5e244a8585a2e212493d382520c01629d41053223b67a9f30e2b737fa9902be1

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.4MB
Sample260818-aph6qstsft
SHA256 5e244a8585a2e212493d382520c01629d41053223b67a9f30e2b737fa9902be1
MD5 5ec575ae9b892f2728715d264c1e1415
SHA1 f304daa8ad423dac21c839ac3178fcf3b45f1db8
SHA512 19472056260a78aa3e21cc9589ba77ba98fed4dbe168069a42e8a4ea1614bfc27fb42f701139c5b894403c47055b93c229da94513c7c31761b3d67b62fe58915
SSDEEP 12288:NibwAEUmeF66jedGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:IDF66je9nQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1746501353AE0D033E273217108D2D7B56BBEA9B19F61978B7B80177D5F343918A2934A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1476	elevation_service.exe
2780	elevation_service.exe
2056	maintenanceservice.exe
1512	OSE.EXE
5008	PerceptionSimulationService.exe
2556	perfhost.exe
5076	ReFsDedupSvc.exe
4380	SensorDataService.exe
4352	ssh-agent.exe
3540	AgentService.exe
2084	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6e3d5085763f1d8f.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaw.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaws.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a6ca130ea82edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079495ecea72edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ea74820da82edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026a0a70da82edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cdb9b7cca72edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c79d4d0da82edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe

Runs .reg file with regedit 1 IoCs

pid	Process
956	regedit.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
1476	elevation_service.exe
1476	elevation_service.exe
1476	elevation_service.exe
1476	elevation_service.exe
1476	elevation_service.exe
1476	elevation_service.exe
1476	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeBackupPrivilege	5076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5076	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3540	AgentService.exe
Token: 33	2084	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2084	SearchIndexer.exe
Token: SeDebugPrivilege	988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	1476	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 956	988	2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	90
PID 2084 wrote to memory of 3152	2084	SearchIndexer.exe	102
PID 2084 wrote to memory of 1432	2084	SearchIndexer.exe	103
PID 2084 wrote to memory of 1216	2084	SearchIndexer.exe	104
PID 2084 wrote to memory of 2160	2084	SearchIndexer.exe	105
PID 2084 wrote to memory of 2680	2084	SearchIndexer.exe	107
PID 2084 wrote to memory of 3696	2084	SearchIndexer.exe	108
PID 2084 wrote to memory of 3280	2084	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_5ec575ae9b892f2728715d264c1e1415_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:988
- C:\Windows\SysWOW64\regedit.exe
  C:\Windows\regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\config.reg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:956

