e4ed28f156e41de25dbcd87fc2ee706597690bf4d8a95ee3ec13cb10a163f6dd

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.4MB
Sample260818-adedeabl61
SHA256 e4ed28f156e41de25dbcd87fc2ee706597690bf4d8a95ee3ec13cb10a163f6dd
MD5 9ecf16135a4f75f5b426fdfe49769773
SHA1 b97a20e81e7cd531ae38831900952274018a5b3a
SHA512 f90f6c99026e7df5bf8f027c9ffa83646f2d060615c73cabe061871a4ac44ce19d7d9515d57bc853bdfd56cf245937cdda94165582ddaae16b775ea35bf25b31
SSDEEP 12288:MibwAEUmeF66jedGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:nDF66je9nQ/tbw/2Mkjy6Fr7g0oi
TLSH
T12E6501353AE0D033E273217108D2D7B56BBEA9B19F61978B7B80177D5F343918A2934A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1720	elevation_service.exe
3680	elevation_service.exe
2636	maintenanceservice.exe
3260	OSE.EXE
6060	PerceptionSimulationService.exe
204	perfhost.exe
1072	ReFsDedupSvc.exe
4608	SensorDataService.exe
1728	ssh-agent.exe
2880	AgentService.exe
4944	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e9125e9db05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f45f8e94a52edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c6dac994a52edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000098ba6e52a52edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e563b994a52edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9247951a52edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe

Runs .reg file with regedit 1 IoCs

pid	Process
1312	regedit.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
1720	elevation_service.exe
1720	elevation_service.exe
1720	elevation_service.exe
1720	elevation_service.exe
1720	elevation_service.exe
1720	elevation_service.exe
1720	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeBackupPrivilege	1072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1072	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1072	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1072	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1072	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1072	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2880	AgentService.exe
Token: 33	4944	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4944	SearchIndexer.exe
Token: SeDebugPrivilege	5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	1720	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5180 wrote to memory of 1312	5180	2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	90
PID 4944 wrote to memory of 3936	4944	SearchIndexer.exe	102
PID 4944 wrote to memory of 1572	4944	SearchIndexer.exe	103
PID 4944 wrote to memory of 2624	4944	SearchIndexer.exe	104
PID 4944 wrote to memory of 2004	4944	SearchIndexer.exe	105
PID 4944 wrote to memory of 3700	4944	SearchIndexer.exe	107
PID 4944 wrote to memory of 3660	4944	SearchIndexer.exe	108
PID 4944 wrote to memory of 5416	4944	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_9ecf16135a4f75f5b426fdfe49769773_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5180
- C:\Windows\SysWOW64\regedit.exe
  C:\Windows\regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\config.reg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:1312

