5b3a9b49c78189ca6988afe6284da5dcef1572d001ebd662e7b95ccc618fd7cb

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_5830d9fd85a6fbbc8cd7465810f1dffa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Size 1.5MB
Sample260907-dge1wsxemb
SHA256 5b3a9b49c78189ca6988afe6284da5dcef1572d001ebd662e7b95ccc618fd7cb
MD5 5830d9fd85a6fbbc8cd7465810f1dffa
SHA1 9a5ae35565527bf8d7b1f50b7b4e7b7b58980735
SHA512 25ad6fda6e2e961e77f67a9b40b9559bbff950131d5d140b96cc155a7e33a8859c0f8d294f29cffde8946457131edbeba840afdf3ce947e5f8a5418bfa6bfd8f
SSDEEP 24576:/DDhRYL+krTq+NNLwexaR8cKR5CkJJFJ3ShcD:7DhRfeTq+NNLwex+8ck5Ckb3SyD
TLSH
T12375E02532C0C072D46728324666C3F25F3B78B1576AA98FBBC54B780F35BE1EA25359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
608	elevation_service.exe
1992	elevation_service.exe
4064	maintenanceservice.exe
6004	OSE.EXE
5596	PerceptionSimulationService.exe
1880	perfhost.exe
1100	ReFsDedupSvc.exe
2316	SensorDataService.exe
2256	ssh-agent.exe
5968	AgentService.exe
3712	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-06_5830d9fd85a6fbbc8cd7465810f1dffa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-06_5830d9fd85a6fbbc8cd7465810f1dffa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-06_5830d9fd85a6fbbc8cd7465810f1dffa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-06_5830d9fd85a6fbbc8cd7465810f1dffa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e03e6a3e238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-06_5830d9fd85a6fbbc8cd7465810f1dffa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-06_5830d9fd85a6fbbc8cd7465810f1dffa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_5830d9fd85a6fbbc8cd7465810f1dffa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003def0dcd743edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dccdffcd743edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006dede3cd743edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000de557811753edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e66c5cd743edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8df0d11753edd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
608	elevation_service.exe
608	elevation_service.exe
608	elevation_service.exe
608	elevation_service.exe
608	elevation_service.exe
608	elevation_service.exe
608	elevation_service.exe
1992	elevation_service.exe
1992	elevation_service.exe
1992	elevation_service.exe
1992	elevation_service.exe
1992	elevation_service.exe
1992	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4116	2026-09-06_5830d9fd85a6fbbc8cd7465810f1dffa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Token: SeTakeOwnershipPrivilege	608	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5968	AgentService.exe
Token: SeBackupPrivilege	1100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1100	ReFsDedupSvc.exe
Token: 33	3712	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3712	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3712	SearchIndexer.exe
Token: SeBackupPrivilege	1100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1100	ReFsDedupSvc.exe
Token: SeDebugPrivilege	608	elevation_service.exe
Token: SeDebugPrivilege	1992	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 6012	3712	SearchIndexer.exe	101
PID 3712 wrote to memory of 3556	3712	SearchIndexer.exe	102
PID 3712 wrote to memory of 4588	3712	SearchIndexer.exe	103
PID 3712 wrote to memory of 2752	3712	SearchIndexer.exe	104
PID 3712 wrote to memory of 4920	3712	SearchIndexer.exe	108
PID 3712 wrote to memory of 3936	3712	SearchIndexer.exe	109
PID 3712 wrote to memory of 4724	3712	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-06_5830d9fd85a6fbbc8cd7465810f1dffa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_5830d9fd85a6fbbc8cd7465810f1dffa_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1992