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2780

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2056

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1512

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5008

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2556

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4380

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4352

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3540

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3152
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1432
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1216
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2592 2588 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2160
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2680
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2592 2588 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3696
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bd32a6275a99e71a15623c95d83094329fddc779cd2817f5ef5743e21a317320
MD5 12d0c21b392910b95beaecd4b551e24c
SHA1 c06cbaebfdaa96772431ed7dc516838412a258d3
SHA512 670791730ff0a5684ea6edd1347185d9795e88b6e968e89d222e5bb18f13bc44a0442d1b7323875f6aa03c8de29eb61df20d2c8389dbad428991701e3514ad13
SSDEEP 49152:sb+632BuPkFKRrdE6ohmstBhuXjfS4LWxndQ/lFTjN4:W3q6HjB1Lm
TLSH
T1B3D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 0a79ba80a0d048f8dc25148af463e900a725fc111e0859fe9767e93db62eef65
MD5 4b59b57769ab0d6fb1da62eba1a7123c
SHA1 125a0030d3ff961573271f2097e3c1cc99fa6b82
SHA512 d6a9f3cb5651b10529186f43ef21e3125609b07ad5e4102c9648faf0f0e14cbe1804a0730dd16f2437a26b6708ba807e0bb03dac656f0e9aad051b6acdb270ce
SSDEEP 12288:j1XLsswWkxy2lRq2czA2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:5XYfDtczAWnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T11165F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 713e1cf08484465b92b4aabda2367651cad6e2fc7de549fd5a421d4546e40d45
MD5 26e3f4fa8bf36af39f330ec99b8f2f65
SHA1 58a78a95869fffe7a65956009ce3446255fdd816
SHA512 98524983438b41af97215d87d06640dda8e1878e7a5ab32b1e1fd5a681202c95e2918e117a2c2a5d4ddc42927741c3120d95fa68895425e46736e37902ef46fd
SSDEEP 24576:f0Le5ji0hmxLrM1nQ/tbw/2Mkjy6Fr7g0oh:fPji0AloQ/lFTjN4
TLSH
T178859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7af4a88af400951f9df072b5701d56dd953b66824e8f613c7d517251ef0862be
MD5 c0f1e3e671f57a766b0d2859901e6e30
SHA1 44ddc343e5ba382a6a868a8e617ce6e8d0a11234
SHA512 165ef9c0a1f29374fda10e3506e645b6ae6e5c119cca888f3bb7b07ee5616bfd971b1649c8c0d9e5ae13db7e09e152d3cb85f0882c086a7a095e27829aed30be
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWE6q8wyuznQ/tbw/2Mkjy6Fr7g0oh://ezSC6vUzPvxHjyUQ/lFTjN4
TLSH
T199755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 41481c363a8eb736379148a684686cfdc360bc4afaf231822c961d7842b52ce4
MD5 86d70e27b4238611c766cb54d3197cbb
SHA1 29c1e5137519f2952b2f87e8ad1d2b6ce34398ff
SHA512 e20a94ac9fabaf740afd43fcc69378224eb57fc2449d1d1b78da1947510fcfe903a17d42bd5e9dfe0726381a34db06ca1739ab061d8c5528b79d09eb587dd21a
SSDEEP 24576:kVbqPb88hv/l+6KnQ/tbw/2Mkjy6Fr7g0ox:kVO88hXl+BQ/lFTjN4
TLSH
T178559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 da87317402fb936005cbc442d6cb712260a30724a8b28a48badc6da5ebddaf22
MD5 bddf821510ce3c850561c4b3c37dd4cd
SHA1 7294cd087c4c570dfad6b5ea90a1e81287a22653
SHA512 a7f79111503db5f86120f1dfc4f56b196216947bf35bbf6df330825b59e23d903f8b48ec19bec19aa596bce0815728c3fc50b0e1fa5cff8a2c88d6d54e12b5b6
SSDEEP 12288:BzZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:BzpnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1155523696A14F897FF2B06B15CC28582AB7B0EC1BFD4A74E7B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 08ea1adbf126de9cb11f89df4e4bed1d01a7b4a714d07e6e3a0e72b7f9509dad
MD5 309219c7277dd427e9594b3de553ff43
SHA1 d097deadba5f8b22befe9b388edec5cc5767a275
SHA512 00d2371531b3f013823b971d96d9c5bc2420bdb41d5bcbc235495a83c1bc3e38dea71c7266b65540de7f9b4dd201f6df5d61b6be846aa8ce9b26706ec7b245d5
SSDEEP 12288:DeBNUbTVO86UiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:DJIUinQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1B575CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2641f8d82b553d30b0b55290947ba6352d9054f78221fc5a3110fa091f4c11f7
MD5 f7139f8dbaa3551c6cb6a0e5d7f9eb1d
SHA1 1252de18faff92fec70861f675ad7f23a3a8777a
SHA512 7bb0233851ea121ec0a3337f39c7edde39fe933e7f005e79780cc50ab930123c5f286a93f842b017174c7c36ea598867caffa343e2b0d8597fb63dd47221c10f
SSDEEP 49152:PQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THY:PQvGAdlCEL8c/yRNw5CoLm
TLSH
T134267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 fea6a1ab0429e4197b0e043f046688e5eb518feaa1b6e37812fd1039e5f5b45c
MD5 bc09b752f6b3f0d38009e622325bd1b5
