022acfc21bd8e1520793dea0bb9ef063835960e428002c738d36560754327ad4

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 13:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_54ed18184385c067f240d52d04b5f3ec_elex_karagany_rhadamanthys_stop.exe
Size 1.2MB
Sample260807-p91c3sga44
SHA256 022acfc21bd8e1520793dea0bb9ef063835960e428002c738d36560754327ad4
MD5 54ed18184385c067f240d52d04b5f3ec
SHA1 a78201b9c278c49d8150fb6340cc5612e2f8b007
SHA512 baa477c4fe41a36a5bb65985ffcf1187b5ee1cb64e33739b54456933e54d47e4729bbdf4052d1b44b396b836de50782a3032cf720bc3ecfb976db1925ed5e05c
SSDEEP 12288:SfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14B55236B7698C0B7D87302B082E5E21A982B7D62DE7444537BD529DEBEB10D04F39363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
936	elevation_service.exe
4736	elevation_service.exe
1512	maintenanceservice.exe
4184	OSE.EXE
4880	PerceptionSimulationService.exe
816	perfhost.exe
4040	ReFsDedupSvc.exe
4404	SensorDataService.exe
3088	ssh-agent.exe
5508	AgentService.exe
3256	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3441f592e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-07_54ed18184385c067f240d52d04b5f3ec_elex_karagany_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-07_54ed18184385c067f240d52d04b5f3ec_elex_karagany_rhadamanthys_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-07_54ed18184385c067f240d52d04b5f3ec_elex_karagany_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-07_54ed18184385c067f240d52d04b5f3ec_elex_karagany_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-07_54ed18184385c067f240d52d04b5f3ec_elex_karagany_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-07_54ed18184385c067f240d52d04b5f3ec_elex_karagany_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2492	4332	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_54ed18184385c067f240d52d04b5f3ec_elex_karagany_rhadamanthys_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000e364c0e6d26dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e11a944f6d26dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d24994f6d26dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000063b6cd4f6d26dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008a366b4f6d26dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f93450e6d26dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074ee6d0e6d26dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b2f21c0e6d26dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
936	elevation_service.exe
936	elevation_service.exe
936	elevation_service.exe
936	elevation_service.exe
936	elevation_service.exe
936	elevation_service.exe
936	elevation_service.exe
4736	elevation_service.exe
4736	elevation_service.exe
4736	elevation_service.exe
4736	elevation_service.exe
4736	elevation_service.exe
4736	elevation_service.exe
4736	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4332	2026-08-07_54ed18184385c067f240d52d04b5f3ec_elex_karagany_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	936	elevation_service.exe
Token: SeBackupPrivilege	4040	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4040	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4040	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4040	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4040	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4040	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4040	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4040	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4040	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4040	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5508	AgentService.exe
Token: 33	3256	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3256	SearchIndexer.exe
Token: SeDebugPrivilege	936	elevation_service.exe
Token: SeDebugPrivilege	4736	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 2528	3256	SearchIndexer.exe	104
PID 3256 wrote to memory of 1760	3256	SearchIndexer.exe	105
PID 3256 wrote to memory of 1460	3256	SearchIndexer.exe	106
PID 3256 wrote to memory of 3264	3256	SearchIndexer.exe	107
PID 3256 wrote to memory of 4796	3256	SearchIndexer.exe	109
PID 3256 wrote to memory of 3152	3256	SearchIndexer.exe	110
PID 3256 wrote to memory of 5892	3256	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-07_54ed18184385c067f240d52d04b5f3ec_elex_karagany_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_54ed18184385c067f240d52d04b5f3ec_elex_karagany_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 596
  2⤵
  - Program crash
  PID:2492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4332 -ip 4332
1⤵
PID:1924