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4064

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6004

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5596

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1880

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1100

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2316

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2256

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5968

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6012
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3556
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4588
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2752
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4920
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3936
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e14967e016ff6007b9017f7111a3b66c61e5f419eee98b462432bbb36443a51f
MD5 ee57c1609cbe17e1df8ed00838b9abc6
SHA1 b689510bdfb4f55ac6a4d0c5e387f802f8fe5bc6
SHA512 2766a291f6d1763a68baeba7bbfeb02092b51c72376e9688a6d7b8a15299133891f61ff05c8409ee52b02ee996a96ca4c4ba840e70b58b44d860d13f474ee9a7
SSDEEP 49152:Kb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnjNLwex+8ck5Ckb3SyD:83q6sjBQNEex+u5Ck9
TLSH
T141D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 6257170a93baeaa9b83e2385df7d2356c2f6ae2df8417d4494911ae293f3d5da
MD5 d1a1a9e1cd86113f07a523cfdfbf66df
SHA1 ea97b104c65ebbee497f6aca657720dcb372099f
SHA512 14a813eff77c86441f74d1d6c69efdc801ba3483b600c39d0ad78d49fb4210afc580613d09322886571ff494d56f5b1be73ea3f8c89154c8d0a19b26afe79ffd
SSDEEP 24576:DXYfDtczAgNLwexaR8cKR5CkJJFJ3ShcD:GtcJNLwex+8ck5Ckb3SyD
TLSH
T18965F12963D009F9ED678139C8A29512EB33BC9543A0E78B03E095355F737D49E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 ed9ad0496d4a9395e03cc1ebf61bc7630e2cfb790d21371bda0ce2d55266fdfe
MD5 d5195c4e2c46a73a22f0f50432ca1fb6
SHA1 dba7c71cb45c408433c30de0399d79bd5ac9dde1
SHA512 5b15781977d42fc54724263c1239734792916dfe89a74b696f14c805c130e5c4915496eb28054bf9c7a500a97269a8278ff2a06fe93450cdc1372510f59a019d
SSDEEP 24576:X0Le5ji0hmxxrMfNLwexaR8cKR5CkJJFJ3ShcD:XPji0Aj+NLwex+8ck5Ckb3SyD
TLSH
T17D859E16F6748331D073C0B9C5D2A69AEE72308657308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9ff81c65ce6a07721eae95fc091f9c25c7d1b7a94578b7067db3e683fe2fec56
MD5 b3a0b51b662e4fb823cd9807b37b0a1c
SHA1 5847a2b027e700bad9e8aaa24d09f7312fccad0e
SHA512 a959385d0939c9b42f0c49faeb46e9da3bc4c743589cb18aaab4433fb7fd42825e344907cc83015bdbab7750f0fd20496ee1b173082f282c3eb1438ad18492f5
SSDEEP 24576:6a7/ezSC6vUyD/aqgrvWn6q8wyuZNLwexaR8cKR5CkJJFJ3ShcD:t/ezSC6vUzPveHjyCNLwex+8ck5Ckb3J
TLSH
T180755B15F5788323D0B2D0BAC5D6BA9AFE723086573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 cc3096f2c30cfe568ac6ff336cca46169c4bb10cf80220955a35b8eb330c4715
MD5 fd51c681ca50f795642d09bc036213d0
SHA1 253e86c066b4ac10e766dbc8ec71294b91b9346f
SHA512 555047bbfdf71df85676e6bb7ad19b3964a6473f7bb2d3825098891e8abefe354aa1f2c03081889c59bc301f8595b6d0a748bbd9035446938efabbcb00086e56
SSDEEP 24576:yVbqPb88hv/l+YsNLwexaR8cKR5CkJJFJ3ShcD:yVO88hXl+RNLwex+8ck5Ckb3SyD
TLSH
T185559E66F5748331D073C0BAC4D3AA9AEE32344257318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f41b65ec9f34f5aeb9a8850435b7aebb691127d70cfb176f447528b4f2de44b8
MD5 8786ad1e4c92727ced1967e28f3bc21d
SHA1 8a95774432e3c4092e5a2e9b24af0310e063f638
SHA512 4c5a620137bb64c3db6c6fdac38baae028088f844dd8a5d3e4eb72b15a60ab1021d2f41610c1e62438f76a97e25a6fdeedc0247ab20eb17594103e7dabcb0c88
SSDEEP 12288:ILrktQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:ILrNLwexaR8cKR5CkJJFJ3ShcD
TLSH
T14E45238A86448906EF1A4933A4FB76373F17BCF491809F49818276359DFBFA0C5427B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 c1f858e773816b8b1c4e36192c2d4b7c1b15b559c706e4360332ee215d225e08
MD5 c7b89bf1a2c7520333c5748c4c4bf4f9
SHA1 74e7fce4ce4148f6697360d906eb835b6b498775
SHA512 1f32678b2fc0fef90f530e13be0e95db58931f6c642390b2b95515730d3de23dc7af14c2912f1f0ffb789162b11ae91b99753be21286b46757356a21a172656c
SSDEEP 12288:6eBNUbTVO86UUktQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:6JIUUNLwexaR8cKR5CkJJFJ3ShcD
TLSH
T15365DF3BEE28FCD2C67E8D795A918700A77278704B52A3CBD165830EDE235E05E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6ea38cee8e8329821bcef3bf10cd0602d72093560a08fe9657338bdf3c2f63ba
MD5 f6352b8de09d08bf3e18df297d4321c4
SHA1 54950b7f7488cc457dd29403a4e234480810825a
SHA512 6679c897152a6e2412054ee7923f009f9497b4b9154cf7ba893532ed40b0111885a676742854133987b5239e487e9a903cc5bc963a0f97c9eaa85ecfbf654fb5
SSDEEP 49152:9QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH4:9QvGAdlCEL8c/DRNw5CpNEex+u5Ck9
TLSH
T19C267D656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 4b750edf60f023275e1b2d583eb86a700ecd6f81738ada0aa44bc2ee3be434a1
MD5 18ce77cce6241d14d043a79412b81480
