDEEP 12288:WUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:W0nQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1FC5523797964F98BFB1706F18C8281829B7F0EC6BFD1938F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 a8520efeb4accd65820f445e9e8a4359d3940f3eaccefb466a08b6a246c099b5
MD5 5125f12e8b48ac34f8be20a7809dd685
SHA1 e05ef5fc3e6d5dff6e839dedd10f1e40400ca533
SHA512 c9373094ac0062a47b7adeaaf8e5c4189ad84f9fb21142e010958dbc66f3ee8201625026b948372bbe5a121cf9d0ea042f3170c487191c9fdc3139648a1bc62c
SSDEEP 24576:Qfwv/k9RX6wkyAIQnQ/tbw/2Mkjy6Fr7g0o3:vMnYIQQ/lFTjN4
TLSH
T10685DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 61bec44140181bc0461852fadfb16b5ebf5cfe507287ecc26fe4e3864d144bb7
MD5 76ae225a2ec8df425ffaea1881ac42a2
SHA1 091461a3f7f716e325877a77196317f6d77e485a
SHA512 ddd66d38224fba68085a01b69906a30eb192b82cb356ec30da1dd6dba35d88cc339386711fd20cfb42c756654ef92027ed65a619c33d5507fb90f355b66e7983
SSDEEP 49152:FYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK07Q/lFTjN4:FySzPILm
TLSH
T1E6066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 06c7e02c41793b50ed370b126f868c52cb13fb673bd371ebc1ca81ff089ecb1e
MD5 7294c2f84aaa813300c0ff5faa3b4f7f
SHA1 fd0a10f85fd093c04abe5e0696b60d2096d47040
SHA512 d06799fc98a6b52f38827e811691b739dd377df010772de9257b3d444262d22820bde26ae9055722f45a1fdee45a2b85e5901141691aade8adfc9d72ad9eae16
SSDEEP 24576:N47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY1nQ/tbw/2Mkjy6Fr7g0oR:N47JUQj1irIhCnDHUPfF/LQ/lFTjN4
TLSH
T1C365AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 74a6ada7e7d7b55affe67a58295ac4b338c877179dbc8863acd6693a0f0d64b2
MD5 744ece12c47a5b756e99135b57de7227
SHA1 28e33ac7fbec12f6fdaa2598133279847b223f27
SHA512 815783890420ff17c1cb57ffe463b49050bcc5dc62e8828d068ed1e9404235a0e8a1ff3808bde1ce18042fa11f4767bda792b953db2962a5f349ab388b4a12ad
SSDEEP 12288:tssfMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:9MnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T16365F119E29852E9D02E5279CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 89782716002d90031eac9210b563b35ec6bf92a144925bd82daddeada263ab78
MD5 6afe6fa930a90418563c66dc1886f793
SHA1 b33f27e10628499fe966c1cf3b0da949d0a85ed7
SHA512 9c0e91393cfd901d34f8cd3237a8cbe1d4c9341f1323ef34634cd6ebd4981d3872b7f0140e0f853fa0eafe7239b65f69668239193b230beeaec1d754221321f4
SSDEEP 12288:eIkRjU3fTxaxoZVfuEFdR8597KBcXze744fLRpcW50zOt+:ed1UPTIxYu6dR8KGXK744fLLV50zOY
TLSH
T151352750B62AD75FC6A844325E32D1CCA7707D05EE44AF0773C8873FD576668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 f332c9ab6865170c28a0d102ee7e9e0401818d9629591597927cf4a283d0cd85
MD5 2b02fde62b3fab9a75cd49f5f78f752c
SHA1 2776e1ccf087cc9fe92338ef4cbb2216222d9c0e
SHA512 c9c57f59d97672edb61d1d5fd730f316c0f1faa69756d27d6969a491cd0ae8edd7e3be473b7065a87f4bb6b45bea21a14d507ff9255c6d9d9aada2bc04ea6027
SSDEEP 6144:Peh5hxlAt91LGcxSAQAaA5Qb5IXM8Ox7MytMxYMytMxHcLhX9K4ECdOCVBPJzHjG:Pz1LGYXpvKbWR+zPJzHDV+b
TLSH
T1F5751B816537E28FD5FB5071032A5B8CB774EC06BB456F26B3C84539D82AA25B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 ce02c6d5f3b1c63c9c8de97796b2ea2c1613faece8742cef475acb9a8d82aedf
MD5 313bfec2c2b9dea83a8f26faaa1850b7
SHA1 4936822d4eaca201ccb3c0fe978dc3b18e1c6f55
SHA512 90f02c95790d903b8e7bc36ae2fe27cc6f50adc7007e73bdcef3cf7171ca4fb95020d16a736976c24b4addd1b6ed26352b59263e9fe1d104aacfbfe476620b31
SSDEEP 12288:+67EGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:RknQ/tbw/2Mkjy6Fr7g0ow
TLSH
T19D5523756668F94BFA3B06B058828111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 91aef7237aab9029fbff9b3fee0b0c816a12bb96b77bfbbc80ab76543312e674
MD5 314659a16e06c771750feed57725be38
SHA1 a8c39f8f4eda17902081b9bf037d13504b6b06e6