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4736

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1512

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4184

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4880

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:816

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4040

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4404

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3088

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5508

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2528
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1760
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1688 2856 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1460
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2860 2884 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3264
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4796
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1688 2856 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3152
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2860 2884 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 08219d2781357896e18feb7524dd76632875fef561b036ff9fd7efcc11c832fc
MD5 d8c61237bfe787b6b08334ea1cd1e235
SHA1 9a7e807c554d7b6865d6e4c768ad1b64b55bcb32
SHA512 b75e85a61a7f4b87e5ea95589a5e6014c208752f3de6eacdfb522086687d645bf2e25238ac515f5eb0f6e3f7ff963b84f08acf72be1ed8fc148d437e10576aeb
SSDEEP 49152:Sb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnhDmg27RnWGj:03q6sjBOD527BWG
TLSH
T11BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 13fd0894cdb4c1cb2cfe935cc9555d68f8ca4cbce4045e0b9ce462e364b4318b
MD5 c96513140e6d5ba7af9124e5e3339ff5
SHA1 d0ca35157bfaa75e908d384b8877e7941ba1603d
SHA512 802d985ef3d3a0d5bb2e410ad8a3c1a1ee49647fdfa52e7f70198431033c5cb98778e1a29e2642692355395a0f98079c38f4bfd7378c7d6d6e7e8321f1dec433
SSDEEP 24576:tXYfDtczA+sqjnhMgeiCl7G0nehbGZpbD:4tcPDmg27RnWGj
TLSH
T1CE650129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 03664283fb07141475d2e979f306c8dc6ad2ded78a761eaa422a4aa50f7c2de3
MD5 c6b11d40a23236244a70da1ad6ecc64c
SHA1 808f3ce07cda5bded21597c2d83540fd04650938
SHA512 f337201da64dcf4c8f6867741420529f294f0803de3305629d51fa02a39fbcbd5bb8104da746feed0872afd1f217e39758456f7ce7aae40f7f4bf52c4389e3ae
SSDEEP 24576:U0Le5ji0hmxxrMFsqjnhMgeiCl7G0nehbGZpbD:UPji0AjEDmg27RnWGj
TLSH
T175859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e8cfd8ff6d166413f01022a5493f44f873b91390f1feaf20b01219b673eb0268
MD5 1552f60477563780f18dda203d2ad780
SHA1 a23490ae843bd28182ce3d5d21e97ea13a2014b2
SHA512 433232796878fd70d2471d71a833af6196adf0e229e1a795df4660b14b0f70c2c35e545595a0a0b4913cd477cc96ed29ca36b1306a1435cdebc8160885f7050f
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWn6q8wyuLsqjnhMgeiCl7G0nehbGZpbD:m/ezSC6vUzPveHjy4Dmg27RnWGj
TLSH
T15E755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9f88b71b4044670e8da0ed7e99e60b2fb935c71a7bb8e15713e806ccb69d9bd4
MD5 f3b903217bfe3b4f18220bad94a713fd
SHA1 98b9f4fc9ae6c35279a191f5dbad7b4861aab163
SHA512 01bf9d64abd8cfb925f5ed74c433ca2480b6b81ffadbcce72265854cffd4d101a81a05165c63538c70efabc906a0917948d41982a8af196af99c24381d0ca7bb
SSDEEP 24576:dVbqPb88hv/l+YKsqjnhMgeiCl7G0nehbGZpbD:dVO88hXl+3Dmg27RnWGj
TLSH
T1C1559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a01a182c2079c87fd758de500179775a26a9c5eacaeed8b1ef08da2cc1678c5c
MD5 f51de8788e15be18b270e9f81e6c4e2b
SHA1 016a5b4c371432a38016b707f38355a8bd0a95b1
SHA512 fda0c69bec3cf4564ab8d182183d68e7d059ed40afb3ceafd265b851ae327f0831d34167b3339ef93d2d23390760052f67140012b70ff44804ebb6d336b23990
SSDEEP 12288:TLhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TLhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1554523BF964C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 f80a4009edd06f633c0bdc64e9db00ec1c3c19eaab7a2e8dc51ec7caad1f60fc
MD5 caaf9dcf0d60675b1734ac99b2fb8963
SHA1 03be8b78179002f810325ae60e73d63b02d7c401
SHA512 19f4af7096d50444a64f9c1bca3e728f5d5d49af03565d1ca17a6e78be55840e4c2241bdf794e507e0369bd50af250af1616c4b1e620017b9133a87f6723ddfc
SSDEEP 12288:ceBNUbTVO86UiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:cJIUisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EC65CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 847c857c062f71f0aa6325410115fee30f0ed4b45a051d49a001ace7adf31e75
MD5 095606f7773b3469c868592cb380f558
SHA1 f9c3e95a45dce3685493b862885fa420be6c7a46
SHA512 bf92149669b21f59ea092137444eea4644a477caf17bc55a53ea72cd2eb13c1cd4a2c4854b04ec9146f3f58c57eb2561eb469b3bc585b841dacad3f5ef94479b