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3680

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2636

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3260

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6060

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:204

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1072

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4608

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1728

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2880

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3936
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1572
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2836 2824 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2624
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2004
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3700
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3660
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2836 2824 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0b19bc9a8305423145470b4ba5293d65e5267e893fb7afe6632ec21096ab4e9e
MD5 a71d1b773cd06f2ef17d5b7ec55b77b0
SHA1 7753a8b1d522428be1c2edccf4ee18017e73c434
SHA512 52c1b7af37c293fe1b5f04b7ca9c2ba5ab02aa8f5f1247ceaeabaa4ef0a3e6228247cb9eded0ba30aa462ddfacc7f75a94cff06e2a982fc50e61654270d78164
SSDEEP 49152:Sb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnOQ/lFTjN4:03q6HjByLm
TLSH
T125D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 b32b0722742f3ab664130197d6c20f064537fef17b2c4a34d37bb37efccfb134
MD5 aac1ea1462e0ef56300ceb99ca49889c
SHA1 a04cc37a2de6e0035f4cce6bd4a0e02adca2eaa8
SHA512 48ab6915c5962233b255a94013ee36a0ed1a6effae4acc174f8ef36fac0499154d532810b09722dc651090b735927a69f559487e0178ecef04222dc84a623d36
SSDEEP 12288:L1XLsswWkxy2lRq2czARGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:xXYfDtczAhnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T15465F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 4eb2691a247daa01639475caa57cd0361d9a45b9c83a770df0c9dceed53d9137
MD5 6facbc81648241c2c4993ec4192e4f84
SHA1 8194d0e4f833caf1f9376255ab610191530ffc69
SHA512 65b74c2cbf45dea21ef8c2ba6053080f68d708364aa8fcfede8318ea930c58bb4785e90aba7b62d363a303ae318bfc050dbe1e963a30624b3c9affbc1dfee893
SSDEEP 24576:g0Le5ji0hmxLrMmnQ/tbw/2Mkjy6Fr7g0og:gPji0AlzQ/lFTjN4
TLSH
T1D6859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 744d4c3f6cdd1530b2cfbe97308b693e3399c809f764ddc7a9f41709a81703c4
MD5 3754d07acc3baa2c5f7d23852fdecc79
SHA1 a8601f709d6897ff4de2e13ea119923baba38e29
SHA512 64f37e0ac653b4c6d9cf0b83760a1fe51edc48617b73516637ee1dd40e7bdba31b43a189103e0b49e628c3c341b06e1672e46490e6ac457202c3a4f54e8a733c
SSDEEP 24576:aa7/ezSC6vUyD/aqgrvWE6q8wyu8nQ/tbw/2Mkjy6Fr7g0oE:N/ezSC6vUzPvxHjy3Q/lFTjN4
TLSH
T151755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0f52e005c4329396f685ff35b59689495803091e155099a860f5324b8c7e32d4
MD5 c87721f23aa618e7e96896187077cd0d
SHA1 537ab847b13df393c3caa4684134891cc4ff0065
SHA512 72343ad85fbfe682eda7ae3e9913d245736801c167ea4fa321d2e492872aaf5f3cf6a84e386747b7b5b23ac62f8e2ab514b4a8ea791befe60cf80406ee62bb30
SSDEEP 24576:8VbqPb88hv/l+6NnQ/tbw/2Mkjy6Fr7g0oE:8VO88hXl+aQ/lFTjN4
TLSH
T145559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 acec1ed0fd61cecd150d5911e4839467d6210e995c7370a88926d71c9aaa2730
MD5 26d222e3adbae7483034a0646381b9ec
SHA1 02cceb3ea8bd6e7457b3061a5c8535825d00ea23
SHA512 78d712f0e27169d618f91196d930af148c0f9b691a031d124c138d78495687f50531ffe39755d6c15b12cfb30909b15b82fd15985c96776e3d7ec226de1c2bbf
SSDEEP 12288:kzCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:kzCnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T14D5523796A14F887FF2B06B15CC285826B7B0EC1BFD4AB4E6B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 205504903f7056465af3a286645f980eb59cd8d5fc85aebc01b4cbe8510fbd67
MD5 b526c61a17ffa052e9e815f320618738
SHA1 1f289c113bad5e4f271ef95d514954be4a7f7c87
SHA512 661dc323653b940f909d1af4f37635749159ea6d7ec440be5cfa995ad2c9ec759c669a3aa8c68ef9d29d070614b1e0f1fd356dbcb186c9c0a175a32dd8fab9ef
SSDEEP 12288:keBNUbTVO86UFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:kJIUlnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T19A75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 31e3ed968dc1bcbd7ab08ac739d53388b0e7af9227536772c4d6b1e5ebcd5408
MD5 a9321cbb4ef75d9911e6d8decdf4885e
SHA1 01f9c81d64caad4926709cd25d8a13d67ec841c9
SHA512 65e7f69b5b9380802b29dc5ecffac94756fc550ae85ecc23230de25fd93a22e8315966e782f0a306c96e5d0053eb5d481de1db9fa92d9f0b46bbbf7a433d38e4
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THd:GQvGAdlCEL8c/yRNw5CvLm
TLSH