SHA1 589a0c7ce6aad596a45b57029966254f0210e45b
SHA512 933faefdcee45db3c3b448df53ee2ade9dd424f041ab8290409a443d22cba3582d0ed05830476d15179c8dce87e3e85ebf6e8561bb777f57940ac96dc0115d2d
SSDEEP 12288:3AwSfxL/2Dc39DLLmt0LDQewsAj4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgo:QQewsAj4nQ/tbw/2Mkjy6Fr7g0oq
TLSH
T14C75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0985cf6ecf937dda4d31cc5166002ce2ed1c476c8b3aad30136f3d08b667a973
MD5 ed7486238c324d97f90e741f2ecc57df
SHA1 6956227fa1aecd556023c7462d869350654c1905
SHA512 a5002dedbb08bae8ab7f089bf1208105027d3ac95a65cd5056108e4a427a390992d9b284230156f6494b205b9c9b65535c0d0160f32d76ae40c8f50482614b52
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHTL:XUEtQevvqc2W1cpV2EI32
TLSH
T135474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 607eec921dfc173e3eec31ab138b658f073d1beb6bc619f1d4b70ddd0916f998
MD5 c4db3d1c472fab7b4792f08d1c018489
SHA1 a434cfd635d39dea7f9ded1a36626603aa5c0968
SHA512 0b9c0abd72ae78b0fbd77d7281140b2155b9cc54c99a144ac196fd9b008e77528654c9a98fc6877a13fea383eb1e5f425b98b831ba07c26ff9c93ea81f1e7ec2
SSDEEP 49152:8CbRquA/m2yL5zQfFiV+XenmE3/zYQ/lFTjN4:1oqtVjnmELm
TLSH
T178D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 70ca7fc1f368d487eab0043651b98ba75c3398da8f665c103a4f2407ef97a02b
MD5 b79d37ada88e298aaf14a14efcc103e1
SHA1 2f5ed994d8121f65882ce5b14c598431a5e610a6
SHA512 e41ab63d86b5e937e182a5d199050915a6c3c21b82bc75d5d1121e366cef89eafb34bea03533047cf8d15d38f744e917f603318d530a0dab6198f62e30310a71
SSDEEP 24576:RAhGLJIFoiwtA5l7S53vnQ/tbw/2Mkjy6Fr7g0o1:RAMyFoiq5fQ/lFTjN4
TLSH
T18A35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 1aeb28be648fd6fc5da517fc47ea5c39c706e470c8a4cf8c577a5366ba116908
MD5 2e3a5d8b514dd46e1127960517d13d2c
SHA1 063ce5628407988576d6f5735dab26e76bfb64e7
SHA512 3b3cf9631f150f5102d8ad86d0fff2f9ab214497c347ea26719529e0bd5aac517a71740f61ac288affe138123d4a2a5e0997cdc2ea28ed3a8838c13e1c4c33b4
SSDEEP 12288:omw5HEjsChN2BFgl0WDm+CjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMu:FwuHOW0nQ/tbw/2Mkjy6Fr7g0oP
TLSH
T18765F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 6d7cb7578246f73a300a6f21de62527d9410b6f25122fe730ff800345af3be9a
MD5 2a5e916810ede18f3b061bad2d8e256f
SHA1 04ba6f251a58b3387712749b140a423ce97fd7c6
SHA512 373a1544ae9652b2e95a4d5eb172ca2a31e2fb501aa1ee917ba7995cbfa7fa467823526a4aa082e224f38c24ed486d336e0837857da6b431cddde7b358230af1
SSDEEP 12288:vXZ1IyIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWAN:fZutnQ/tbw/2Mkjy6Fr7g0oAN
TLSH
T18955126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3c0c2bd2d0600fee03e87bba2165d31b3ef146cf4e660bcfd4337b877b20b421
MD5 22bc3056bad660018ad3e77862372f34
SHA1 10e54a86ac79711cc247ec23daeae918e826816e
SHA512 e847805db266f66ba587d3798040bd116114c25c1596f71885946408d5bfcc805664e8c27aae06046d6c97ab678b368d6f76eee5522bf4b89fc548f7c161648a
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UU:1QRQyi36YOcPQLvw2gAf+PN3pLm
TLSH
T12F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6d25b2e6e6367d6c0a7c6c0615312fe5d52fe2ffca7ce6df8e2d07c2bc044889
MD5 325665d6e5f5233c1a7b78ac0e72bd0a
SHA1 f6eab5b2a6e765e8734b48a04621f3762563016f
SHA512 c799ec41495fb717638842b529a1f6dcf481fa77bee617d272e2d735d29c7964b76b78cac2466b4e397324191513372e36acbb7db8fec77f105691365bfed2e2
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UU:JQRQyi36YOcPQLvw2gAf+PN3pLm
TLSH
T1FB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 dd494271c29821a1b7ae1c27d0f53a3292e03933b3eb00c8fbfed92479e87790
MD5 c129d263beb535b7921c690d36b87258
SHA1 55d1bcc60fd885c0ba0d604ca0f4518ac6e6f940
SHA512 fc8f48f8afb20a4931a1818d1f1e70c3e0e0c20c66a4d922aa1b77276df624ac77acea077f7a9d682d3a0fd525a2a0dd6d89d24c85222f3522eea78407c3e0ec
SSDEEP 24576:ywvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0dnQ/tbw/2Mkjy6z:M68Qg55nhheWu7PNU3/oQ/lFTjN4
TLSH
T110B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ded66eca0429cef67ae1bdaa9ef0657cb6ef0730af2ab48498b4cf6347fc8e64
MD5 e4bd257d4659c1ed727c8241c04cc41a
SHA1 c0062032eb7273ed9b0d58da1db0046070572163
SHA512 67512f5ec793ab7c0c6085d2b733f0173ae761cce10bc34d06233b29f754d36ac12d804479114e0f3842d0dfcbef065e4a29d3b3a559f6a55a04fc820718b4cc
SSDEEP 49152:Y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99+:Vy5112gYy5azzVvL69nLKnhZeLm
TLSH
T133167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b37d3388b2c7a13b3121d4531af23e7b8ed24a41e668c6b77e218adffce979c3
MD5 b3d6b7ef3f0353b92e1a849bff8e5126
SHA1 d4ecfb4c0775c6d429e81693a9e5abcd6593cceb
SHA512 2510c16bfcef3b0152024fa81817479a4af27acaa7908164a13c029373c5885e832553eb907fbd1fe3ff0a13a068e5943bb186a62abe65d7c5e4731224421c04
SSDEEP 49152:rB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glGQ/lFTjN4:9u6JmVxd2dRLm
TLSH
T118D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 618c63813f21b65ee5fcac4f0dce338f8410655bbdbf67bebd7f42ecbf98c9c7