SSDEEP 49152:NQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THl:NQvGAdlCEL8c/DRNw5CvD527BWG
TLSH
T1C9266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 8c0f7fe3233dac83c560f9e72ef6c47c3aab8b4657bc7c47b299f694fd82fce7
MD5 b20bbcdb6436ee862c3a0d1ecfcf2e3d
SHA1 9de9b20edd77c53072067498578323c6c6b2957a
SHA512 55df2b05c7dd6acd57fbc229ac22edf1ae3e10e7d4c942fae185646289b7d18741127dd6e3272dc661a2f709c0f17c262a3d10846d22a3d6afbb6cbaa3d1d13b
SSDEEP 12288:NAwSfxL/2Dc3RDLLmt0LDQewsAjIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:+0ewsAjIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EF75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b3804e549d3fe59bfbef113e4ad57d1627e35129a0cd98179c5bbdb9015efd0f
MD5 5c7726d33ec93afe91ae7c90c7db000d
SHA1 0f4e7087e04abb99d1f370c44f0c98a97baa8d6c
SHA512 b4c08bd86ce98111ad2e51be11f9c421ebb4972f467f7bb46a552c93160b3a3a1c0cd81a02dd12ae1cfd2bc8269e39dc9c0273c7834d93f2253bd41d683df6f6
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHsVQBWG:bUEtQevvqc2W1cpV2tI32zB
TLSH
T1C5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b72055c3d6401ead66b4aae675769ce8c44a84a79ee0d7c7cfbe8c5626327044
MD5 e852ec8143e428b0719868436f40ae63
SHA1 d5881a3680d8649bd97dffc62b1434d566f060e0
SHA512 ea871a252d351ff3f3b016c7ef2daaa97a166f224ed04d6f1a51217b3508ef9514808fb052864a432a729cf604003f7b9af8d38217eaed18c0eabb12660da628
SSDEEP 49152:KCbRquA/m2yL5zTfFiV+XenmE3/zUDmg27RnWGj:/oquVjnmTD527BWG
TLSH
T11CD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ed8bb28f7fb80ac24ff67dda387657dfd45b3db821c7e60cb63134bbf5de2d76
MD5 a7762bbc508b85b017720f88dba7598d
SHA1 152969e4a669e63f091a479ad8529347094bd1fe
SHA512 54ca1438bcc3d1ee38e9e2c95d9e49c4083ad515e231ba6d02faece3eeda409d005c7990f09eb0b473e2ee18e3f087329066c3a6c866aba1bb6b2e5cac997a7e
SSDEEP 24576:fAhGL3IFoiwtA5l7S53PsqjnhMgeiCl7G0nehbGZpbD:fAMUFoiq5DDmg27RnWGj
TLSH
T1B0359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 c36cc67be82682592a0e2b4022de825e9967b327f6bbe361b4e9b5e923175a78
MD5 de354f44686cb035089a039e630797d3
SHA1 74707854ffd7a391c3e27e5035673634232e56d6
SHA512 d00906a32510e5731fbf7dc57d0b0cca9398c1b513fe989a667f5b2b6ffc200e53b6d42bafa532b4ef82fefca2a39c113188823b85264120b6e098a6268b8bb6
SSDEEP 12288:1mw5HEjsChNVBFgl0WDm+CrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:wwu4OWssqjnhMgeiCl7G0nehbGZpbD
TLSH
T14065F14A76A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 2df73a48f1b755473b5b664fa12fb262f87c7b4bc4aedc4ddba272c9e1b11fe1
MD5 450071f0cee7cddc29071c12a0bded11
SHA1 dc3b0199055791802697bfafde8928c214086cb3
SHA512 9f4852ccd4f9e0fdb6cc741bb4d95ca3201e59952fcbf54e4dbce3a82c4989ea2e2a1ed1e7635413a92f7ec8f5394328924c51185bf1850e61c1b895ec476389
SSDEEP 12288:KeZ1Iy4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HZu9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1525512AA239820FAE163417CC5E5D609E7337C62673003CF166656AA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 da8cee6ed32fb65d7635865f718393113518e250e5a1904bd02871aa3dc1d232
MD5 f1270a35fdb57ebb35e2d4c4aefc2598
SHA1 976dc1d7201cd08ec63fbbb949c47db12eed2e62
SHA512 0efacdb2e54d551fca4090a855e32764a8e11be18260f7043ad62998de900b3d37d4e2e9e2674d7074c98a4e33dd7234028c1d36edb02cd486d1c14a72e4bc93
SSDEEP 98304:BQRQyi36YOcPbLvw2gAf+PN36D527BWG:YQyiKa/X+PNKVQBWG
TLSH
T124667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 75342e77b51cf076ff692664beeba8415b6cc903d23b1dc1fb044ed396b16417
MD5 8fe6f660883edc053b165b1a37dc3630
SHA1 c1c7f154bccffc37f6ffcb2d7c052184d11a3a8d
SHA512 fb71576adf6e0f32636a115b56e3ecaccec7d2f23812d9595cda66c6c9c734cb2d838b5382f79b9ac0b585f7b95f112c749ac69f1ceaa5f8f6d82458f4041f74
SSDEEP 98304:5QRQyi36YOcPbLvw2gAf+PN36D527BWG:wQyiKa/X+PNKVQBWG
TLSH
T1E8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4dfbfcacb259a0201def339d2f0a839adbc17c833b72503bec428801dce7a3d7
MD5 cc1c5b495b2ea2e476bf1ee036babb4f
SHA1 1586b5814d0f3485e9860dea68e7b40ae30109ec
SHA512 593bcb63b84d9f48c489082c7883b1a8e39b5f4b90fd48940b8cb921331bb6a5efef10aeaad6bc9f18d6c080e29aa0891e4e83b8ad48131cef5d6fe4e4d8ba2d
SSDEEP 24576:zwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0NsqjnhMgeiCl7Ge:L68Qg55nhceWu7PNU3/EDmg27RnWGj
TLSH
T1C5B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c868895866b70f9d8a147e4158b30cf5c26b9a8f109dca35c87ba5340201e342
MD5 d50d7300d2db9401ad17f830333c3f26
SHA1 2107fb46455ff081f0f919e14174da5f240b01de
SHA512 8f47e1772e58419915c48696d49d8121ccf28676f6d01b791d29a1e84f1e6ec03fd6af27f1cc9d647c2f68cb1caa281e6b46f69237b8dd7bf01aff2f7d19eeb8
SSDEEP 98304:Ey5112gYy5azzVvt69nLKnhZ1D527BWG:FLIHEWhLVQBWG