T16A267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 1f2e90f6a59d8b3e5d9b1200cfee02028f7960b59ddfb34d5ae9fce9112c3989
MD5 c92aed9366a4dd47205748f30d6993f9
SHA1 778151ab63f5dd1ce8a1818950213b20226db289
SHA512 87d59f23eb3e0650f3c5e15c08645906b010e3e8babb63b081497ae3ae2d070afaf5a68085fae15c6d3ea9ccc4196afaa682ba00d6f9a8a0e15c1e76c35d91e0
SSDEEP 12288:KAwSfxL/2Dc39DLLmt0LDQewsAjTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgp:fQewsAjDnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T11975E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 99726660d60fa12edf3d963560d63a417fba211a11e90a95266c31a6184cef26
MD5 74eccf183df55963e140ad7a0299dd31
SHA1 e3ee31b90bf378279d32c37d91402c14c9e38edc
SHA512 ddb4cd684daa0b0f2cc58990d07a053d0f133a98f104310f7e5e037f43ac2d1ea7034ad4017ab18483e1aa02a333e19a99cfbc8213625ef7b9658afe53feb620
SSDEEP 196608:nUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHgL:nUEtQevvqc2W1cpV2EI32
TLSH
T18B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 95815eed6622128041cba6e6f2834299c2eb7e299ba8c98fc23d6ca6b99eacea
MD5 9378cda0df76c3e0264812208247118b
SHA1 3e4ccf86bf73d783e0179ae3ea437b94ee7b591f
SHA512 348c5917ad40956bc23506c0fad111085130f52c8f720e192a14226a5f0ea6a4ce32a4b244c8de4754ccfa57fdb215686a1ad1e7f14b448dbb31713e93910df6
SSDEEP 49152:/CbRquA/m2yL5zQfFiV+XenmE3/zjQ/lFTjN4:YoqtVjnmzLm
TLSH
T1D9D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b7ea68f8c4a955bbe56b604dd9625664002e73b962d53a10893fb3db6ac1ea49
MD5 dbaf000dd7c7a80b29d3d98929403f6c
SHA1 843d129092ad8b5e7a8b9fe41cde8dee66c9b9f8
SHA512 e4240b45964263e99e4480451f727d23e438298ee5633482f1fd380dcfbcfa0e526453e187100b9a896f9dc7c3cc2d8bdad2e2b738d3bb0ff377ce32452624af
SSDEEP 24576:+AhGLJIFoiwtA5l7S53AnQ/tbw/2Mkjy6Fr7g0ok:+AMyFoiq5wQ/lFTjN4
TLSH
T17735AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 f06cbdefc1eedfe38417a12420a6a516abc91513bd4290abc7561a2821b28493
MD5 1c4d9a1f8522abcdd9701162cca9bfa7
SHA1 b9b76583c013aea8ad6d8a3807b89ca613d2ad4e
SHA512 d3f7aa14c068133b63ca417c11d374915135f466d4d83bf01ac879ce1df579260085b16186fc20371adddb8ad418069d841c7a24f0d8ce1adfe18b80936f0f6b
SSDEEP 12288:omw5HEjsChN2BFgl0WDm+CcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMJ:FwuHOWXnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T14465F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8927e2c1ab3621a5344ca8d412660dd95eb259c13529c2b1cd0150ef259c2d5b
MD5 2e96922733c2d8ecbd8fc2ba551fb384
SHA1 cba2dc97198929f615d352bb2084fc41d71ee262
SHA512 8f557ab4d3b0b9f0bbb6dab658c619e7599faeb6e33e4291aae8032f07a758654692701065fbaab73063a6a54bc2fbf2cc8048c978ff44ac88f84dec4dc53867
SSDEEP 12288:DXZ1IyjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWXN:bZuenQ/tbw/2Mkjy6Fr7g0oXN
TLSH
T15455126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 137155aaf97eaa56d1a43d29a0553e2c46c519208f070343ea8d966933aec003
MD5 c5525b99f6a2669bbbf6a116021a0531
SHA1 a7a22ce2d17512029fa636866744c59be21f8deb
SHA512 3371293526c4843f20019745976c25e8be2c7aef2695aef5f6ad5e70fec546be47f08938601e9f3e682474eac6207a5ee009ab8d299cf840609c6cab82807382
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uh:pQRQyi36YOcPQLvw2gAf+PN3OLm
TLSH
T122667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 90e3f305835a22f347b4f3f057b7d33d484b2a92a9d09f30a6f8a7960c884452
MD5 2b91d90931e68538552f59e708717b03
SHA1 3db937974da98cf39387f49e3a12b897a664f80b
SHA512 ec91e8a96230f612405103f7e7b16366933e0ba2b86b53719b09421ff796fab46699fb27ac24482cb9f23aa21aca147ebc372664871293cc8075fbe281c1ac57
SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uh:7QRQyi36YOcPQLvw2gAf+PN3OLm
TLSH
T186666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0e2bbfcfee9d1eed4240adad841a15fc9f94d327a32c883ca97b19141e4dd8e2
MD5 56382adfa4fa9c3c6741e23faf7eea06
SHA1 4fb5d0f54eecf2b8a17c21b49b84f6ffee98628e
SHA512 ea7f8feb609ef92d6cd1a2493a6b01e827cee04ade7a7027a6940a06e46b0d1e66c3352a5938f7baa4b40c98864115ace34ca949e0230bb7d1f4a9a480d14102
SSDEEP 24576:gwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0OnQ/tbw/2Mkjy68:G68Qg55nhheWu7PNU3/zQ/lFTjN4
TLSH
T1A4B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 20b54eac16830ca99f4faee6c0239ddb27e8c78d1648d325b80efef3aad667ff
MD5 454622a49e78ff0e910ab468dbfd8daa
SHA1 0da603e1627e3a0d1e5cb0bbc723fb286aa535b0
SHA512 aade079919c39ca9cb62ceabcbb2acc0581593ce1fc3491ce0c2b134092e6b5c92fe8ad4ea5436320feb2fdad95b07f6b845ea2684f63e74b374072e21636698
SSDEEP 49152:w3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99b:9y5112gYy5azzVvL69nLKnhZNLm
TLSH
T1FF167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1265c43c5d3c1cd7fd8face5af4643f13d5a7e62e2f53567d1b2f854ea40e881
MD5 493cb7041412599c1ec97d03db8e20c5