SHA1 4033114c07c74ae6a6df1554f3158158c17dace2
SHA512 2163707554f367b0a48caf37f0ad0ad4fc6dc253cdd31afcd3fa2994027d351fbda22733c3b060e04b9fb5e578a2cb68a174f1ad201653c70d307f202242ff1a
SSDEEP 12288:GAwSfxL/2Dc3RDLLmt0LDQewsAjOktQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k4:b0ewsAjONLwexaR8cKR5CkJJFJ3ShcD
TLSH
T18D75E031FE74D432C77B0DB21B36D716282DB9604B511AC3E3E88E9D59702D26376A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 cd4c9b6c3b01fd749e93091ea00690a88c136f5be65d4da5118276a20f8cbe9e
MD5 af18ae06b7dc39d755d7062eaecb9a9b
SHA1 4939231d17f9caa7414f4964bdd8af7bf57cd058
SHA512 a6a08003f633aed9306709f4139d462082afd9dcf584241df87357d0fba1403e2ed4ecddac6587342758611bc8df8f41ad743e52d6f8cc37174b43386cb6b8ef
SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHmNX+uf:eUEtQevvqc2W1cpV2tI32a
TLSH
T140474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 32528c6779fcbc892f1150dbcba635fe64b34d8d80d9d8191af7e5c4fadbfe97
MD5 0c08270b73b118b90e3108894ffef4e8
SHA1 0e36c216ad918e9f09701cf2d97008de31d47600
SHA512 6bddaa6b986d965865fa430c54b7182db0edb306d77ac78c2ded657211db6bd5d7274ccbfb013d8cd6b3a589ef749bb16aa3698933ff751fd34febae496e8b76
SSDEEP 49152:DCbRquA/m2yL5zLfFiV+XenmE3/zuNLwex+8ck5Ckb3SyD:8oq2VjnmdNEex+u5Ck9
TLSH
T16CD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 813ae3df531f6a93f85498ebededc8b0d207d3b957f7fe8db8384167c3b46d95
MD5 52f24cb7dbdf2c75cfacdeae9f0b1dbc
SHA1 ccde239d2aba67027345e1eb1195a5cefa6615e1
SHA512 93c297a2198bf03ef24e85ccc0cce363ba604981d01290d438e510ba7163f1e8503585967456e9a7c0070f7c7c570f7ca5794351f7d561e478e56475d77ee413
SSDEEP 24576:wAhGL3IFoiwtA5l7S539NLwexaR8cKR5CkJJFJ3ShcD:wAMUFoiq5tNLwex+8ck5Ckb3SyD
TLSH
T147359D81EBF945D4F5B3AA7899B69171EA76BCA95E30C20F2150D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 95ef1017eaff198a0ce2f45f3eb30ec0d042bcd4151cd1182d5fc21ed13683e8
MD5 70424b879ea25378fbe9d4eddba60d89
SHA1 a2ed2b2dc7f5db5f1d1b16f0f98e6f86487338c8
SHA512 05ecb9795319591998d1301510c7930fec6154081ce8e7dcb529c69654d6a6f93b390f56fee791a449b871ca3ca409fbf8504583b36ec9d500cb55f8c86092ba
SSDEEP 12288:+mw5HEjsChNVBFgl0WDm+C5ktQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:Xwu4OWiNLwexaR8cKR5CkJJFJ3ShcD
TLSH
T10165F14A76A40CF9E9678639C597D136F7B3BC112621DB0F0360C62B6F77361AD1AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 73c727f206a94d309e83fcdf2ee7b49c7ed9a1767c69be2bd4ef5dff84799755
MD5 9c1a856558d1c007188aebf01c0912cc
SHA1 836c9e245707248b06b6271f0b95258cf3ebf887
SHA512 b009bf45c47221d1da880ce7107b2b68e5b4376a78b0d613268f77bc61357c50095e2d2a8741971d6e64e9d813371748abeadcd00c819937e1e39d45487ab425
SSDEEP 12288:feZ1IyektQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:GZuHNLwexaR8cKR5CkJJFJ3ShcD
TLSH
T1C155128A239450FAE6574639C8F66616AB337CA2637283CF025152366FB3FD18D36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9c38eeb07879f3296c627e70002e3362b0713d9e10b5e9eab437cf7d2f48d386
MD5 83eb8187ea6c5095afea6542e05d3e7b
SHA1 0fbe7f5a79e892478bd73cd5669c19ba4da37314
SHA512 fa53f3253f0f5feda25ba41ccbae8e4f9129e60a1c98af42aa5be2f59ec5a5e66c6a26b871c69d3802d2da75237ffe252ce6398f75834529fcfe7602721bc71c
SSDEEP 98304:NQRQyi36YOcPbLvw2gAf+PN3oNEex+u5Ck9:kQyiKa/X+PNYNX+uf
TLSH
T135667C43F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f4fdf99c232308b8729dbee86e30ec47eb1d785fa97341e9394df0731f5d76d5
MD5 16009e53d0b074526fb11a5584db733c
SHA1 0d3b1b6758fca8980dd82c9fd0a3e3b774eb7dc9
SHA512 6b3319f35fcdec940600cbbf69c3805cedafce2838487a18f3d0c91855cfa8f808adc94e1b0daea855042ecb3c5ba2bc2dbf28293862b4de384b258938713a4c
SSDEEP 98304:RQRQyi36YOcPbLvw2gAf+PN3oNEex+u5Ck9:IQyiKa/X+PNYNX+uf
TLSH
T129667C43F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1e94050a4249d05cc847024d987818a6b5f8a8bc78e9bfdca6bf799f65bc6f90
MD5 58d8078ef3ac8b1116485154e4cbb6d0
SHA1 50017ae1d4f73fd43e396c4ea3d753b2e1c23fb4
SHA512 16138c8dd63681fd35b0ca2c36c8393c83558bc0e61873e10edde1b55860a7a88695249f453140ab818d4f1f540ff2ad1485c891f2563f48532b895ef4d33a0b
SSDEEP 49152:168Qg55nhceWu7PNU3/+NLwex+8ck5Ckb3SyD:DthLRc/+NEex+u5Ck9
TLSH
T116B54933B2F600A9C44DE1769F4A973196D27C758FE0E3DB850172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d14f167a0468123c4451a3a5fa36e0fce5eaaa0be5d83791fba73bb8ca80ece4
MD5 65d99983d2f7b85fb6ac629441155320
SHA1 96a8dcfc4e4a979279d8e31c0fc840fcf39812d9
SHA512 26451118b86abb573d5e29db6c462aa7cd461e3c5cfdd00b7dbab1976135c036e801007b31bde3f6bc279370371edc32e578f9b045e8427a97230ceacbf2312a
SSDEEP 98304:Vy5112gYy5azzVvt69nLKnhZrNEex+u5Ck9:4LIHEWh1NX+uf
TLSH
T1DD167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0dffcd496522929942e7cf9e3f44453495a92ea6dec5830c78cb5016e6960a85
MD5 079342f14d590a175499381501b3a7a8
SHA1 298e9db414d37c1a23afd8b700496c230e2673a9
SHA512 7b7b04fed46a3b0421e589ada4705b731e81e74cfe2f090ca1d4220d503359bd33bc1f4bf7ba4bed5ff3a129ad92d0795dc01687fa6e2e75a7298e7f10c15450