TLSH
T184167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1e0e6bf6d7993b93a5bd3912bc2ad8b3fecbf8ef4612d8a503a0150669048153
MD5 08572ae72a00dfeaae6d79d5ce63ea32
SHA1 505e61dba6f3e54f246ab58b9ab66eb8b9890558
SHA512 84525cbb49094b0aec9e32db12ae64ec280f0489b2afbccb79725dd769336f4cb4bee85b7f71dc0f6def8e55c0c86cedf122d60d5a4b0f3404776f039287c9fd
SSDEEP 49152:1B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glqDmg27RnWGj:7u6Jmdxd2dqD527BWG
TLSH
T127D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 def9056f94d913d3f88029f33008942ba66ca6941ee6194d695f08bedc7c9666
MD5 f1261f0134721acacf816d3a2fa0a1df
SHA1 fb93f74dad01b0898b4d6bb732f6aba160dc476a
SHA512 486d86ef4b947e9540825a2d5ec4e4a6367e0865e8aa127fe9539a59bdcedc290ab38e6b2bbb14e8f18fe6b746e307fb19f749ab18819e7894fc19d218ef69f0
SSDEEP 49152:M1hpsNoJpF1A63U44CwH7R4xGDmg27RnWGj:MmifPWRTD527BWG
TLSH
T100B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f4269d0fd92c66520db32dd4eb6c49ab6e3411bc4849e03269b9215a44fd54cf
MD5 5389d85329d8103f66f71336012390c2
SHA1 3a994783c11301b5b7bb5b64f86b0558b90f56d4
SHA512 4a91a71e39574884f532aa030742e3969dc30f31f9124ad2df1336dda807ede573b5c13458742cd45f7216448e3b23674facef01cf18631e5f92ae670b64ef5a
SSDEEP 49152:cSuZQIY0Be2KcRVtOnks6NMHqhDmg27RnWGj:e5dKii61hD527BWG
TLSH
T164C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 97f8e1d267431f580ad1c63407e610d5d4bac83c2b33a3f6b22ec21a0b858b4a
MD5 5f6ac16cebf424ae23ae5a614d9ddef3
SHA1 affd6dc69276c16df7f3b0f2e27a87e799758d2c
SHA512 15aa9ab8109c3fdbb657b7ad53b0e0dba193b1e03d67bd070b7c45e7dfff6869cac7a3f3ac6b83ade8c30097acbd936dfb0a4d9f54ee16c6e4de13b5cee69667
SSDEEP 49152:5htSn8EApI0fig3giDn0AP5wSDmg27RnWGj:IX2imphnD527BWG
TLSH
T11D95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 8a433116d4c9800fb60a938e31b4a13b8b18459baa4c53cd317dc70cddcc4e2a
MD5 fa66a21fbae699a075514a0b8883b28b
SHA1 00940a3fdff087ceb9b2df7b73758af955462db7
SHA512 5b15ca9faccc75aca0258ef44cdca74e844bfd809d9c61a47132891f1a016e57073809a43e08641b940f539f9d0cd5557109dd4177d9a749139d1d146981034c
SSDEEP 12288:eZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F4523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A977CBAFBB14984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b834d46f20677a0b133fa885cddc94573ccf9eda3ab24b68e2186c693d66483e
MD5 138fd08fe598fad588f3a99db9c56175
SHA1 0950d0874a517a4dac4cdaa77798b7cfe92f0925
SHA512 6bb43b4910b2d985401d6736b1ed9035358eb3c862d27e58a5d251cd808f57cc00653266beec3ba8f00341090efdb7b17e771d20c99b0e736574cb7b5c836cc0
SSDEEP 12288:gUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EC4523BE965C41CAE52648B5C3E5F14DAC073E5BE92004837A977CBAFBB14984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ba1db4f02f7834ca674f51a8378cfe23577b95e614779a667a2d74d92b79bfd5
MD5 d52b2090d007cc1d37f73f365886c545
SHA1 f6c3ea786de69815835b81e598cbac1ababc41d5
SHA512 2c4c09178272138031f174b3bf462b4ceb9955f733fd9aef68d5d7c5fb5d59a292246c6bf3575d34bb4c2fe8642ecef02a0f896c84d9631d96ad1074d6ab31a5
SSDEEP 12288:saXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1304523BE965C41CBE52648B5C3E5F14DAC073E5BE9200483BA977CBDFAB14984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 d81b6cac3a11b8765ba969f12928830c884066770789a9ebfea88870d78181fe
MD5 b175eb698c5c9bdded06a64c40961a50
SHA1 989ded62b9f25245900f8b0bf4478742015fea29
SHA512 8ced8025dd83e335aa72a3a8789ef15b891b37fc7af9b93a447c4a77c1d085473c9b425f37dcf9fe7d5e344daa88ef3d6b3356bf9da9bc7b67397dbd6077f1ea
SSDEEP 12288:/VvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15545236B675C01C6D83285B4C2F5E11DE8237D56EB3005DB6B532CBE6FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a33d372c1126cc28d90d4016a2e58061dd9b4adb4c15409b738fae2cafccdc5d
MD5 d113ce0f37a6844ac1169ec96f6ff192
SHA1 ee98d1f1c0d4f810101129882c4d5c6b5f7ba116
SHA512 f57408631e6695f3631c9eb2c24b250c9c131b70472c0e0b98d66dbe847c107a2d4eb57b452ce09d7cf3d13551734fc581763a969a11149c7eb810b64c7dbb55
SSDEEP 12288:yXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C64523BE965C41CAE52648B5C3E5F14DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 4144672096b6c7b33afabe7fc6381901c4e90f1ebdab57f0d7ac7f0c4482d201
MD5 81ae924c37bf1b5d635b4d1ce0e43eea
SHA1 2f63caa23d7f8f1d687974d3bfff4436bd56f7ec
SHA512 3092e929e3f3fee591682fc81ecf8b48070efb30b2187dc89235f3ad7de3533699b54702cd7a5cd5a93c720e9b34858676ab7ad1c629090a142d24a7c8d86dc5
SSDEEP 12288:AgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19B4523BE965C41CBE52648B5C3E5F14DAC073E6BE92004837A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 374559dc308a0db28e3e4bfc1bc1b5c15a8557217f14cf8d69926d75b3b25170