SHA1 d101fe031318f874716c9c84c0a668405c5dafd6
SHA512 e5c71539769ec313c07bdfc002c5175f09a149cd5f2087c54513c9e4999ad100c38ebeda4575ec5c33c3f2ce087eb426dcef0409875093ba4161c754e8a78039
SSDEEP 49152:ZB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glRQ/lFTjN4:Pu6JmVxd2d2Lm
TLSH
T16DD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 45c5509e59b12edafed7836b8e74c176da4078ab36d6741fa3d139fd851a99eb
MD5 c29e20016f6959853f6c9d3f87b9d8b5
SHA1 18542c94a142a589e8f52afbaa73a093f533309b
SHA512 b905d66488d3b7bf9eefc297d456facc2718364a4353c98639bf3ca59a6429abd4c5281d783e9150bfbbf93b7b0e79d7e08b79fe30fdd3e98cccdd8e036ec1f8
SSDEEP 49152:y1hpsNoJpF1A6UU44CwH7R4xFQ/lFTjN4:ymifPbRzLm
TLSH
T12EB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 40abba4af01c61e9a49238a7240eac37e62a2926b4fd5f44b5d48b1cfaac8004
MD5 52c14a7d6da574e55306a239dffc1c4d
SHA1 55a8710078357066fe0560c21e04356c65f33a4e
SHA512 14794ba34d738ea5bf2a4b008a8a188590bcac2d4886789537a17911d9321dc6a5e6237fa6ea74e626e3365c8bd7cac4b48e18f65bcec589f5b89593bd0bede1
SSDEEP 49152:RSuZQIY0Be2KRRVtOnks6NMHqeQ/lFTjN4:/5dKTi615Lm
TLSH
T1C8C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7237e32e4fe4e0c83afe1524777da8dd81fff6bbca3100f2014bfc53ea26b172
MD5 964562462bf0b03ba62d3e5d51d758b0
SHA1 d2e42a749f8e01542b849b639549fbc6c717c04f
SHA512 a775afa852d30d3212f8b209bcb6c8f8dee1e0e9ae5936acb5e3f8bfd7493aa432b19f3752b7282a2c7001344baea0a7b0646751d7f3e8235b77b1a2b6908d4f
SSDEEP 49152:2htSn8EApI0figngiDn0AP5whQ/lFTjN4:XX2iyphHLm
TLSH
T1A895BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 15850055ed4f2b8975f702e6bdc513094993eaa0dd24147ae21c2f3bb7ae38aa
MD5 c26aa6db89facb3e23a4ae2720dd1146
SHA1 ec70f2ab227ea4c3b0da64e069b787adafbf4646
SHA512 b8e665e732ba5b52c7986258fb766d9261576171f455bfc2fe7c47652bcc2c4bf798b7f489d7ab0b033f2c335ab03aa9f0c209fa2d07827b9dd4f200f143ea70
SSDEEP 12288:VaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:VanQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1575523697965F98BFB1706F148828182A73F0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 bbca4422ef0b6763da42b85188afc9c175e41352641727ec00872621cfd9d0ee
MD5 fbbe8f37b96306f0be45c2b9a4e15d6e
SHA1 bb225c4e473105a137408484dda34222da8a7399
SHA512 a2bcd59dc64e68cb06eef8f44a4bbbbb3a3dea7cee32fcf4da444164ce6c09addc4be602b2ed1fcbde2295ad0c353afe634284b10ab3af97eaee398cb37870c8
SSDEEP 12288:G/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:GfnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T19D5523797965F98BFB1706F1488281829B3B0EC6BFD1A38F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 7f0e58c13347fd86011868331b9278a89f2d9062b71e355eed34e8273409153e
MD5 ec705467b405a2b7f07bd37a0588effa
SHA1 e8f2dc7f899db3f6777c5025c846fa2654d9afa0
SHA512 f94b1b8695b57bd2e84bcaf58b6d985f040d1b9bfed7ece17537f9fbc5f27450a90536582e7d221941aa949470a946c86d232b82834e9d2a1611aba97ab2bde8
SSDEEP 12288:adGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:a9nQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1CC5523697965F98BFB1706F1488381829B3B0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 6662ef01df374cb958971a62ba36009f2574f754ca80e6c76e752493c8816483
MD5 cc5cad1d53025104ce6418cecff9666f
SHA1 374cccacd10c5c59e46a39f181028dd1e3622e1a
SHA512 52a5b3f158b2d0507ba39753d2bd8bf07f01b847c6043d35877ec385ddab974f4dcc67874550255e53708c23ae0025dd3ec13d39ff81d59486c0bb035f988824
SSDEEP 12288:GVAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:bnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T13F5523693A69E4C7F92742B4CC938142E77B3DC5BBB1A3CF6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 5be47ba54820dbef2d0bb7fd28e6daa96a926bebf446ef71c8de588cc76d5d12
MD5 2e3e66ef8993aa4dde47a6981b8542be
SHA1 13f7d9c46a1ad1e900f74e61418f5939bc6c5934
SHA512 cedb0a831d0bf90afe72953a963f7c5f035ee12838c7069e03cb75883948f8be1df8c04146f33f8a819d7798b3f9a53ba36d3773f2b85cc24eb74772c0beabb5
SSDEEP 12288:RoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:RonQ/tbw/2Mkjy6Fr7g0oF
TLSH
T17F5523697965F98BFA1706F14C8381829B3B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 18bba35ef72441f1eaedafad41f98fc039d37a961791923ad49a0aefc632f01a
MD5 dab042225fcd75c2c9a3732ae1842ba0
SHA1 d27eb463858b57edc5f36d94d4f119cf50d04ca7
SHA512 864ba2fe808199b91f7ba0b23c92179a6c569bf792c2cfceb3fc0553325fe5625a7105d297913f7abe38e9717489b417180475f6fd05cf43e677700d6fc39ccf
SSDEEP 12288:VLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:V7nQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1F15523697965F98BFB2706F14C828182973B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2564128fba68df0711b59da9c37554542822c34606e5134e852dfa4093bcd9ea