MD5 6b5736ccfe551c25cdfb64b6544165b2
SHA1 e637ec817bf54fc098afdc5c6a1f83b9f2b166d0
SHA512 ebdc28aa805a13c65ffc0493400aa1bdf794fdc4931c64f65ebafe67c9deb894a7240aa894227a51d86e90450c29600cf9219117dc124edc87a3ab193a9a6ef7
SSDEEP 49152:M1hpsNoJpF1A6UU44CwH7R4xCQ/lFTjN4:MmifPbRELm
TLSH
T14EB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 43f6fbb71ecb253e22588336cd5212e1a37d05a5a7ef41f37bcfef8e3de3204e
MD5 7c4067f57e8128726f8a1763535f07c4
SHA1 652852e677f82ccd9a63f1df8b98f14e71b1813a
SHA512 1c79eb121ebd103e122099f9e5138082fdb15a4919ff0bb290023f5ceb90db67f5d09446df1aff89fe907290fd834968ff8c290bebb369adf94a5d6b37fb2015
SSDEEP 49152:7SuZQIY0Be2KRRVtOnks6NMHqtQ/lFTjN4:p5dKTi61iLm
TLSH
T117C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b935a57f048effbfe40954b0ab8d51231c801a85525a6d851f6565fa37fc5ede
MD5 b9e13176f05dbd087f313ca1f9f3959d
SHA1 cc7608696351656e4600d6daef28572a2ecf80fb
SHA512 f9a878eebf46109d0bfb386a16cd756af5d06b17876a1f5c2ec5949889f3e38e14226145ddad80fcfa0a89aa359a0c4f925d2c5c31157ab6924cf3a52c10a25a
SSDEEP 49152:ZhtSn8EApI0figngiDn0AP5wWQ/lFTjN4:oX2iyphALm
TLSH
T13D95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 95ffe089bef153399d88663d9367c260ccbd4d9348e4bea4ab8a6b8bd23dbbb4
MD5 cdbfda7c1bf7099f4da4ff5f2d21d8d0
SHA1 a934016386a3ca0fde9e98a1cc66e13e08793460
SHA512 f757fed8a5893339dcbfc29ce57f39b582cbd3a058ae457f4c749f3bf5007f6d1456c8e7b6bdb7566c31fec2c25700cbdb6b63909fe2fca05165bd3c79259ab1
SSDEEP 12288:YxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:YBnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T18A5523697965F98BFB1706F14C828182973F0EC6BFD1A38F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 92b064ffc127a0e3f2de63d8539825975dff55469c19f903397bd61742f80961
MD5 823f4a19a932eadcb28f23d78fbac0b4
SHA1 464e1858f40f84c4407ece405d66d9a51f93552c
SHA512 116f16f8830dd8bb58ae261086ebdcd496b19e4c6e11fcba3f355aefed44f91d9dd967f2917e96e278ef3e67fc580254e17f317607fa6aaba1dcbb85635c6ead
SSDEEP 12288:t8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:t8nQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1BB5523797965F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d544a42feec511fe2a061c900de1c0315509a3512af8f80dc0431d607978ece6
MD5 54036ee8be943cc2e0c724aad1d50778
SHA1 cce3683b337ea2182a5689812b0898c6ece77877
SHA512 0a81bdbd452d29af58295b7eec63a42e7c5919a5ad98de5f29b7a766a4cbcae35391da2c7333f86a92c70661f5b495765c61813d8566c8ff157ceccf7d63f89d
SSDEEP 12288:S6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:S6nQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1B55523697925F98BFB1706F14C8381829B7B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 7a79cd326027782596f1a74ff424361598acba25aa594deed382503b8d57394c
MD5 78b37751a54280e7e1d466f9f601c991
SHA1 4e4e82df45c97bf21e6bf9f1ec9610bdd07c5b4e
SHA512 f4d3a8446c515a42e74d4924735f000122d83ed189e2fb736b54275e59a00c03103a12e34228f7c0a94195185c883d6f3c4509dc70feb3cb0b7700df4ef8a49f
SSDEEP 12288:YVvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:qnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1BB5523693A69F4C7F92742B4CC928142E77B3DC5BBB1A3CF6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 12c6f3ff1e17235d677aaba6c7a193b73e928bb762fa9f9a26c59a0ac08e860e
MD5 3dac49f629418e6d51f170a8921e946d
SHA1 36490073e64a371bbc055ee27a73bf34cbf644b7
SHA512 8e370596741496de5537b5f2e626f2bdd49c11034bf1932940eea1b6611d5c503eab6b589bafb1f857f1738e8828cde534d9b38d733af881e99d3b146c74336b
SSDEEP 12288:xXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:x3nQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1995523697925F98BFB1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 225500d5a2196a553942bd7b0fb36e504eb0e6a3f3c055cfe4d089a96b655a3b
MD5 8e6754675d48c9f528a6ceef04a7dce7
SHA1 27e83899e5d01840998b2ea918aec9acae7425bd
SHA512 b3bdab6c97afd29416ff45f2b82c6c20a303bd32b1584d58b122b3358d7be30191df1715bdbd9650c07641af145de32cbb57a3e5a39b36bd9168e0f6543e65e5
SSDEEP 12288:/wGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:/QnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1A25523697965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 9afb6f75057e7c3506d653b3b7e2b858a36811c57c7a614438e5379ca798141a
MD5 702786b8395631c2e3dabc509566a281
SHA1 6c16f272371dab3d0db4a88f8f527fc559f5968a
SHA512 3433d87b893b99d088f09e8ce19515acd1d6b0e439d4b1380dba6d1dad3f4b346cdae3e871ed3b95e19779df7326954126efb172e412cf8f7b35c0b02bd209ea
SSDEEP 12288:AEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:AknQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1355523697925F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 5ac8d41cef1c07bb8f36d09c580e98debd2016562c96fd70f41db09a2c1ac7dd
MD5 1148bbb69a76fdceef4441a346618d21