MD5 2e7114ae5a58a551720389135306583a
SHA1 9dcb816355a22961e3328d5eb544e040709c9c22
SHA512 9bbacadd08364744361823c84baa53de89d59d9101c363b520bc1f3ffcfcf2795013795d9c1e1859e22cfd7ac577bf682f606dadc190fa56555c6a27c95af14e
SSDEEP 12288:M8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:M8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15A4523BE965C41CAE62604B5C3E5F11DAC073E6BE92004837A57BCBAF7F14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 452de67f3fa99f55f23204e72cc79e3b4f27a0bfaa912e51b062f71967b3ea75
MD5 ddaf40e7309170c3d11be467f8267ab6
SHA1 052fd35affe49fc54169ee349f101ee05173b806
SHA512 c2f18f4ef2b1508ea72cc498da4ac7f51e539f1e33b81822376ab7a6b56a6e674fdcfb959ed192e5448b88b86f1e94d6dcd9c6bb8be445b63606ed61c1cfa9a6
SSDEEP 24576:EZMRzFVSO0sqjnhMgeiCl7G0nehbGZpbD:EZMRzfMDmg27RnWGj
TLSH
T1EE6501A9B35418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 1935ad2d5e6abf3af94a267d93e5bdeee48af31ffdac01775475bcd506dcc494
MD5 d5e6c0a142b89ae2a3f22b3a592959f1
SHA1 6af67b00286943e42ffc9ace40daff463f384424
SHA512 1419884089705389a7f52bf250a316a76a40d5df2d3ca388028f05fe0648e4e9f4fbb165625d89cbc0e789ffcd94fe495a2cd4432ada5caa1d4fd518960dc04c
SSDEEP 12288:etXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:etsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CB4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFAB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 fded5ae2e57651c6312f184b2d7342c8dc26922360e8c9aa6239484170182983
MD5 6e4fbade09cb8c7d1616e8e2dae78dd8
SHA1 531a42d822a9045865b76ea95ba415d693d0590a
SHA512 c02117d9d38da491998a5570d4fabab25ba83342af119986b1b767e3b5891ab163614c69132594ba8ebdb15c1d85113e2856d13aed0c283d54f73f0be55007c5
SSDEEP 12288:mRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B44523BF965C41CAE52604B5C3E5F15DAC073E5BE92004837A5B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 a7fbb20f61e96585923ee4c311b9809dfbb9b960cf45d214f3c4b0103fa57a65
MD5 c7c54d14cf21d36dd5f8577f2bbb5c68
SHA1 6b36b3bb9650b205195c2a4ce7663d67a608f83f
SHA512 95ea93037122344fc1df122bf1d3222831a720e893349db4eb889bb9b4dcc25f6398bee9ed87c5a3661587ba9a003d467f3dc92360957bf68b914a05b3846917
SSDEEP 12288:byPz5L84Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Wzy4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15655125B73A530F9D1378178C5A29A06F7337C3647204A9F17A116BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 e64a6e628006b194ef04334c4a06260016f4637369f46f7dbdbbeab298d63514
MD5 b9ad111b549d06b176fb984a3536a838
SHA1 aa4214f0ca970bc75ae014f1ae93b91b5a8d561e
SHA512 372dac026a045225a73afc51064345fb29df7013ef9ed26bce0363474e71752423ee07538536bb56c389d56d38f903634cc3e0efc87b8ad0d3fa6de9fb2a5d96
SSDEEP 12288:ptXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ptsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1084523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 71affdc1bfcfe78a9728a894d4779318383653d953ebb7fd2b660d7223bf6a49
MD5 c3c0db99cc21caae00714cec880b7667
SHA1 d4abcf078af796bb623263c5af8a31abf24a7506
SHA512 7a7d65516f69f0062196ff0de2a179f11946cd1455a89c701289f3c23323ba821e4a231bd22c36684c8bb63857b26ca7e8c72f8886e157e3787951748afeed4d
SSDEEP 12288:LtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19B4523BF965C41CAE62608B5C3E5F15DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 ed26ed18bdda373c5f8d16005d731dd1c18e863a33292d72be7c18cb46140177
MD5 93a30e90bb518df75924fdf5eae77fa0
SHA1 168e533e4ed3d8dcf566b4f7d0e2d98f44792879
SHA512 bed2ca8d9c89eb3527a2b0c5d77e4949de72dc8bb9af0d98c75fda6353bc85465b460e926b71acf4def00b96e630877ab41ff24f79d0ed6da86252e634ed3f6c
SSDEEP 12288:HyPz5L84Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qzy4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15F55125B73A530F9D1368178C5A29A06F7337C3647204A9F17A116BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 2366cb9679cab611a0e7065b0806d76b9cbfe3b1201a6cbd26aa20bdd4b94b4f
MD5 bb980d8941b5fea6039fb785e08703a3
SHA1 fe17bc01e78d3b81bdeb24ba66e120b32010946b
SHA512 6de0a0365411399e1b8b5b6300cf6377ccc9e5e174753c432aaaa2e4b3bc07c2cad3120c1f4e32ff8f6cb05fc4dd84167c7288976760b4b76be3d18aec2b6c77
SSDEEP 24576:RTDaLl3z0zDqsqjnhMgeiCl7G0nehbGZpbD:RTuLlj/Dmg27RnWGj
TLSH
T11D6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 6bb689b64616324b89c86dae6dbe668abf4bd06eac4b174e0bbc354f92139c8c
MD5 d1802f80f85cd50f571aea57e9e317ac
SHA1 fa6071e19723a36ceb00dd4e378f29f987184d68
SHA512 8c145c34cd6fde68fd8edb44d0bf4869c0cba8171d1136e382d24d9d40be242cb3d9c13b26fbd91842786ad9cf153808fb22f87cce4d1d50ed5bc63ae76b25e2