SHA512 631f380ba18218a990effa7001205517983e68ec4401ff8eda93efd6e64aead8f7f7e1364754a2bb455beeccc2d15c9200203d83673f4d1a47c15e33d83631f1
SSDEEP 24576:lgb6bmBIi49WNNFpg1rSvFv7bYunQ/tbw/2Mkjy6Fr7g0oB:lgb4mBIBhGF1Q/lFTjN4
TLSH
T19E65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 dfe27283ef3ea8abcc302ef9bb4645b40e0ffca36d56ae5bbc0b425e5b3cf4fa
MD5 5704dea708b1dbab1267a75e42183e19
SHA1 007b39e1eee616136f052862c0f1ddf9fc061e77
SHA512 6c5cc63eb58119dea949e81c2c30dae9d7748e2d8c969f04e1bd4a6cf273f92df598fb0dc9919de2158e1c7bc6e2ae93c7f305bdf173248837335233265407fd
SSDEEP 24576:RG88u8FpJqH1Qzria7/mlnQ/tbw/2Mkjy6Fr7g0og:07ZFPqVva7/mQ/lFTjN4
TLSH
T10E85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b4df5fa1ae4383db6fdd4cf3677ca2649d08f803aba6668f0d1448bfe44abaed
MD5 a39783db32b774a80859aba794347ee6
SHA1 d426149b8f0df228c56659bf1ac347f738fb20f2
SHA512 505e7a96c41a26ca52fdfbec1f18a59e4f655da2c2f24d8aba9f218790c16de79be63934ab8cebf2acffd03b0123c4b8f804ef1518e5e9c4985b19fbf1de7058
SSDEEP 49152:bBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjRQ/lFTjN4:kG05lO43brLm
TLSH
T118D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 de20c556076e9a409f7f0f488245382a82f66499205f9198cf0991dc4e46ec71
MD5 0f80d0e99b914c11893c195f458218f6
SHA1 bd36a8768a4aa50b4b7c4110f385f7bc16e9ba62
SHA512 5e813bd9c360422efe0754d006cb5e542733999607f52d5a27cfd7cef78fb6c21f1dbee1a3fe07363dcd4a74d639af18a6ba4f4bff227f4ba4cdb31998ae5558
SSDEEP 24576:rfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn7nQ/tbw/2Mkjy6Fr7g0op:za5POZ3+Jt2pasx2+m5Q/lFTjN4
TLSH
T1EE65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c9ba48487d64c8ca03b886fd3ef898d47174dac2a10b952ebedb149bcdefab73
MD5 e161cc7e48c915c795a099b008cdd93f
SHA1 71ce0c9a54e164a20da6642ffce88340bc209c73
SHA512 191ae1a188e6829149520e283ada02c3757738928176b17227355f9ce7268fc1da1ba0cdb370ea3fbb9c84c55a66bcd1e9016ac5ba46eb20e70dd2a478df72f1
SSDEEP 24576:bNcwHdjbyQ4nLC18lb/EOjowL7FkNnQ/tbw/2Mkjy6Fr7g0oR:bNc/zEOVHFGQ/lFTjN4
TLSH
T183858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e44367a6be38ca86fbbb7537c8a4453d913a1f5d7f411c29f5ace89dd029f734
MD5 a3d03d19739e2b7acf04574efb5ae878
SHA1 96c86f365cdd7a1e5f584dbceae617f6f8a3ad4f
SHA512 a0b3deab6cc7ed16d03d7268da19c4d92a68ebe9751cc0a4e4a33191769c57f22e643c2acd86a9d94865dcfb06c9a9bad6abc16389bfc2844fef272b378b8dc8
SSDEEP 24576:n8kNvNnaFeYhJNtmZBmMnQ/tbw/2Mkjy6Fr7g0of:n8MwBtOmMQ/lFTjN4
TLSH
T1D255AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 2.0MB
SHA256 ee4a7c071b43d0c41d9274a5d63ff21c5b843fdb6537ce57cfff8a9db672c23e
MD5 8eb53c159f388b825ed7c24617d33e7a
SHA1 d1940cfe59a2bdd1d709961d2b7ccdabcd1d33a8
SHA512 16ef55dd3bbbc197d0590cb623c2e94cfe1ef04fb9568bafa08968a7583833ef2c3e9ca49db6a4d81289dbdd3fecdafdb7f757f07c5d7b5f9f6d03e33bb91182
SSDEEP 24576:8PUr+NQ+nQ/tbw/2Mkjy6Fr7g0oGnQ/tbw/2Mkjy6Fr7g0od:8JQ+Q/lFTjN4GQ/lFTjN4
TLSH
T1F4A5022E26A828E5F63B917D89828609F77278921751D3CF0390413E4F7BBD86D7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 fb2df09c39e2c00e7f99710bc33914b95e140180cac1fc0fd018788c196d58b5
MD5 4cd82f885bab04358f61acd05e343752
SHA1 25fc3ed0fd8b8f3562fe269c596af77c40ed210d
SHA512 3d00b5c01de3e27a4bacb1298d42e77aa5077f246a46936ecf4fe667cf93476be9d8b60e2ee0421fe75e6efcd212b81cbc7e1468da804c02e29d45b4fac77327
SSDEEP 24576:ED3FHshBIYQgAYnQ/tbw/2Mkjy6Fr7g0oR:EDVHeBIAAYQ/lFTjN4
TLSH
T1B475E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/836-52-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/836-238-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/836-53-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/836-59-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2176-301-0x0000000140000000-0x0000000140203000-memory.dmp