SHA1 49e537a9987a8a0cf384b13950aa0d1c61c69d10
SHA512 b704602370612971814ea96e34727cb3cbeb6c7a7f5fccd6cf4311087663d85aba272512d20901149200efe02ebdcb7dba9bdad88e5ed316be7ed77f609e2a2b
SSDEEP 12288:WiZwbDzzFEoS2cPvycGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:ZZM3zFVSOcnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1427501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5f320f69d424044d8ae86aadbd1e1e972eecfd241e519bd33f9506d7ba9dce53
MD5 52acfbc14753636413ba298d871d3ffc
SHA1 8b4a7ec4d7b04e00b2069d5d5fc0bbb0781f2aa5
SHA512 9bca5940a231f10011068d5791a229f38f09efbaac7234f2090ad4fe187a0a0a910ab61cba17c47612d1341cf221c264d79cba9a11fbf41cb3d8aaf1df0ca432
SSDEEP 12288:9dGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:99nQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T14C5523697924F98BFB1706F5488281829B7F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 da6db1672e061f2ee16774b4fca5cd59df14597a80839fca24ce2573e2e8318a
MD5 6cdbc660ca1b142e05d26b58218fde3b
SHA1 406721dd19800cc15cc73a1274aacb1a3ac08b39
SHA512 7af7e69c8efa6475930b57a625c5df3ebb9e0bff0ee1a98937e0b49dd3a9b3dcee28270b466f00a747b739b6aecfcfd774383f2e0ab1f7a628206063600a68bd
SSDEEP 12288:lpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:l5nQ/tbw/2Mkjy6Fr7g0os
TLSH
T15A5523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 71ddf0d2dd126c0088f7eeb693e80966cb94b62a93f800f6a50d0d3efeffc65c
MD5 52eac1bc425c27aba732d0eaa7eba844
SHA1 05430fabd1e5b6a6066b167ecf4d12dd4e7a21a1
SHA512 f0a7d04fbebe43e0edf943c2e50dd172419116e9b0e75b5d241492067c3c4bdc7de79a6bde77e21e86b1fdaff2d304ab29af3d226528a99eac40dd9c56a2ff9d
SSDEEP 12288:7yPz5L8IGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:2zyInQ/tbw/2Mkjy6Fr7g0oy
TLSH
T12A65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 83a7dfd8abaa23e7f64d3b32d3a0ef4fb203cfcbd56e809c529c8c636f9a762a
MD5 ee12cb62601b1e1deddabfb6f34d246c
SHA1 52eb17145a11c5a45b33c5166b65fd471c8b9cce
SHA512 67ac8c225dcfc1b25ba6982d21c20c788997d9cf8ee69d685a11968b1234d07bfae3e84843933a822195892a187a7b292828cc27f94407d8b228b7a565f98cd7
SSDEEP 12288:rdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:r9nQ/tbw/2Mkjy6Fr7g0op
TLSH
T1CB5523697925F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d0a4d8cebc68c25798a6c57864f348b5fe5894ac36329b3ee01718ea065357ce
MD5 08b39e8b8a9a1d091ad41c47b163d103
SHA1 7b767ac6eff37bee4ec8c5c0f89654e3e7db5ee9
SHA512 2fc8018ebd89122c4a3a9577077ff3d1a48251e972f4abdf3822fdda4774423c3eb0a45149f27a0767c4ed7b93eaf6dfa985f26f5d3df6750029d9248837f6f6
SSDEEP 12288:odGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:o9nQ/tbw/2Mkjy6Fr7g0op
TLSH
T13E5523697925F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 40a031273e5a3db9f32094b715b08f1c3d19b42b2efdacff09275ab05b97f518
MD5 a8fca86938ebcc83269e8ac522c3f9b2
SHA1 020f91cf3fb362a1552a0dbd4abd31c59b151fc1
SHA512 1dfee652618bfff766ec25930229ae5e70467be37cd8615663eb597e6eea4adda3eb762dddacc1ccccfc94721f7eda284163ab545431661253879b57270b851a
SSDEEP 12288:3yPz5L8IGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:6zyInQ/tbw/2Mkjy6Fr7g0oX
TLSH
T14565021773A570FAE537427888920A02F77678725B609BAF2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 87247626bda3cb0d12a3a66a2bc81cf4d43f65c367d92686954b44258b9d7641
MD5 ae9d89c798c591d4367408a5945205ac
SHA1 0d11e02aadf8b882f9721e6e9c9be7fccbfb3e49
SHA512 d359b11b7bca5f414c6a2cf80852584980da9b463bbd74a75799cedb5073fe826d463b41c318612fb73a1094755c30cd034ac9bd8b6259a1a2d6e9034ffd75ef
SSDEEP 24576:uT0aLl3z0zDqnQ/tbw/2Mkjy6Fr7g0o7:uTDLljzQ/lFTjN4
TLSH
T1237501A4B35068F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 bfc46e0946516a698d9c4dce265e52bec85b92bd1060a2c434b8a58a5725a1ed
MD5 1d014662422c0c02e8264bdb0e4cb7bf
SHA1 694a64533c2a13a191b47e2c5da49df50e109c37
SHA512 def263d22c06640d6f298fe941af6910db53eb47e4805ac0a9b5b2a2efaff7e3fea6e9f712debe0f034222e7f1c881a69e6eee881f96adeb0b049a79a1abf321
SSDEEP 24576:p31d9CHKy7GZunQ/tbw/2Mkjy6Fr7g0oW:51d9CHKyagQ/lFTjN4
TLSH
T1EF85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 b070bc36694ca3589ee0d1e16430760eec9a147c3bdbd4fc3baa8f845112dcce
MD5 06906d584b5e9f2652550db7f4ccb34c
SHA1 d3058cfad88be3e533a5a4498f841f893b1cb7de
SHA512 2201a2212d133b9fb2eab2cce792f3f92f59e2a431454364ae888fbea98016eb3bf5c57603b65651aa2c16fcb3bddd7f68683c30fa075de2a5737a34ba564998
SSDEEP 12288:UaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:UanQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1F75523697925F98BFB1706F14C8381829B3B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 a91e2fab81924481639c435687b258606dfd1f32caf2d0453faa5b8391bb05f9
MD5 4919ba07ae10245bafa4ab67033dcf3f
SHA1 8f516fdbdef7a46273b20d7d0f3c729c6e7db2ac
SHA512 445417cfd177ab82dfbc65004af77d1274828796e62354faa02d47d3bb3b2bdbf3135e603a4e79339d850e6fa74e868a95ac8cfd29e121269bed70cf670dc52e