SSDEEP 24576:H3vd9CHKy7GZWsqjnhMgeiCl7G0nehbGZpbD:Xvd9CHKyaMDmg27RnWGj
TLSH
T1DB75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d509b438d3af6e401d5d2f4eca542d13525673f0aec227aa5913d4f7fcce282a
MD5 c381e246f01136ba0e6692142a09d677
SHA1 d687629c7664ceecbf89c8dabb17708918c0cd46
SHA512 48daee9e9158d12c68987bf3e62d5163ab69bb182f35d99e6be14a17cdd85909b9752ccf413b09ac49acbde437c84e1636f42fe02992266b7f7b4403b80da57a
SSDEEP 12288:H6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:H6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12E4523BE965C41CAE52608B5C3E9F14DAC073E5BE92004837A977CBDFBB14984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 7d3015ccd05cd74089910037d1a5ca0fb22fed893a85760cd26892ca7feac2ab
MD5 c54fa1bc5c9af464833f4224495f03da
SHA1 59638b6990c143aebae4aa8303f3d02f252b3e69
SHA512 9f789fd6f56bbb49b86a7a290cbe08b53c05455ab85ed82677e335b67868144e98a2152e4da52ab56c1590caf45cb5f3e6d0ddfc7cd3811fa696bc7fd937472f
SSDEEP 12288:ZYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1344523BE965C41DAE52644F5C3E9F10DAC073E6BE92004837A977CBAEBF14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 19b90c7eb38546929f18890ec5dbe5204348295efbe837bf22de3698f5d1519f
MD5 3cc9575e0dc8a64bf196e15de1ff12b9
SHA1 21795226db74385cf35bc88d3627c0ba4254f126
SHA512 4ad3c52b3f7dc5cc636db9029b009437fbf22db99f5dc366c3fb098bf7dfba424af01f1189f6d7fa9de76b0ad2bc4b293bd8e6a71bcb29f5b869fe303cc6b8b7
SSDEEP 12288:qTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D54523BF965C41CAE52608B5C3E9F15DAC073E5BE92004837A977CBDFAB14984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 0737428af5d7d59c6263e8516bea0e3f00c6ef2c46a9c4fb1a3d607b30be40f3
MD5 ee6d3a27468e9e4dfba75b28d4f4fb94
SHA1 dd4c96ba3266de7f62248a3c162271b2df31d12b
SHA512 f9effa0d70bfd354b857fcd4a1475bf52b16eee1c4f9a2ebfc4691037dc077ff96baf4266b947559a9af7a9fdb317cf4f13cb3db4aeab78b3bf85cdfcc4ef752
SSDEEP 12288:etXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:etsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1454523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA977CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 303e7c1ddefe714d4e72a390427af2986b2502b83f87f57ffa608c2486614782
MD5 32c05a2150ba53b6f28fd7284cbe7542
SHA1 7fc663a8beb0eaaed29fc76a1eb6014bef5dc410
SHA512 5942f938f50ed6c5a1052f7b98fae9746237086421d510be0e7900b111db3cdd9a0604a56f07959493b6645c0702ba9f5bb9482a086f8152718bfa0dbb370735
SSDEEP 12288:S6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:S6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14F4523BF965C41CAE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 a44c465388f00607e87bd408c1b5a6ed0855995f3faa74d6e60ffeee8ceb9031
MD5 c97e13078128ef684074561bd797c73d
SHA1 fe3bb368c7ba34392d460bcbd05a4d0afc4e895b
SHA512 c4a8d75fb2112b042b3e25f361388520941c5996613bbcc6c59c176ed6555ec7d7c1be1ca163ba1b2f89e8e1877057516d8681a34befb2f6d1845b9085e7b1de
SSDEEP 12288:qVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F74523BE965C41CAE62648F5C3E5F11DAC073E6BE92004837A577CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 858e6a17b8d8cfc8e637068ce594d1cb893fe3227726fc5f24ced6dbcd378566
MD5 1603393edbc09e302340850047ab4b74
SHA1 5a1797906bd857f2ff1675bd1296b6b42bdd427e
SHA512 87cc4188f5374c0aa67db400f98248c76b701a5a7550d4171a7265b5bd89ccbddb4e43ca13a90bfafb1236fa52e0f66beaf05aaa5e6c41ee159ff661af7f75da
SSDEEP 12288:bXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1124523BE965C41CAE52608B5C3E5F14DAC073E6BE92004837A977CBDFBB14984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 ea800438f2956113c943e53461b6d2f53c7460dcd032bdb9c7a137c580a1c4bc
MD5 6643743bc042860f31451ed5c02f2687
SHA1 0b84c142a9bba062510a3d9b85836a8dd30c0450
SHA512 63d7d544883c640b29bbd810948598fa2c085303ebad505729e09bf655f5e6e5abea136e75a255fd619fb3b555eacdac32eec04988d69a2baa3a17a781193e1c
SSDEEP 24576:SfwvUk9RX6wkyAIBsqjnhMgeiCl7G0nehbGZpbD:CMnYIVDmg27RnWGj
TLSH
T15185D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 52787d6442213ef96b3992384703beeda6f671a259f83261f646bf7944c07ecf
MD5 825ca073eee3796e107c4acbce85e568
SHA1 f2796ef176315917ace42a7d29af3a5888c68bcf
SHA512 4cfddecc6490f66dd6a5fbe2576accd88b15349090e2441b0a90fbdeb866f2ea3162235e5f166c68942e66ec0cb0f39f2eca7724fbe777167d89bc8775978948
SSDEEP 49152:wYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0yDmg27RnWGj:XySzPaD527BWG
TLSH
T152066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6b69b752d3eeb445526a6d0a5df0e5d30250351ce22d459ebea3a43c6b11f6d9
MD5 ab0252b8051fab614d6be290e754aa5d
SHA1 fb0adcd3e7617da5976097c3bf61e85613495bf4