MD5 c069d2cbc8c69784db09ba9ba1106d52
SHA1 f11a3e8628e57115cdcae62414c78ebe3aab92fe
SHA512 ef6caf0c9a6ed1b7d1c3d2a090a532337666a0a653de86fcc1d060827293307e2eb0f39f69327872be604df906bff662204887ba454470fec917ec7a718e8849
SSDEEP 12288:vnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:vHnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1FC5523797965F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 2ce0757f5d986783de8c1114cddc6f93f84dc229dae1ba5717ddc7c5df4708cc
MD5 084a73b611c185bd5cd66119fe2dcea5
SHA1 8278d813b064277cb86ff5b059bc65eca09296fe
SHA512 72b8e288c9a80ebc85365ce560ce7526af151c8f07eb670a1171a0f030e765462b27759fa9a4b6d30c1f8394ce41b3503c247cd8b539ddcb29fd540763a523a0
SSDEEP 12288:yiZwbDzzFEoS2cPvyfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:VZM3zFVSO/nQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1DE7501A4B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 39bfd70346bd42d13e2b9c94fe1a70d7bf200c6119ac1e8c4ce344e81982a347
MD5 b10e057afa4e0e674ad12ef4c6bffb68
SHA1 ef096954d512fb88574dd0cf051b6c20cd1df4dc
SHA512 43e4719996fe62bcf77b3a7bff0fe1a6196e20a53c4475e07ac73521471b0074ea97429b969fed16f8704d1d63d561ce6fa55a0640ef5ea4d48df3c4f751f86c
SSDEEP 12288:juGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:junQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1A45523697964F98BFB1706F5488281829B7F0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 fa0c203792b550c4254d38019980d3657fad2bafe9f7d8d66a3ebf4cdaabfae7
MD5 586125006859f2f982636c3f375ae622
SHA1 6d45110975242af964433dc1574cbe443b60da9c
SHA512 9565bded5801d4492205af151d79385c1b944bdccfb6f99fafe3ca2889f4d3c94e969ffefee70c3ede4293bcd509f80015ae753c4d71a0a4a2edde3564c29dfd
SSDEEP 12288:KSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:KSnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1525523697964F98BFB1706F5488281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 9b90be9ed8b8163ec73f23f8ee150656521b6388b9f4ed1a72b44c959eea05b4
MD5 fe2c83503af23e072585c1a538f1b182
SHA1 89e12ed5f76ff350a4787c502ccec36a6c47fbb4
SHA512 e0bd811f05d0d0deb2a1179ab3e346ddc6dc0da7b9c12533e83ea5790d60adbf478d5ec8b88d873376dd79f69df3256d8fa2fc7075ba7dc5a1295b058f2bd636
SSDEEP 12288:cyPz5L8jGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:FzyTnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1CB65021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 047287443bbc946102eb54e9921c3e566e628d8ceaf75b441a63700b402515af
MD5 b670b94cae681795f661226cd8a418ff
SHA1 e3a277ac2fcfe0c38413fe3d28746e7b785e9b89
SHA512 d57be382b0d770eaefaa357bb62c14d270c511c61e05cacd711a9ede19f83e91eab3e065ca0693c54e2e2b1ea17657c14271c588ffb276482991ef967fc9e4ae
SSDEEP 12288:8uGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:8unQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1CD5523697964F98BFB1706F5488281829B3F0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 6d95abc783e4e234d3e31a97c2130696538bf0facc55f805c5203202b99f66d4
MD5 fd3d71ac3bdd97f4da42b2dd611e7ff2
SHA1 131c8bc69437062222344bb25240a828618bbac6
SHA512 739692d78205b8ec12fff1d29b1f4f1c983a116964c297d926d751ba5de5173a26fe2cf8683db596d3dd782308046ee94f3bcd1706768d9b84dad3ed6421cf42
SSDEEP 12288:YuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:YunQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1785523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 10d441d4d8ed901194257ea2a3576e507e36907721a6abf2ffd19a7e77098cc3
MD5 5c223aaf530870a6b6e4330a86926baf
SHA1 c17f2816d1dd852a92061947ac45358c59c47825
SHA512 90445045bfe28cc61977e13d22877f023c715feb949674a39627463ad493558083c99ed11256fe567ec9ffefc690494624163a6a1f1a120ebceb991c50caba9c
SSDEEP 12288:SyPz5L8jGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:PzyTnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T10E65021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 b01b75ea057eb5f0a8af44ac634023b32a93d44245060d29cd34d95188b3f0ba
MD5 19a75a6a1c719a825402697557b2f818
SHA1 aaaed4edb4ab7963f14af99223ae9a19f94e0683
SHA512 5dd432b97528e2e61797bc57810bcd2df36922e2ee8f4b601b4b64b57c4974ae097f4b3de77be61eddb25657b211d11a299bb32d18ba16b9f220af70544ea62a
SSDEEP 24576:nT0aLl3z0zDtnQ/tbw/2Mkjy6Fr7g0op:nTDLlj8Q/lFTjN4
TLSH
T10C7501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 c1c3c59785de1f1d0a5b86555da6b5d913afc9af19854117397d3486ea005e9a
MD5 cf72c92a434e63fb1d1542226631a39c
SHA1 bcb2bab721663417e95c3af32129db1dd3731952
SHA512 86460f4c7807b50a1091b9bf1ac89145a9bce699bdb35ac155ba979e381e9f03b080daed63794cdcd91d02129370562fd83961dce1577230d918c3a495161082
SSDEEP 24576:/31d9CHKy7GZ5nQ/tbw/2Mkjy6Fr7g0o0:P1d9CHKyaLQ/lFTjN4
TLSH