SSDEEP 49152:iB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl8NLwex+8ck5Ckb3SyD:Qu6Jmdxd2d8NEex+u5Ck9
TLSH
T138D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bdd6d78b0174d72e481248086e62c3a60c68525847ecf9b9ce0fa128e160d1b7
MD5 054e5d2fe813be9aeb1c93fc6ab744ac
SHA1 6505188d07a8c83180a8984c21973ed8da3360ba
SHA512 0fac08a47f1d793872b41a45ebb0cb79d49de0e08fb61869f0f80736455e5b02e6dda6965b5d0915746b534f2647d7c2386b1d2f0b39ac6cc50a27853809fc64
SSDEEP 49152:C1hpsNoJpF1A63U44CwH7R4x0NLwex+8ck5Ckb3SyD:CmifPWRdNEex+u5Ck9
TLSH
T157B5AE13F29901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c6b5209c499b0785b72198d7d01e016857730333b51fec7256833c61c9a4c353
MD5 ae66271c1b1d710f9a959bd9f4f0b76e
SHA1 b52efe133995f4057251fa21a3db48c9cd5a2e00
SHA512 fa0c23d7d62e7700ca4ec4f6dbb22dcf47d6542cd2eeadc1560e39d1d2e76cd65962c8c68320f7a18116bb9e1e4448a9a461f7af533de03f4026d58309190da1
SSDEEP 49152:XSuZQIY0Be2KcRVtOnks6NMHqHNLwex+8ck5Ckb3SyD:N5dKii61HNEex+u5Ck9
TLSH
T16CC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0699ce3635c5430b52831235a8a3c768645fcbc20e45f5f929c028186589e6ad
MD5 59ea8d0a9f93e8c4ad86bc39753a90a1
SHA1 cf4271f10ffde4257865c2e2b0772380cb0bbe76
SHA512 8e91e2c784bf721d1c6d300c1ae431f27824a7bef1c5cdd25527de8d08d1707504dc8120296a97748b225ae1d8a8ef4ad07f91a05826760149b256919ea26395
SSDEEP 49152:UhtSn8EApI0fig3giDn0AP5wgNLwex+8ck5Ckb3SyD:1X2imphhNEex+u5Ck9
TLSH
T15C95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c05db25af180d763b0cab23ee819ec3d2ded63b567e9e220c26609b1f6e32a1f
MD5 626f83f1df5f844794bdc8c986b1e7bb
SHA1 00a9737b474c9c862ee68f26911879125de5a462
SHA512 537b217c7683fff76fe474f4ed77cb92b120121dd881a989d427b70ab8da476fc0d060d4a9c42fdaefb007ac1463ae33a9328620ea878358173c93467fcdf29f
SSDEEP 12288:lzktQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:lzNLwexaR8cKR5CkJJFJ3ShcD
TLSH
T14345234A85458A06DE054933D4AB76773F0B7CF9B281974992827131AEFBFA0C542BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e2716d8f5b5747e615830d110dc9bbfb013546d2132e6cba52bfff1a9727fdac
MD5 21cd97b626532525e2da735c8ef63430
SHA1 c03d5b284851f92381fe12603b95c8a98c44d15a
SHA512 fa7c68b6e6250566cd578a482b973d9e6aea80fa81bde1d9215d8ce3e4586c60205b9496145273a9f102f6c2e426008f1cfe20464965c7110e55a1c0e4ab23f3
SSDEEP 12288:HaktQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:HaNLwexaR8cKR5CkJJFJ3ShcD
TLSH
T15145234A85458E07DE05493394AB76763F0B7CF9B281974992827131AEFBFA0C542BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 decc13a0261abc8df90f824154ca6bebdca740546d07c90f2bb091aa8fd3b439
MD5 e9e589384ead0db26ae20148b9a42f8b
SHA1 f89ac27ab41e3f12a33b7d70a8eae528d58d2e83
SHA512 4304ea25ba429be4c0ce30d4ae463b96814257db2c6d0c3e8ec344001ad335979182e47762ffea4f55a748db07bef831673b54c1f2713f90d2de8f94365234df
SSDEEP 12288:4cktQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:4cNLwexaR8cKR5CkJJFJ3ShcD
TLSH
T19645234A85458A06DE05493394AB73763F1B7CF9B2819B4992837131AEFBFA0C5427FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 f181eb17a621b04731883b81783b7f0aaa553ec13828b56c248d27cb2eda9998
MD5 30adaf9216b8573eb5578d93a5f23010
SHA1 9f856996ecb9cdeb1d01d071ecd7d827f6c25096
SHA512 861ceba3cc5db5e0461bd92de7fa3c7d403d4ce8cd72f382578962cdf07f50d45ea071485206db462dce36fb85498aa487c30539dd85e800ba5e00b7c3f38e29
SSDEEP 12288:CVdktQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:yNLwexaR8cKR5CkJJFJ3ShcD
TLSH
T10C45234A56458986DD168632C4B77236BB27BCF4A3519B8F824225355EF3FE0C901BB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d82e1e594f14161455f5b2227e27180f859f8240c7914652528cefa7711cf30d
MD5 005df7ab99b32e06a08146fd3b8533d2
SHA1 c4e1c5eb7e7d242829da2b21cbc2ed2c1e601a75
SHA512 ab51ec42fccfc32b10365f2a084151577ac0cf31176781820e5a5157ab93d89bf471571a254f6af3d60e60ca936b6e2d7695c0030601fe6b3afe98c6aa660589
SSDEEP 12288:bVktQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:bVNLwexaR8cKR5CkJJFJ3ShcD
TLSH
T14A45234A85458A06DE05493394AB73763F1B7CF9B281974992837131AEFBFA0C542BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 76825ab7cd65b57ac9b239288c24212453897e8379bee78565cb23823a5393ad
MD5 4130e6d78bc9683fd3f509a4b56c4c6c
SHA1 0f601c9271e0d1daaeef746c42dfe5db5a2cf2f5
SHA512 64ef75566d9c7a63bf9dfebb756570c6f0988b9e619d16d362b6d535f3f9639e531514fe13264fb01bee519ade7f8ab1251769b8d8c9af6815245951080c8dcf
SSDEEP 12288:p2ktQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:p2NLwexaR8cKR5CkJJFJ3ShcD
TLSH
T18B45234A85458A07DE05493394AB76773F0B7CF9B281974992827131AEFBFA0C542BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 3d0b4ded22e79efc020e7af6edd2e0178d07f4995af4095819ccc246c3bb9aa6
MD5 3eab1f386f94ce6b9a6b74728c6112e5
SHA1 0a22cd9548817e9d14746709877d13a97141e933
SHA512 3aec3d28910cd33f7b8d3378fa4283bb32d1cf7355e4c3240b0ae423747b271a1233b3a763b62cd168a811c4f42921445e9dc1af848aabc9c647a7500bd4fff4
SSDEEP 12288:uSktQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:uSNLwexaR8cKR5CkJJFJ3ShcD