SHA512 b2b8ca3cb1dc24da532a9e5165a7348dd55043972fe1855dab682fb1a10b09637eb04abf100f6caaa34d6234c1a518f66f0527759e3ffee7a5b8ef142325d576
SSDEEP 24576:447Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYksqjnhMgeiCl7G0nehbGZpbD:447JUQjTirIhCnDHUPfF/iDmg27RnWGj
TLSH
T1D565AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 46b5b97d24a5f9896e57cf078f1c5a881f0afa9df4089b8f4a97bee870ba8327
MD5 b7b893ddec170a70ea5f59acf26543d8
SHA1 98310c345ccd65944886953b2f3aa93b144bdc75
SHA512 acf69849df60a66f6d344331bccd30dca548b73c94cdf78b2c085ac9ab10f4351b45d75a39f00c21afeed8a371cddf93125c26ae1c8b8847c74ba1f67f5df59e
SSDEEP 12288:2bsf9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:d9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A55015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1020KB
SHA256 68ca3b95c226d056270b44f6e666f83b98a5792e9841403303dbec9b66cee699
MD5 377dd7db065b3c8ab712259a9b2109b6
SHA1 5eb9d18c3d6a0925b4c66d19f03629d601fa361c
SHA512 c8950e6cf7432cedb0e816e0b65a19059b0ff06e38ffe4a7db2ef683666521511c6fbca331c94873d843884b7718eeca8927531e38c8d3f459e07cfcf20e89c1
SSDEEP 12288:Fbm9+FU3fFVhb7iPbs9bHshtaZ+7pYEGJ0yBFAHOZ25e:Fbw6UPo8HcaZOYjJZBFAHc2I
TLSH
T134253950766AD75FC5AD40321E33C2CCAB707D41EE05AB0372C8972FC576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 3fc6ea8a885742c0ea3047b07f3f920d18e89395c2bb2b76ceb0de29a4a1adc6
MD5 e935bc044a3d8d9dc9ed3aeaf31a3c7e
SHA1 ac5cb2d011ca0d9113f01ee0cbd1462d71e33fb4
SHA512 274159a2ead585b2abe8c976213542ee81b995bbf4c420261d33c31231e46d3a7f36432f8524241cd7c707cd5a72e530c90fc0c9c614b1fd51433a2d6250cfc1
SSDEEP 24576:TewPVjvQg+CgrsqMzJI7VqtXNydt0GqhxyMHhDp183/8:TewPVjvQg+CgrsqMzJI7VqtXNydt0phV
TLSH
T16055D881A437A3CFD5F66031072A5B4CA764EC07B3056F266388553ED82BB66A0BD3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 9d275bd69c00a8c9d3696792788eab650dd5be4743a8d028357af83bcd30e0ba
MD5 9073612064ddd45d1e1e8f8c925c70ff
SHA1 eb89bc8f0aa450a4c13f4346a54fc9d5616878b0
SHA512 0632321354d80319bab123bed7691b9dee5d652034994c838a9246234c1ed6dbd517b5d25fc4c34f9f31be881194cc7e246daac6fa55e496ee96b953361f825b
SSDEEP 12288:r07lXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15645237B935C518AF93609B482EAE12D681B7E669F1004C3BA0778FDF6B18C48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a4935f9d3675e36d21e71bfc743226a7b658ba8e67a54ed952dab7929ab6a793
MD5 e250ccccd8f6756635358ca9d63fa0b0
SHA1 21e84c5e2c15a6d0e71c0c1b78e15b1f88bc4c68
SHA512 7be40c31b13aff0abbb9eca7feeafb484a338d49f0f72b0533e49a1f41b857602a571de212076450d688e41d689c46569446e1685aa8b7c3f7f5467cd6c280f6
SSDEEP 24576:Sgb6bmBIi49WNNFpg1rSvFv7bYLsqjnhMgeiCl7G0nehbGZpbD:Sgb4mBIBhGFADmg27RnWGj
TLSH
T195659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 008953ef882ef2726e033e50b00a43bf87da85514c5c8e19028325dbf97d7cfa
MD5 7e604264a1215c7a8e0b4ac02bee5cd7
SHA1 ad7dd90b38ceb850b75c5895b271bfe8d41d1fe7
SHA512 92fc8be2f732ed98913b1acbb396e6465b9a3f46e6caa5fd6af579e0bfd7eb5c0f05a22e61cd1c3c44cdec158557d09839e32dc8ecf7687b0dea3b5462fe2d82
SSDEEP 24576:8G88u8FpJqH1bzria7/m0sqjnhMgeiCl7G0nehbGZpbD:/7ZFPqVea7/3Dmg27RnWGj
TLSH
T11C85016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 d986101389bfd60afd44d16e1bc276ef71f51dae3f7b0c4dc8e9fe69e427e4ad
MD5 a2a67e73775b02625dedc4a9e65b0076
SHA1 7c2ecf19517f4bc5c1ab34bd3d6e1161223bbde9
SHA512 a89cd3a98bc678f5f4044fe48581c635270c2b6c250d80ed4da8b6d133ecf47fcdf95fae3c99ea599ea1c00692cadc3ed422358ca281255fc7b131a249eac2e2
SSDEEP 12288:iHvUrBFrEjwaQQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:iPUr+NQQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12165F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 feedc136d7529af296d62172317fffcc18ba8816aa77d2cb086a3dfea6c384f1
MD5 366f0d09bdd4a23675b9a37397db772d
SHA1 dfb775094a0e1d0a4bcfdb2299ed11fff8458c46
SHA512 90202260999d1efde55cc2e7625269e8fb7a19fd5639cbca4eab529b34bd4174e7a535d12ab16fcdc811f1eed73138b2f657d0718e6b669f5dfb0bc9215b85a3
SSDEEP 49152:HBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjcDmg27RnWGj:4G05lO43bND527BWG
TLSH
T1D9D5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d2d91d4b16bcde27150b64ce5625f30cf27a0c13919bc674a73ae5fe5cd02ac6
MD5 1c93056ea4610ecc5c9bdaad28c3b1a7
SHA1 3427000d25e25af290861cdfef90043e57afd903
SHA512 65a9798a1b6a76aad173ef133607e06c24b6bdc9dcb024379d81e4d2dccb87d95e8cf0d655a7e0e3d83a2b06c39d2e8b52f13d94109a5bacb061373c84c64819
SSDEEP 24576:Efa5POZ3dpuWVM50JicR2hG0lasx2+47eidnesqjnhMgeiCl7G0nehbGZpbD:ca5POZ3BJt2pasx2+mEDmg27RnWGj
TLSH
T10F65BF5EA7FC01D5D579D17DC583861AF5B2342253319ACB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 38b6f99df7cc6b54350ba6ea54253676f84489f7f80fbb055bb311b2f7901db2