T14285CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 5f4389993931605c1d69f2135772c4e9bfa055fa44de1f769328925f86caaeaa
MD5 9837ac6cec26e279b195625450a15ceb
SHA1 6f36d500028b236b707925f1ea19f3b70ac0b228
SHA512 79fd37837061494af70260beb6a6460a742aeae48f99aad3f5364b32927c916af9c6145577d53037706374b0cefe425bcefe5e496eded858a566235a75d3e07a
SSDEEP 12288:f9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:fdnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1F95523697965F98BFB1706F1488281829B3B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 1999f1c32ba513106fc1bf35ecd00a9b017e5dc4b93d1bfef6b2496dfed239ab
MD5 23df7752a65b66f0714b5ca05f0109cb
SHA1 af1432ece7b8e91b916f0352e769d76aedb55fe6
SHA512 80685fb0db0f9d5b4e8d7194a958c55d8d0b76414cfbf8ea3c8c6162e2aa5146efd37d124c09266be96f826a5510f38f21471a8ee7cc94ef46b7f9e4cbea1b9a
SSDEEP 12288:uDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:uznQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1155523787964F99BFA2B06F1488381829B3F0EC6BFD1938F7B481129967D39406D67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 8498470e81cf836a61b91ecccce5ee0c2431ceebfc524ac7f347ba215ed670a4
MD5 17ab5a25eae6434ed7b923ac223d79d5
SHA1 f50151cd6869e90eb269d2e379d8043447f2aa54
SHA512 96daaab7e9522ce6a9a28626e688903e4f9afbeccae0b1e8c5de764efa71732b06f5420d0fee59f309710b57c6174e43cf0faf0c9b69b2bc22d64e5fdeb18b2d
SSDEEP 12288:REGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:RknQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1655523697964F98BFB1706F5488281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 614a98a0196d6a3a5b51c94d3f8b201dce29b47b63c2b6229f5e2890dbf1de24
MD5 2e2f5575ba26aee99d70d1f845621497
SHA1 d1cf4daa351b9076099e6516a72169a36a903f1b
SHA512 74d200d233192be8dbe92bfa68e9c220374c6eafd3d4112aafe13d44d71c123872509bfb34d1293b73d8ed3032df7b97da221dc1149ecbf0e0b1aa59e4a245ad
SSDEEP 12288:/uGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:/unQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1525523697964F98BFB1706F5488281829B3F0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 5bb8fb4d867e69db8188758bb2247d2ec6b7a0f4dce3fa13ce20f780d86d4945
MD5 1679697d1686615a45f527d674eae2ba
SHA1 e8c7bc9b5f98a1235be96c78b59cb6ef2b261987
SHA512 19e34c73f8b6e14d66e68233b2c033e5fc754b1c5bdea0b58903fd9a12a82c123dab3d921600c761141b441d99836d493df8faf4b73dd911a3c6ba51d1a13a29
SSDEEP 12288:s9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:sdnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1865523697925F98BFB1706F1488381829B7B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 d12a771452603eb2b799938888288484600f0eeb6d737099085471c9104b34d9
MD5 b48eb5c3edabc20a2428e1913e5da0e6
SHA1 daed9f55d69cf7951e4e15dbb44928999a85d05e
SHA512 440f7887bf9474eb10135ed6f2cd201db94b196050c2e6507f720d0f06189d24bebd0f6266b834122091df7279dda4dde817da5d21271cf367190280f4c18123
SSDEEP 12288:M2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:MWnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1FC5523697964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481119967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 fa85c7f1d141b9b66fe1893eaadc376498c1ef03f03aae499b8b44778b810180
MD5 03ad4366a922c3414f47fcdd7d728df9
SHA1 7eedc99085dc3869a546f304aff8567a45f1908c
SHA512 64eb0a39ae7d99da9509e2e42e98ea4fbdc3dc6389e9f021b75e159e29353b45c53f57f96eebd55cdaa6d8833cdf4d5534d59b0278578f14fe6be06f9e96b961
SSDEEP 12288:goGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:gonQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1975523697965F98BFA1706F1488381829B3B0EC7BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 725db4c32f8c0c5cb04d38d47ecf6fcddb01971e34b434af16b3e291c5d11ca0
MD5 a28bc153f4a0ab255bb0076b3696035f
SHA1 e609ea2c27881cdfad133df82b8db423a8bf532f
SHA512 ad56d43563f3a4cbcb3a1b0ce43765bef40fe0f31c8505f1f051673e4ba6e9aa1488057b12a4102d9248f2c5144af4d0448d05e71d2719766aa0615bb16f1248
SSDEEP 24576:Ofwv/k9RX6wkyAIinQ/tbw/2Mkjy6Fr7g0oy:FMnYIiQ/lFTjN4
TLSH
T15585DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 357fe4fbd1a0893d81937b8a91d7aaf53f5fdd321ec97e0e58a946b7ad7ddd53
MD5 afdc6d68a3d0a535e897bf9c0aed0076
SHA1 5b0f1a98629e879c166cda45189410d243718088
SHA512 4336d9d238e06f2e99da674ddfbfebd354f9ecac98865ce90a20bd220c9e956e3b4a035fa3c1e8bb74f4bc339b87cd71a22eb69bb5a2af08c899fa758b03022c
SSDEEP 49152:YYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0BQ/lFTjN4:mySzPuLm
TLSH
T1EC066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a9075cbfa576200e6fb92e9343abc8749cf55c6ddec168044c34296ec9d728bc
MD5 939a628fdcc0d22d3fa4b200fecf9a8e
SHA1 3a025acbdcfa6901da25c9b43f3adb9983cda949