SSDEEP 12288:joGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:jonQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1B35523787964F99BFA2B06F14C8381829B3B0EC6BFD1938F7B481129967D39406C67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 b734e0e99d331e470ffa8a617b3ef9c62d2727db3fda112933e8d563b528d208
MD5 38b8a102caadc7699b8e279c3f4e390d
SHA1 ec0983c52fe0f2bf77c37f0736469e4232312f75
SHA512 070b56a872e877fb99ec199d27f1b7ab9e8a46b8b9ec94554a64e7c19979e168c631e382b623eb00d4248f944c291005a5b546ba14d5c844398590a43c920370
SSDEEP 12288:zrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:zbnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1955523697924F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 4c5ce40026d7d137f8c2ab1a8ff4951426595eb5e18d13cd7c4bba75b499fb22
MD5 ec6fba4a20a06fe031b181eb2c72e80a
SHA1 c2a42429d6658d8c80e5fd90ea55425c940e3a0a
SHA512 4191296b4b444b533d44bbeac79d850f3f51ec72bedb7ad44a2317bf85f8ec522f02d717502cfd3ac7d9d0ebae02667ae5c57d80c057ecb62670cc68832ce7c0
SSDEEP 12288:zdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:z9nQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1325523697925F98BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 1e0121c09f4a584b37ba11aadd3c8b0d9df1a2231b70c17d4f686b245b12b8e0
MD5 3f477af54b3510846fd351421ce767d7
SHA1 3fd3f1eb83c3bdb2d2b4ab5592abf33d877b68bb
SHA512 27a4ec8d43677777cc6bb8dc5d38fdd492348ad124621786c6ffc6a5d10d1dccb76470af998113cb0f1f8d58c53a3cf16823c4e488fee476b2ea376d652a2b86
SSDEEP 12288:oaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:oanQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T19E5523697925F98BFA1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 1375f2a2ab1fa301558c981536eab9c8556e33218a150b4a387641f39d2ed61f
MD5 3df727b95d763cc709c69b07d0a82623
SHA1 ebdd1fed54b0d306d6a6478322d7c76d2dca0aef
SHA512 a0789f2b8bb2d5c3bb91bcf109c85581a3292b93e413577c75be8a933342495da6ba7161fbd9f770c1455cd41448a7af6cd9b87ce4bfcb75b62dec35d3f84e73
SSDEEP 12288:PFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:PlnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1185523797964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 4b8f09230e1119a16a27bfbd10132d78b4c13b1da35b8460771ae2fa02fa7954
MD5 7db63c86c2486fb009f3bd19c782f9fb
SHA1 b751c5bccacb251f1d2724fd8e2e644281555682
SHA512 2710d284c538c54d4079c7ffd094cea94da4a1d9126ee2f0bc40cc69d546a9a45173197e63efd27a1a9f4765a55ab15bafa6745ba913af0bd1e54cfaff10f715
SSDEEP 12288:lXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:l3nQ/tbw/2Mkjy6Fr7g0oO
TLSH
T16D5523697925F98BFB1706F14C8381829B3B0EC6BFD1A38F7B481129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 1fa18655d5b3f19303633c61910c0a43782db27e01c701883d198ea172321040
MD5 f56e9c2154810d82c1183a68e4853535
SHA1 dd51498e33b6cdffd2d1a44df4ced4c7bc529afa
SHA512 fec63106e3d453e379fee2666d6502faf4e70e9cf3aea0669c51c01296019a6a163cd3b617331e527c1c87d7c186a9c8a5d84570019a36794a7276d82f5e7ca0
SSDEEP 24576:Rfwv/k9RX6wkyAIJnQ/tbw/2Mkjy6Fr7g0ob:AMnYIJQ/lFTjN4
TLSH
T13885DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 787cae3db095c2e33351caea85ea1778c5a933c5e007d2bb87c1e8aa93b56923
MD5 c37d1f1c48754b62b2c2cba1e08018c5
SHA1 31936c3b4afef8dbc9a3d6bb065479400f2e8ff8
SHA512 dc2cfa94719f8478f09a450a3b57a3f334eaba901e5fbca00bcf3db1fedbc4a0dab2c0fab6cc28b293f1b80c542ab40b76f316734839cbe87bde3c8ee2b8b700
SSDEEP 49152:sYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02Q/lFTjN4:SySzPJLm
TLSH
T14F066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0b49eb968e93e7b8d11bb4befceaea96f06edb3906a6b77b71f002e73947bda2
MD5 e35cf6f6b8060c6ce96adabf705c9462
SHA1 8a4815f428d37b692adcbc00fe4e7b8104ad91f3
SHA512 70864b9b948c0364824b870e60802aef99b2aba2eb3c1f10a01428c5e5146391b9acc7d73dbf66ea153567a81fcd5cfad21e6fe179656cfad3793684ebfe3878
SSDEEP 24576:F47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYsnQ/tbw/2Mkjy6Fr7g0o4:F47JUQj1irIhCnDHUPfF/GQ/lFTjN4
TLSH
T17365AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 3800917ec6963e7cc81f6a433b4200aede0f61f71f99db0794488e7de772591d
MD5 86187f31129d65a06d1fc1cc77c821e9
SHA1 2bca40722c833dc80e347168dbce204e01b2dbe6
SHA512 cdf93482e6eafb5d6c657f82007c7191c1ba3b017ea019050eb61b1b634a522938abec3b0f4b5fb0dbab7b5c25dcc0e45ae2ecc3c329b0ba6b76487622ad4f41
SSDEEP 12288:OssfNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:4tnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1FA65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 29fdd8863fe71dd437ade604871cf7eaa39ac091e5fdd81edb75546a4b53b41b
MD5 a2bc1b1868b5fa509af2400e1b252040
SHA1 842778a46dddc6e1e44a12109c05f04c319a1a92
SHA512 229ed7d9209b39d09db3a59572072faaad930c73499f89967775878fa616c44e222d8cee075f32142b0eff5f2c895de3e37ddd54df09957005f49cd7ac56b697