MD5 f864b994bd3b62eeabc023ed6b3607a3
SHA1 cb798b3d6d3476e1efa791da427cb145ba1a7eeb
SHA512 c37a73f427323193a76ae2fa42fa075ce38fa14c06b9fd8ee96f7cbc014ebc2f43a4ac771baedee8959826bbe68d952975334021e13d77a849ba3620568b1687
SSDEEP 24576:NNcwHdjbyQ4nLC18lb/EOjowL7FkMsqjnhMgeiCl7G0nehbGZpbD:NNc/zEOVHFXDmg27RnWGj
TLSH
T186857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 55a6f43f103f825cff9c8f17cd0018375db912646347f3e094dee2062a04fe16
MD5 5114301906768f192ffebbb48f07574a
SHA1 2b4c34c54b188771e81dc7561ff0bfecd652484c
SHA512 01dd78d858d6ac443a2100c07a7bd0abe6a6a46a8a9f7acaa339a6d11a43aadeb150a67e28ea883d33a8f84598b0e891d0b9dc1d080bc4a2540fbe05cd434167
SSDEEP 24576:rTkNvNnaFeYhJNtmZBmysqjnhMgeiCl7G0nehbGZpbD:rTMwBtOm2Dmg27RnWGj
TLSH
T16A55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 33fe24a6091a71d177c420d78b0c05fe20f46e99157ff13ee21d7c7cab753179
MD5 9eab8388754833e25d2d174ad19bcefb
SHA1 c7cbd3616a2cca630cf4d272a2367d070f70a7c3
SHA512 503324f162e9a488723bb588b450a3c2c793271e4cf193a597dc7460d097813cd3c1a4bcbb7838024881695918d4dbb91d1646adf8f6ed7751e5a29db7fb95dd
SSDEEP 24576:oD3FHshBIYQgA5sqjnhMgeiCl7G0nehbGZpbD:oDVHeBIAA9Dmg27RnWGj
TLSH
T1EB75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/816-80-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/816-304-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/936-14-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/936-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/936-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/936-83-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1512-43-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/1512-49-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/1512-53-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/1512-55-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1512-42-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3088-117-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3088-307-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3088-111-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3088-110-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3256-138-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3256-311-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3256-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3256-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4040-305-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4040-323-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4040-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4040-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4040-91-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4040-85-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4184-64-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4184-58-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4184-57-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4184-274-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4332-0-0x0000000000400000-0x00000000005E1000-memory.dmp

Download

memory/4332-28-0x0000000000400000-0x00000000005E1000-memory.dmp

Download

memory/4332-8-0x0000000002490000-0x00000000024F7000-memory.dmp

Download

memory/4332-1-0x0000000002490000-0x00000000024F7000-memory.dmp

Download

memory/4404-96-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4404-97-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4404-308-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4404-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4404-103-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4404-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4736-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4736-121-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4736-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4736-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4736-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4880-70-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4880-68-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4880-76-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4880-289-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5508-131-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5508-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5508-122-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5508-123-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5508-129-0x0000000000820000-0x0000000000880000-memory.dmp

Download