TLSH
T1F445234A85458A07DE05493394AB76363F1B7CF9B281974D92836131AEFBFA0C542BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 d7c3007c3c8642b8014211bf5828d0080fd16ab525adfad53c0dad9fbcc55f93
MD5 e889f7f7134e19e4c5a1b25cbc673ce9
SHA1 2c9c3120cebe17bd8c3b4dcf044efb5c9b0a9fba
SHA512 5df1b2d18e433234f452f83328978fd356746ee4d3108dea57f46ca56e3cfc748b613b91b2953a12c24082f2926307b06088dccbe072fd6fc05958a814608473
SSDEEP 24576:BZMRzFVSO6NLwexaR8cKR5CkJJFJ3ShcD:BZMRzfGNLwex+8ck5Ckb3SyD
TLSH
T1D3650195B3500CF9EC67813EC8669916E6B27C690760C60F03E436375F737A14C2EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 df36392af9c61f4866321722128cb68277b598234ff4831f24151f1b3c169d0b
MD5 04f4313fff9c0c8227bb917e43c5b152
SHA1 10bf1fd8a3d1f9669fb27da01ef745db562facf6
SHA512 6ed63a190299ac2e273fc54af8ae2214605c187b99c5a11c901b5b881dde13b03f795dbc9357cab3217fef6a0c39636135868f42ce365fcfa8adfa1e373feb48
SSDEEP 12288:2XktQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:2XNLwexaR8cKR5CkJJFJ3ShcD
TLSH
T13B45238A85458906DE05493394AB77763F0B7CF9B2819B4992837131AEFBFA0C5427FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0f5891e046d46fca746877c94f96f6cb99e9b10576dfce36d2975b76fcd1ca48
MD5 b60792318e4d5a54f4c077642e036069
SHA1 2bb2c6839d565ea457bd2610839df69a738c94b9
SHA512 de75d9baac203f8df630e3060c300687d5899350d959a0237cefe40675ca486acbce02e2eb1b4619efbda51f9c18b7e5aedd13abe524a11743b516e0abc77d30
SSDEEP 12288:x7ktQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:x7NLwexaR8cKR5CkJJFJ3ShcD
TLSH
T1E145234A85458A06DE05493394AB76763F0B7CF9B281974992837131AEFBFA0C542BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c4d8b469016ec19a73c724f19d9605f7b3dad115f63ca95e8665a75f2bb62610
MD5 00a2158506294f149be8a583c9364f7e
SHA1 db3200f540a1a8d3cda9d75f28f9e7bbf7cde336
SHA512 c85248183b8c6914b75d684594e95a99c9e42b78663c9d5b3aa2bfad4fef1174de2d6ad884e49b41f9d13cb50bf35d7fe920bc1390bf8a3968e6310eb2cea527
SSDEEP 12288:4yPz5L8ektQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:ZzyeNLwexaR8cKR5CkJJFJ3ShcD
TLSH
T14B55124B639120F9D5278235C8A62A12F736BC7553608F9F539017362F77BE09E2AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ccbe2610f2f56451c194dedc53397d4cf2ec98bfaf92b61c47c240be3b5d9682
MD5 e110034d1374b89c623a23ea20cd7f5d
SHA1 a19391eabbdc50519911f0a781f0da79ba0cbbd8
SHA512 f8e98393a43bee91e197189103878ee6ab9146fbc27375b35c4d6cba2c909f454609e7fc1c1cef232119f4dcc810f57a25c7e0c0dda74f9c4c335fe62bd3928d
SSDEEP 12288:uXktQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:uXNLwexaR8cKR5CkJJFJ3ShcD
TLSH
T18B45238A85458906DE05493294AB77763F0B7CF9B2819B4992837131AEFBFA0C5427FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 a21634558dee3f1adbd87b8c7e5e832a05406e73b46b455166e0b63d4316523f
MD5 b46e7152853e1c4c827c49157d922567
SHA1 f598e86c21bfa781c8e09ae47594badb68bc4995
SHA512 de69ffd10177d2b5c04fb20f3a9cdc631cafe2b835abe4d23a7290e47b17e570006c0d9a5a8523212cd6c1d0b33666e0515f243b3c8c07bfada8212bf7f8ce69
SSDEEP 12288:fXktQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:fXNLwexaR8cKR5CkJJFJ3ShcD
TLSH
T13245238A85458906DE05493394AB77763F0B7CF9B2819B4992837131AEFBFA0C5427FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 e35c6595dc23d1b0828516f1ac617baa26325582538d18c2d97716878dc85e81
MD5 7caad9b69802214d78eb0d837241891a
SHA1 2add6f2180ae4fdd7192de18382e341326bd2518
SHA512 e2558522da22c29c12d6d40d3a0889d48c0bc7f73ac87366b17c74f90491b1978af96376875d4f684ed5fd4527898995ddc29ce03de287f21735384eeaade42f
SSDEEP 12288:oyPz5L8ektQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:pzyeNLwexaR8cKR5CkJJFJ3ShcD
TLSH
T1E355124B639120F9D5278235C8A22A12F776BC7553608F9F539017362F77BE09E2AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 65e70123eb84d214cf2821f50513aae5ec799b6348828ae9cd622a1674b0b1af
MD5 58c716be896bdeff357cadc74ab11e7f
SHA1 21ca2c1006f0c77c0bb33476cbeec32f6d96d045
SHA512 56b225706876286640d7a106dbdd31ee45dd8d1300ea493ebc9d081c634d2bf069d28e5a34b7596f4f21d50a9ba8c11d3b34c711c263e79dc2288bfeac725e43
SSDEEP 24576:JTDaLl3z0zDMNLwexaR8cKR5CkJJFJ3ShcD:JTuLljZNLwex+8ck5Ckb3SyD
TLSH
T102650199B3504CF8ED67813EC8669916D6B37C6A0360C60F03E436275F737A05C2EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 aa60061be750e7bf7dccca4b4e29dab7cccb35810c7934c47b5753ea5c63a73e
MD5 65e3fbc32d5f574a1cfdecb2a311adf2
SHA1 bb7c7a152f55ca537cd492e31745dd2197003db6
SHA512 fe0decd76ba247d46bafeb1db72706286ac7525c41c390d467942951e8f5ccdcabc4b7d7a4e7d743e14af8140bc11b634f12367be9667d1c1a583c1fbd5324e6
SSDEEP 24576:p3vd9CHKy7GZINLwexaR8cKR5CkJJFJ3ShcD:5vd9CHKyaGNLwex+8ck5Ckb3SyD
TLSH
T14375CF90F3E414E8F1779A3588765512DA767CA91B21DE8F03A4262A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 8ec8d671399f730a13cad18ca790424f0a5c7ccc184e2c52ad0d91a47db4be93
MD5 3298887cf081dd74d74a8db3cb5a505f
SHA1 ce331749a4979882861e56b5df19d5339911b85c