SSDEEP 12288:T3dRmU3fGzGrlq9G/1LfCBOhQAajiyvcm3TUMd:TtYUPxrlttzCBO+AajFvcmDU
TLSH
T190251850B66BD75FC6A940321E37D2CCAB707C05EE459B0372C8473FC576668BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 5e0483aa6b84ee95f5bb711e80d26eb118756855638ca5e9492d9d4e8b6e2af0
MD5 79440302fb07ea8774a5917b9bedeb4f
SHA1 92d27a09dfd2dde8995c757609710e86783cd4ba
SHA512 5e2d9c3fdc170361613b29a132ff96320d25297cfc264c71a9731963925fd86a38f795c4be55b9be9ae4a9ee7b8f785c874831d1595659245a6595311cc0f10c
SSDEEP 6144:ZN57d8yoqk7kBvUZMIt8n6UMytMxaB8VCmhzNOzpt1q1IMpS5Tn+M8cjuJMytMxS:Zjk7kk6ONkqc2v
TLSH
T19565F8815537E3CFD1FB2031472A6B4DB7A4ED07B7456F22B3884539D82AB65A0B83C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e372454f2d8e1ead748d1845bc1422f426702209f790b5937209ddc7d9c4336a
MD5 de1bb2bdcad148cce282428fc233a59f
SHA1 1a7b5494ff4dc29bff4e3aad63d08ff04c65bb34
SHA512 dea6caf7097c797056e947db0afb66511541d0cf56f1f1b552096c698fc5a02e210d1c51e5d3c32356eda8e5c1a103bee956f3c62bd9cb6dd823e589c1e44e58
SSDEEP 12288:6671GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:dVnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1FA5523756668F94BFA3B06B058828111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 480538340559ace0c93cfadf3ea2739c2e0e2a360c0bb5679380bfe238518d8c
MD5 b8d3c80c00789f55f47df4105c280f16
SHA1 862fa22ee3473b11c56c81e76a3dd257f6711d62
SHA512 21584a1a878a0e328647eb47ab889c44a707c03ac77d21a201514708636fd6f685ee881997e69293fbb3a43493cad672242eeb0fc993c107d8e9c425fbbc5f75
SSDEEP 24576:Egb6bmBIi49WNNFpg1rSvFv7bYznQ/tbw/2Mkjy6Fr7g0o7:Egb4mBIBhGFsQ/lFTjN4
TLSH
T17B65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 2f1f4fdfe001a80cefa61230f7f5d27e6f4839ad71bdbaa8b2adf3c34047d45d
MD5 5d089de65b46aa5ef6fc6d52cede8576
SHA1 23e2a392b2f759c9b83d424682af4f550e31f39c
SHA512 fa8558be765fdc3002d47ef14e9fd85e9bf53df3b2489936d4261cec0776e3efb08c0439f8214a0c4cc01364782eddad5d85016744599daa7d7e38536f7e024e
SSDEEP 24576:WG88u8FpJqH1Qzria7/mcnQ/tbw/2Mkjy6Fr7g0o+:97ZFPqVva7/7Q/lFTjN4
TLSH
T1FE85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2e242001657cd30a8315103150c40440a30e9d0c45b2cf7bdd951ff731146b1a
MD5 2aba37a107d76ac50b2a7abfb795b0ee
SHA1 4ef99a1c6c01dc75dbca84db1bdcc42de9973fcb
SHA512 490873ab345b0c8c5c418d9beb884c91fdeda796c4cec1ef9f57d23d494065cacf14ed1e5c28f121fb7bbba151c8d73b2239b067f4f5d29e4f169e4ff34dcea1
SSDEEP 49152:XBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjQQ/lFTjN4:IG05lO43b2Lm
TLSH
T101D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 af9390d304ae0faaa9a2f3048461f55d6fa04dcc910722a1b1ae3abefcdecfbf
MD5 cabf0d76b3509e51c649bc84cbf16056
SHA1 db9b76cbf218ba2df01d66706608edbca5baa97e
SHA512 3cdf86fe145685ea6a44383f17a7bfef12b2d45c3e0531f73e1d788566c0b1b23350d68966b0f1c73045b54fe615d3071495b7605ca598cd7cd7897a860aab75
SSDEEP 24576:Jfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn2nQ/tbw/2Mkjy6Fr7g0oI:Za5POZ3+Jt2pasx2+moQ/lFTjN4
TLSH
T1C965AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 844fb850d07c73b886da85e92285eb0acdb76af17439e6ff1bfe35dd877cb2d2
MD5 4e5de4a771b39083ff8a1c5a27f72d4e
SHA1 59007d569906479487f1cba660f0eb39d9adb3a2
SHA512 ddb9887723c40935f5ee547a5c5077c8ca4e0b3095e22d3e07ad437e715317ed7b5a71427778cbd826528cee3e59ea15f45434823e0bbbc1a5b525d88f01dfe3
SSDEEP 24576:YNcwHdjbyQ4nLC18lb/EOjowL7FkUnQ/tbw/2Mkjy6Fr7g0oB:YNc/zEOVHFbQ/lFTjN4
TLSH
T1EF858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a65afb8ca4924f1de77436da162a1cc89eeb11b1a486677c323415d44577cbee
MD5 698f6e5daadf6e0c2f7b4a2eaca818f3
SHA1 7883b88e6b49e6625e62ea373147316590e50475
SHA512 bb61c5f37ff1b4ea66e92cf3bbab2da8e8bd4482befe15b0207c0af1b1c999665668c64083e847a0c8b2937c4b37b315e5e312ccd6d4766dd5e71d45c761aba7
SSDEEP 24576:88kNvNnaFeYhJNtmZBmynQ/tbw/2Mkjy6Fr7g0o2:88MwBtOmyQ/lFTjN4
TLSH
T12155AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 42df4278ff3e3c0cea3d457fda19335324ffa53ccd9517f9f3f5ff7d54f4c63c
MD5 a4bbf95578e33bc91a33d6f5d7b4c431
SHA1 939dd418a9e1ed7cd0f6c197711dc64a3e265c1a
SHA512 a42213d15c8f7dd3daa0842394692c795ff828ee5b0fc193445e12a725f3747bf81b680f45c06b288d28eb534f86be0a198168745e756425a7b298b25de3abf4
SSDEEP 12288:MHvUrBFrEjwaQAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:MPUr+NQgnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T17265E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 f02cd8e45a992aae2f1812c44e9bbacf36164dafa6d41b91bc8232824eb31cb5
MD5 55b40327714b7ba685e79df3a807a82a
SHA1 ce80c81d8f3299bef5244205e12385a3299183ec
SHA512 d9a386fd39f99a6f5d561764310f41bce4a1c0c3cf77ca060742b1f05069f1ddd97a5916c56cd4e0d7b2ef7f59b008e25ea0449bf4a315884591f83ad7906196
SSDEEP 24576:oD3FHshBIYQgAhnQ/tbw/2Mkjy6Fr7g0o9:oDVHeBIAAhQ/lFTjN4
TLSH
T1CA75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/988-0-0x0000000000400000-0x000000000056E000-memory.dmp