SHA512 70a7e910cc28388d77adc079c8c113aa78cfe5729343e2a586922ff6ad115eb56b41e82079b7cbf9dda8e5c7f0b231f5e0fdcbe457d5e16b1aca08c6e382e616
SSDEEP 24576:E47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYPnQ/tbw/2Mkjy6Fr7g0ox:E47JUQj1irIhCnDHUPfF/RQ/lFTjN4
TLSH
T12A65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 2e7e922bf43da3ddf9db5a898271b46eed68d0fb6220b00f55435b98e32ca089
MD5 b0a08f378b52b6c0760a27996370aa8f
SHA1 f0060d47c849465df3cafa46c011d91e164f0b8e
SHA512 eaa0433c11a6e72be17c887a484e90a58fe34c42ce800a58b5ae4d10c13ecf197f338b86e6b94ad7804fdf28d31f715fabf3683f717858c5afff5d234e2c9a09
SSDEEP 12288:qssfeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:senQ/tbw/2Mkjy6Fr7g0oa
TLSH
T18465F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 011d29421090a886ed81dce075a1893beae0d92e51863d87a5c6c3e838591f77
MD5 44b6063d20565fa9430bfce4d9ef502e
SHA1 e7ddc0faba7a207a815527503b71fd8d14d17492
SHA512 24fa964a2f2e45b477cc0fd779a514f635d0a14328e93e011d7504a622f831ad7313fbc23f58150ace62f103aa3929a6dfeea415733b69f7cf2707136a3f461f
SSDEEP 12288:p6DyHK7U3fAU8sWKdUBJDUWUru2Tt7jm5PC5BKc1b5v4FLPbV:p6+HEUPADB0nV2P0n1lv41
TLSH
T1F5351800766AD74FC6A940321E32D1CCA7707C55EE05AF07B3C98B3E957666DBAF2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 34973e5ab9e1124d87590651929d2fd17f3369c6991cafe492217194880d5968
MD5 23a0054a027c1d606094eae16b13258d
SHA1 dea8e1cb621fd40c78bb0092b469967a5dbc9211
SHA512 0162405138a353cd20ebdf5a6a820ec696fe6f2bf7cc04d8220b73198a45f8a6477e9ab55693ee696d783cbf88f74e2097ce43d2a54001944753bcb290ba039c
SSDEEP 6144:YIHRhhPcwt1qk1U375u4BaygXPZnqPZkgZm9WyABp8uS/osYEWNKQQTRM/fca3Hz:YIHRh53PZnqPZkgZm9Ap1gx72wk
TLSH
T18265E8815137E3CFD1F7603213269B4DA7B4EC16B7056F26B389443AD86AB25A0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4c43e0d50e4b217751e4bca29b2487bf8b9f5f68babcc30e62b887f4da069dfa
MD5 67f8240bb9ee6c681b2a778a82aec557
SHA1 ef18576727d1ea5e9ff9e032f0a8a34929ca9abd
SHA512 22977e1630c7f76dd209bdd3163cf321c961e231325cd525507e408a178087e98585977e8b61bd92d37a23ea22a4bb4366efeb16c6379f15872e5e6386863749
SSDEEP 12288:z67mGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:qGnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1375523756668F94BFA3B06B048928111673F0EC5AF90D3CFBB082269957D3D40EF6789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b0cc19f529bcf9b5b1a28533ecb40ba96d1c656814c77587af8728409287499e
MD5 dba0be2a6a32a5c4e27cef7676586c0e
SHA1 ac4eba1d8e746e1cdeac2df9fff621c2be438617
SHA512 ff5d798b4ae6b7dbf73929fe3f2585ee4ff3b67cedf9a005a1e7528d09e858ade24b01b79bee2487fec96041c4260bfcf6041e25f5382a9edaae7199910412f4
SSDEEP 24576:Sgb6bmBIi49WNNFpg1rSvFv7bY8nQ/tbw/2Mkjy6Fr7g0oM:Sgb4mBIBhGFPQ/lFTjN4
TLSH
T1CC65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 5c3720dd3acb99e989a09dfc2d784458bf262f0aaa99b37664a58d983ed68b08
MD5 5629af89b355fb7f2ab9eb2db795b616
SHA1 e70d56dd8f6be698b1d6e3b6df995e3c97d8f063
SHA512 5ee7731d49d072717f5833b292c0a54d120030fa6bb8f241db4d5bb52e724e77573c05ee17dec581b4f1763f42877b0a0a1bc693d2f539ff05513476751cc494
SSDEEP 24576:3G88u8FpJqH1Qzria7/m/nQ/tbw/2Mkjy6Fr7g0oe:27ZFPqVva7/EQ/lFTjN4
TLSH
T11385F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 28e5f6040e16f0e9915f48036baceb3fef2dbbb87428d544dd82ee3f01a2a081
MD5 ae8f662ac16a23894f570b8fa54d290e
SHA1 c29c142f0e08f287d4ad56dab4634b5d857bd73c
SHA512 decb687f271654b423e039f783e1a22ad96d043e43e55ff54407ac7bd6443db336d9ce322262f6e4ba6ce213f790fff6afd3c546b8fd2f098a050051546edf97
SSDEEP 49152:4BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj7Q/lFTjN4:TG05lO43blLm
TLSH
T111D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1bf077554e09b09e37ba93b259d0f0656135990af7ad810940e352a0cba0d1e4
MD5 ac16fc6d7aff984e0ecb00e1e6fc4ecf
SHA1 01b5efa9799636ffa92f26d6b727e1cc8b00fb4b
SHA512 36218c3602dfd1764ba0b3debe2f3f3b93a228ffacdfe9766a9646b50d56fd29916b52564d0c12202e9ff439665eb4eb98580072ecfd176a80f63a9a484a4b58
SSDEEP 24576:Yfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnBnQ/tbw/2Mkjy6Fr7g0oo:ga5POZ3+Jt2pasx2+mzQ/lFTjN4
TLSH
T1C765AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d76af39ad82d92665ca576f0b5cd6f25e404fb081b003eaba6c472104043f152
MD5 bd575bdeda4141e984463df8785cf0b8
SHA1 3f1d218b7ac01663d432bd21d91e355eda23f461
SHA512 27348a66eafd145d5fbaa44a2fde20ef14370a07549a41e7133ebe98bc7d1b5bf6ccc9850e5ad5669a34bdfaf0d9c920fc814a782601ba581bd4b02c542178a5
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7Fk3nQ/tbw/2Mkjy6Fr7g0oy:VNc/zEOVHFkQ/lFTjN4
TLSH
T164858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 22352fbd6d3589608360e81d8f9f04a90f086ee1f498e07ad34d5813001711ae
MD5 a74d1a8fefc1258e5c55ca4a5e6e82ca
SHA1 4bd2aaa7ab9b6052e4ce34fd57a43a34e617c550