SHA512 ccb953c15f2b53b0a84791e9bb8d7447ae55a9ad1b55a4483e37a879ba339cc00afe0175a145628e06cc3a428f40685ed3522689088bb5b79307db14fbea5551
SSDEEP 12288:l8ktQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:l8NLwexaR8cKR5CkJJFJ3ShcD
TLSH
T1D745234A85458A06DE05493394AB73763F1B7CF9B2819B4992837131AEFBFA0C5427FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 48b6a07cef36f524630760b028694d278418bf317bd7f985f126dc8f118a0397
MD5 18cb5fbe5c6eb9858cb3adbf53ea6224
SHA1 2ed2f7241facfd5131fac3a68a78596a6b6f15a2
SHA512 db9504330386f1795f3181e49e5db423a36a69be31f4b3209cc3ae47ad56a7dc108d9282de9ab3d3d95ab98ee3a9d6d7931c7549cefd20366cfcd4a6ce7cb519
SSDEEP 12288:U+ktQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:U+NLwexaR8cKR5CkJJFJ3ShcD
TLSH
T1DC45234A85458A47EE05493394AB77763F0B7CF8A2819B49928371319EFBFA0C5427FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 9a596603f11c70f523583253d78b9c4ccd9cba5ed1abaaf77d7c35fbf3003e4b
MD5 06f73d30c1985d335a556237d89276e2
SHA1 2cbb62295204b207547a7883f7b060d0dbf55a2d
SHA512 403b37324d93a2bc9f594b7cc437a0e3e297f65d6de50646106c803c75f2093e3b791f44f35f4b2aca332ef2c329563348ac115e877a1f60b6a216f8e537e6ca
SSDEEP 12288:AxktQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:AxNLwexaR8cKR5CkJJFJ3ShcD
TLSH
T10745238A85458A06DE05493394AB77763F0B7CF9B281974992837131AEFBFA0C5427FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 52cae18785d8b559048250c0844a1175dd3a98e205fa1c89f4fef5b169b4774b
MD5 8a2bf7146dfd6718d37ca1335bf57660
SHA1 3200663578f011d9d8e73f39ce0b6e22a9befb1a
SHA512 138f52998f3914f3bd7678cf03a254df147ac6f8ab8e1bbc0c68190ded3f440a47644343e6d6b65ee9e09e2fceabc5e3fcef600d56f2b9a208360f500b65e5ab
SSDEEP 12288:tXktQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:tXNLwexaR8cKR5CkJJFJ3ShcD
TLSH
T10C45238A85458A06DE05493394AB77763F0B7CF9B281974992837131AEFBFA0C5427FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 33188a63a6334e451bf269c3532b2657aca367d087091657fc361490befb0c1f
MD5 44ff6990d1296441f0dab8b85b12ed21
SHA1 1b89e12ffd503538efa2afd23cc49f91d31a9ff8
SHA512 a09db01b4aa5da4c8504bc0d79bacf2a9a6b768938c0223eb27cfa73c3ee0367927b89231f583becd28825e8bba7385d6f7470cc3727d97ca858fd04095607f0
SSDEEP 12288:s8ktQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:s8NLwexaR8cKR5CkJJFJ3ShcD
TLSH
T1C245234A85458906DE05493394AB73763F1B7CF9B2819B4992837131AEFBFA0C542BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 0c7894f253ecaa076c9612e606232e1276ade38ff24be36845839b61743e9536
MD5 90484e33382775d1468ba0b65cdf0dc7
SHA1 45610f9604b8dfddd23c0797f8fe50c642f6e156
SHA512 eb05f75d98c74070ce946baa33e78a69f66da4bc7357b9c92d0185904dc03c0516039c89ff2764e87e7c4c26490839dec333788d5f99259d348cc05e73539b1a
SSDEEP 12288:BPktQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:BPNLwexaR8cKR5CkJJFJ3ShcD
TLSH
T1F145234A85458A06DE054933D4AB77363F1B7CF8B281974992837131AEFBFA1C542BBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 1518e089377227afcba21608011ed7a6b32e64f96cd70ed2d2e1ffe2d66f8376
MD5 d3af8f2c839046ae08d832676baa5f41
SHA1 0753c0d5f69333e22bd19e32ecfe93fb0124a81f
SHA512 4e4f974e212fed9142d1ff9bef6fa997ee4230f3cb5ee847f1cd12437e473e2110bb60bf5d1658306b072f60ae0f572221bd7c7501c00f3d0cd005c6ef5bac94
SSDEEP 12288:hVktQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:hVNLwexaR8cKR5CkJJFJ3ShcD
TLSH
T16345234A85458A06DE05493394AB73763F1B7CF9B2819B4992837131AEFBFA0C5427FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 84e0bbca4b0650623287782fb72dd0411be29ea814350ccabb430966ab2c4980
MD5 3aa764c5ab58074312d403b3c8049688
SHA1 841b7d72e39a4ea7e356ba635ec2e78f685a69f2
SHA512 fcfd846685f68d3b1f3155a7654f83867a16cd2cffd7c016c0cb4ec00c42958b680a2a8d64d64f17018f3f5165cbfcac4bc32e4363f2c9d3f6441f0f187a5900
SSDEEP 24576:2fwvUk9RX6wkyAILNLwexaR8cKR5CkJJFJ3ShcD:+MnYILNLwex+8ck5Ckb3SyD
TLSH
T1EB85DF29EBDC44E5E177923C99B7460AF6B178681B31C6CF029A536D0E37ED09D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e5b16ea75561c74287daa6984c239d0a7b4cc26bcf82d03dca63db61f65810d2
MD5 5d0b58af54eac9decbd37e27b554ab46
SHA1 d729037aa0e61543b8e069dbaef997ca4c13091f
SHA512 e327d1123897e4dcdcd0bd38dab3b25d72b950f76b9a9499cc2c9862cf39e5d91aa3f0fe50053af8fb6d530d92e97e2ff1e71963b8d15b5d47716e0f806151b8
SSDEEP 49152:uYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ANLwex+8ck5Co:dySzPINEex+u5Ck9
TLSH
T1F9067C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 cb3ef17880bffec49b329644923a54babad5f6116b6f000dcd4a7e6c81137d14
MD5 e8cd08d6e5b28684de966711e447f8ba
SHA1 f5ad35306342f029135d1a509f61f3b4f8c49a1a
SHA512 e2d35d14f79b8ad92e98849d82baa033597c5a6b008247ca7b522d6783dc1816c42c36e50df5008628ecc761af41e7aeaf1d0c7ae67f8d95c764f299ceeff2b0
SSDEEP 24576:s47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYKNLwexaR8cKR5CkJJFJ3ShcD:s47JUQjTirIhCnDHUPfF/QNLwex+8ckf
TLSH