Download

memory/2176-69-0x0000000140000000-0x0000000140203000-memory.dmp

Download

memory/2176-77-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/2176-71-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/2760-139-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2760-137-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2760-131-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2760-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2760-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3232-13-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3232-91-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3232-21-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3232-20-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3232-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3876-329-0x0000022369E60000-0x000002236A02A000-memory.dmp

Download

memory/4116-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4116-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4116-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4116-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4316-1-0x0000000000C50000-0x0000000000CB6000-memory.dmp

Download

memory/4316-63-0x0000000000400000-0x0000000000566000-memory.dmp

Download

memory/4316-6-0x0000000000C50000-0x0000000000CB6000-memory.dmp

Download

memory/4316-7-0x0000000000C50000-0x0000000000CB6000-memory.dmp

Download

memory/4316-0-0x0000000000400000-0x0000000000566000-memory.dmp

Download

memory/4564-105-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4564-111-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4564-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4564-315-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4564-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4564-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4748-81-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4748-87-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/4748-311-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4748-82-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/4872-50-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4872-37-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4872-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4872-38-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4872-48-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5864-99-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5864-330-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5864-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5864-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5864-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5864-93-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/6036-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6036-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6036-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6036-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6116-116-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/6116-124-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/6116-118-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/6116-317-0x0000000140000000-0x00000001401E9000-memory.dmp

Download