Download

memory/988-8-0x00000000022F0000-0x0000000002356000-memory.dmp

Download

memory/988-1-0x00000000022F0000-0x0000000002356000-memory.dmp

Download

memory/988-7-0x00000000022F0000-0x0000000002356000-memory.dmp

Download

memory/988-85-0x0000000000400000-0x000000000056E000-memory.dmp

Download

memory/1476-22-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1476-98-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1476-20-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1476-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1476-13-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1512-59-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/1512-250-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1512-52-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1512-53-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/2056-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2056-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2056-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2056-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2056-113-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2084-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2084-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2084-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2084-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2160-326-0x000001FFF8430000-0x000001FFF8678000-memory.dmp

Download

memory/2556-304-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2556-81-0x0000000000750000-0x00000000007B6000-memory.dmp

Download

memory/2556-76-0x0000000000750000-0x00000000007B6000-memory.dmp

Download

memory/2556-75-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2780-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2780-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2780-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2780-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2780-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3540-137-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3540-126-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3540-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3540-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3540-132-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4352-311-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4352-114-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4352-120-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4352-111-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4380-100-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4380-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4380-312-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4380-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4380-106-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4380-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5008-71-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5008-65-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5008-63-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5008-279-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5076-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5076-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5076-87-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5076-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5076-93-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5076-327-0x0000000000720000-0x0000000000780000-memory.dmp

Download