T19865AE1EA3EC01D5E1BA927885155A1AEA71782D1B31CACF1270837D6F63ED48F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 3289e8f849516cde1f1a0f3d7d86c97608bf83ad363c797eb7f6e3f189cad879
MD5 764a501b7f2b8ade67dd31090b6d66ea
SHA1 858d8c53bca132221c60cde591ecf0396213d764
SHA512 01b8c79463cc6765a2a871d0c6abc6f501abfb2e52575afb35514e5d1d236d357370c6e68cef379ee1b5daf776948a0915fbbe69cc0bd53387f8dee1ee5b0671
SSDEEP 12288:qbsfHktQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:BHNLwexaR8cKR5CkJJFJ3ShcD
TLSH
T12155014AC28842D9C42E6136C7566A11B7337C6493E1D3CB53C0F53E1FB6A909DEAB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 cf37f2bf28832124509a4ea8ff8509ff6dbbb3eb2b9176b9b05746c2de9fb6bf
MD5 e4f33af1f862af383ecbeabe03d67bf4
SHA1 7ee7cd2d5983f89b2dd537711a04d11f89d354c3
SHA512 1986b4896e2467be4063d3b40fb88cce671aca5c2ce2fd45db086068b076bda5e18457a522b34e02f4b96c8210735a9417a7340a179a2a29f48544cad050774a
SSDEEP 6144:NsBC2na2sMcqrERnfKDexHA4by5hP3ePTbI5pJRIuC4O+nGwI9pJ4I5E1YfeG0m0:6jo+Qy5VqTbJ4O+K4I56YfeG0mYCg
TLSH
T153351711766BD75FC5A940325E36D2CCAB707D02EE096B0772C8473FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 84f9ad4590cf89aadf2c0575b043775552610a7afbf4dc373a1e55f27ae577ca
MD5 188d3a3dea05e22a94fe9870ea4d1f2e
SHA1 52e25f3ded70f8efea5367119e6863dba8241584
SHA512 16cc026d63b3510d557c5142445705ca4964af4512856118ece6317bc38b102a421b15d033099109238334404a186fd70a01428224bc1e58011480725006d738
SSDEEP 6144:tH6Cb9by0TJRIGVRI3zYgqZsTqtymKDexH8zGFWmKDexH9lwajOwcNYPNoR1Bnj:nb9by0oPTvxUlkvJnj
TLSH
T1BC65F941A537A39FD1F76032072A5B4DEB74EC02B7096F2667C8053AD86A725A0FD3D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3049e93d8f50eefa58ab8692db899473873b0c0331017931d43a06d8b40b4fed
MD5 4e917f464080db773618ea258d3c3e61
SHA1 e6c426f379584311555d3f390efe07cce9cf9289
SHA512 f7a5469d657afac1e732d480e5e8823fe13a443f9870ca608d9ca0f8d77cab2fa1352317a040bc28f18aade29b5c04a9aaea263f146c9ba0741a432e91fcfa83
SSDEEP 12288:FF7/ktQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:z/NLwexaR8cKR5CkJJFJ3ShcD
TLSH
T16A45234A86448D06ED26593294AFB2363B1BBCB49340D6CB91427231ADF7FE0CD51BBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 34881b3347391a83686c080bdcfb54ba24f21dcb7ed97d8c940f3701c8f239df
MD5 6d3d9ffa5beb5abbddd8dfe121f4624a
SHA1 3ba7674d7460a12c7248666d0022d56a5ce6e928
SHA512 a6cd1a0d13e8f405b7842f16fb07e511b5c2e69cdd69cea12abbffdcc30c34146da4b4efd3a6f476dd0ede42808ef3798082ed7d4001664049d63139cfd92cd6
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYZNLwexaR8cKR5CkJJFJ3ShcD:Qgb4mBIBhGFKNLwex+8ck5Ckb3SyD
TLSH
T181659E1E22E802F5E1FAD2B8DDAA4417D6B278161331D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 9463cfdc3f7ed3cc7570eac06f1854404bfa422ead003f8886f3d9ee906606f7
MD5 6b666c51249749da25f9b5372af92108
SHA1 de5434a96339a166e57bc2fc7c921575a23dd000
SHA512 9e3bb15692ceb792640faabc4261df6ddfd848f959260d9ebbb46a2066c7c5fdfe55752e00ac62e0ae5c5ddac59a2f229913d3b2c68ffb27f08f937220849308
SSDEEP 24576:RG88u8FpJqH1bzria7/m6NLwexaR8cKR5CkJJFJ3ShcD:07ZFPqVea7/RNLwex+8ck5Ckb3SyD
TLSH
T15585F16566E101F1D47BD13889864663F6B2B8251360EFDF07A88B611F23BE14B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3266865e2ef7ce50d657cc802bc4bbe388a24e85ef78975f9e7faf98e0e95dcd
MD5 c11b8e5566b29222d7f6355434c47cdb
SHA1 4b2d4c3332c0f3decd78f1a37cd0b4bce2f7af39
SHA512 a30bff0615311d9a9da763197f57f70d3d0de2d0ba9e2581cedb01683fa13979d801f63a06e5cc2171054fbb22486c837e86a2bb1a38896c1475c5ed33130f18
SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj2NLwex+8ck5Ckb3Si:WG05lO43bDNEex+u5Ck9
TLSH
T133D5CF6E62EC01F9D1BBD17CD9C6460BEBB23825032556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1bc72e7298fbe11e624bad6900938fce4198812a69d87727d2753e5e616c2014
MD5 167babd76807fb738d20a0d51eeccd2c
SHA1 2346db87a7e652baa2d134c530c84d3543ef703d
SHA512 a33cae541076db04e43bac13205cfb151f32cb9b9e5977641c7e9db2b8bdd49e37bfb8df391bc04ab212a9325bf07da2c9d493e787656e446dddae6424202989
SSDEEP 24576:2fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnANLwexaR8cKR5CkJJFJ3ShcD:ua5POZ3BJt2pasx2+m+NLwex+8ck5Ck9
TLSH
T16665AE5EA6F801D5D579D17DC583861AF5B2342153329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 42d9772d9c28bee3e204679589328118d42c8342e5cf4211ac065743a94dc37f
MD5 75fb2ee361ecbb940eb3cd90da819a99
SHA1 8afe87f7bcf764088334140d9ac8d0051a065fa8
SHA512 e20a4cafab1104228ca7a881256f043f2212558ee2804cd11af78af688d1bb725565abeb1ec7d23dd31c6e7154e38643f8126c6b99adde59d538ec7bc7f471a9
SSDEEP 24576:wNcwHdjbyQ4nLC18lb/EOjowL7FkCNLwexaR8cKR5CkJJFJ3ShcD:wNc/zEOVHFxNLwex+8ck5Ckb3SyD
TLSH
T15E858C1623E901E4F5BBE1BE89779546FA71786953308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c52eb6465896d56f8dc5272423bdb1c9657b3062fd545c2c1e90e721c677405c
MD5 d9311a24b8594e3620e35e652a46270d
SHA1 66d9c3f6fc730443305d4067f4beec718fd0fa2d
SHA512 ce704abb0d2154366b5106df5263b1b8293c9c3ab4f8eb53ece15541b0528749ce0d0bbd2e21076bbbb20a727c91e83d73ad9c80ae97c4c4d8fa7514e245711d