SHA512 b66aeac4a23ab2b1714854266da1ca34ac9c8d755c2815949a83c67235f53b4d0d4a901b96b143f744d6755aa4d1b72d316ba6ae7e3817b6db9f995fa745a115
SSDEEP 24576:28kNvNnaFeYhJNtmZBm1nQ/tbw/2Mkjy6Fr7g0oV:28MwBtOm1Q/lFTjN4
TLSH
T14255AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 1498f8d57ea5e3986eb82dff8558c733bfa33a26560c008ce81325339fa5574b
MD5 d37dc84939374ed2c15404a4721b93a8
SHA1 34042418687b484602d8d7da48aa4d2b27d65d6e
SHA512 bba5c4ab330368f183d3f31b3a8e50263dec799f18cf19fc173110c28dfcf6683c837371cc5d1959fe3ddbf715e854d0aa116422bf4ca1595f0b02cd3eec0a45
SSDEEP 12288:bHvUrBFrEjwaQbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:bPUr+NQLnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T11065E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 2a222efe3832fe53c0e1bc07fe5f383f10d4b770b2ecdc176fd5c2413b4ed564
MD5 4c2aafbba9d4d56a2bd85fcef55e8fd1
SHA1 310fabe77275ef63abc974a2f44db4b0d97322de
SHA512 aca661c03207bd924153bb39badfc989d1101d9d7f302705ae96d6f0943f6f95faeb43c3e69f54597cb269c285c5c8b68409616a12cb45ec60725b56bfcc35a5
SSDEEP 24576:sD3FHshBIYQgA6nQ/tbw/2Mkjy6Fr7g0o+:sDVHeBIAA6Q/lFTjN4
TLSH
T1E875E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-77-0x0000000000960000-0x00000000009C6000-memory.dmp

Download

memory/204-76-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/204-82-0x0000000000960000-0x00000000009C6000-memory.dmp

Download

memory/204-307-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1072-87-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1072-94-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1072-325-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1072-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1072-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1072-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1720-13-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1720-86-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1720-21-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1720-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1720-20-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1728-310-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1728-113-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1728-111-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1728-119-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/2636-48-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2636-50-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2636-38-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2636-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2636-37-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2880-132-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2880-126-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2880-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2880-136-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2880-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3260-52-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3260-59-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/3260-53-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/3260-275-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3680-123-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3680-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3680-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3680-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4608-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4608-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4608-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4608-311-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4608-106-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4608-100-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4944-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4944-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4944-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4944-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5180-75-0x0000000000400000-0x000000000056E000-memory.dmp

Download

memory/5180-0-0x0000000000400000-0x000000000056E000-memory.dmp

Download

memory/5180-7-0x0000000002570000-0x00000000025D6000-memory.dmp

Download

memory/5180-1-0x0000000002570000-0x00000000025D6000-memory.dmp

Download

memory/5180-6-0x0000000002570000-0x00000000025D6000-memory.dmp

Download

memory/6060-292-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/6060-63-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/6060-65-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/6060-71-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download