SSDEEP 24576:iTkNvNnaFeYhJNtmZBm4NLwexaR8cKR5CkJJFJ3ShcD:iTMwBtOm4NLwex+8ck5Ckb3SyD
TLSH
T19355AF6EAAB846E4D1FEC675CD238512FA727861033293CB5290C13F0E679D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 6bf7d78a1eed6829f3d820d8c2f6299d5757276e07993a5182458a782b750e13
MD5 47665350892dd97513dcec00fab08a71
SHA1 b5a21e873f6612dbc5474c86d00c71b41aa55148
SHA512 c3cbe89b657caa60274160d8b5ca8bc09b3733bb4c802376fbe219e196745bb8a28e866cd55b3fbcd8ad0dd031337950991a8d740a3afc869139813bf7ca2ab4
SSDEEP 12288:+HvUrBFrEjwaQGktQ+LewXmQrIFnvaR8cKR1nCHEqosaJFJ3k98YcD:+PUr+NQGNLwexaR8cKR5CkJJFJ3ShcD
TLSH
T1FC65F11F22981CD5E676E13D85869719F772B8621312D2CF02D1813E4F77EE8AC3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 54f7bbfd796f901f6c28dcda886ac403f105162787406e1df8bf0fb53c0b50cf
MD5 8b38acf342cbc5beef377b3eb7a6e459
SHA1 d1da381ccc24095eca073cf010ec439e7da975f0
SHA512 73fd6f933861e7c7d843bbe38aeb78d0a58c7095ea8af8e2188c191b567275d4a7c51ff977b7c5d9d74056c0ea45a55368c0da6181a9bda7d526b4c60d2a8c8b
SSDEEP 24576:OD3FHshBIYQgATNLwexaR8cKR5CkJJFJ3ShcD:ODVHeBIAATNLwex+8ck5Ckb3SyD
TLSH
T17A75E17EE69C04E4E57BC17CD6638A06E77238A9032266CB02D081765F6BFE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/608-102-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/608-20-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/608-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/608-14-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1100-97-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1100-333-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1100-335-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1100-91-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1100-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1100-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1880-81-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/1880-86-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/1880-312-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1880-80-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1992-127-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1992-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1992-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1992-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2256-117-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2256-315-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2256-115-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2256-123-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2316-110-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2316-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2316-316-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2316-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2316-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2316-104-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3712-151-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3712-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3712-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3712-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4064-41-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4064-55-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4064-48-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4064-53-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4064-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4064-47-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4116-0-0x0000000000400000-0x0000000000658000-memory.dmp

Download

memory/4116-6-0x0000000000AF0000-0x0000000000B57000-memory.dmp

Download

memory/4116-39-0x0000000000400000-0x0000000000658000-memory.dmp

Download

memory/4116-7-0x0000000000AF0000-0x0000000000B57000-memory.dmp

Download

memory/4116-1-0x0000000000AF0000-0x0000000000B57000-memory.dmp

Download

memory/4588-400-0x0000019347DA0000-0x0000019348420000-memory.dmp

Download

memory/4588-330-0x0000019347DA0000-0x0000019348420000-memory.dmp

Download

memory/5596-68-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5596-297-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5596-76-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5596-70-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5968-137-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5968-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5968-135-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5968-129-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5968-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6004-57-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6004-64-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6004-58-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6004-282-0x0000000140000000-0x000000014020E000-memory.dmp

Download