55951759e05c2ca5e0d2a0659dd6b2097f1db16e19bc4b24f63052aadad02abd

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 3.0MB
Sample260930-cskvvavx7r
SHA256 55951759e05c2ca5e0d2a0659dd6b2097f1db16e19bc4b24f63052aadad02abd
MD5 4368b165ca951b9e05caeccd35746fde
SHA1 284d86216b14ad10c0f181e5ed7b4c8e661996ff
SHA512 2b79671c994ede3d4b6d7cbfe811014627a0e05b7950cbcb4cbc9ffd105b951446ca8fcc63c540574be68bcfb81d60638e8099889e8c2d4cbc2f56dc78b13d98
SSDEEP 49152:ZdF72dZhxSMmT8oWgBCaXFZt5TkFyAnh1EVRkhxSMmT8oWgBCaX:ZdF7G+M4FHX15Tk0AnMA+M4FHX
TLSH
T1F9E522207783C836E467513ACDBAD7295A5BBD300B5252D77B883A6DAF309D35A38307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4528	elevation_service.exe
2916	elevation_service.exe
5860	maintenanceservice.exe
1592	OSE.EXE
944	PerceptionSimulationService.exe
5628	perfhost.exe
2200	ReFsDedupSvc.exe
4424	SensorDataService.exe
3840	ssh-agent.exe
2004	AgentService.exe
4664	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5d3f5ae631e6882f.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00010000000093ac-120.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000e3c8654d8250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007df04c8f8250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c11624d8250dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003444ae4d8250dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b31ee58e8250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0a81b4e8250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
6132	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
6132	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
6132	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
6132	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
6132	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
6132	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
6132	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
6132	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
6132	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
6132	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
4528	elevation_service.exe
4528	elevation_service.exe
4528	elevation_service.exe
4528	elevation_service.exe
4528	elevation_service.exe
4528	elevation_service.exe
4528	elevation_service.exe
2916	elevation_service.exe
2916	elevation_service.exe
2916	elevation_service.exe
2916	elevation_service.exe
2916	elevation_service.exe
2916	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6132	2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeTakeOwnershipPrivilege	4528	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	2004	AgentService.exe
Token: SeBackupPrivilege	2200	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2200	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2200	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2200	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2200	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2200	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2200	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2200	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2200	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2200	ReFsDedupSvc.exe
Token: 33	4664	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4664	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4664	SearchIndexer.exe
Token: SeDebugPrivilege	4528	elevation_service.exe
Token: SeDebugPrivilege	2916	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 4736	4664	SearchIndexer.exe	101
PID 4664 wrote to memory of 1240	4664	SearchIndexer.exe	102
PID 4664 wrote to memory of 5308	4664	SearchIndexer.exe	103
PID 4664 wrote to memory of 2136	4664	SearchIndexer.exe	104
PID 4664 wrote to memory of 1104	4664	SearchIndexer.exe	106
PID 4664 wrote to memory of 4800	4664	SearchIndexer.exe	107
PID 4664 wrote to memory of 3528	4664	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_4368b165ca951b9e05caeccd35746fde_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6132

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4528

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2916

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5860

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1592

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:944

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5628

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2200

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4424

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3840

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2004

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4736
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1240
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5308
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2868 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2136
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1104
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2868 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4800
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b6cfe7f797f237ff29cd8794f96a77747e768eab1950a3101ee75ddc177cf591
MD5 6f938b28637e65ed7f7cd212ebd84485
SHA1 c92476957ced27f1bd245c7152c43e4cac939735
SHA512 f94e5aa929de5a50fdd164208e8d7fb45c440a78b3d4723a33e7df12653a35912f0c34285b5cb2cee8a2e10dc61ff3e32a5f88e60be7f35b6d940c8b15473b27
SSDEEP 49152:Kb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnahxSMmT8oWgBCaX:83q6HjBT+M4FHX
TLSH
T1B7D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 444ea7f0fae4e9f1fbf2025a8eaa8e90088582c7d4a016134177291d06e8aedb
MD5 4cf9ae6371ad16d1757380e11bdd84d8
SHA1 88fa1cad79a413cccab43b74aec925ff234e3dae
SHA512 6aeccf0c6885a1fdd0922eadeee6c4792e736b5add11288b90159f08f2b93cbb8ff058aabc1e3918fc4ca1e3a32aabf5317a0428df496f820368b4fe87e2cb35
SSDEEP 24576:yXYfDtczA8rKhxr+EHNmT8oW4ll1JCrLKXI:ZtcAhxSMmT8oWgBCaX
TLSH
T16885012877D508F9EC67823CCCA28512EA737C954360E79B03B49A691F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 55a12bde24e05bc72043849ba905e587b47b905cb1a0677e8dccad0e21282593
MD5 30653e95eb3cf5042062464e7c7731ad
SHA1 a9fefdb9bc46ac857b579ad115250d0d819ad7cf
SHA512 98cc2c16b09e49a3d32def03a603e70cec8d82d35e2c5d060156e715e0fa293c9146b5d64c2989072762981596dc3e774522d7331a13bcfe50b5b95a5c288448
SSDEEP 24576:w0Le5ji0hmxYrMerKhxr+EHNmT8oW4ll1JCrLKXI:wPji0A2qhxSMmT8oWgBCaX
TLSH
T12195AE26F6748335D073C0B9C5D2A68AED71308657308ACB4296D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 53d1ec109e8b17b61653c677d16ff44d658698df22c9fbe83e9aec55afd36427
MD5 e695d3b6bbb02a7339fc3de5ee840892
SHA1 838b356266e342282db0889bb94aa1afcaea4227
SHA512 7a8b11d45d5b4cfb5bf6783e3339182e627feab8b891eddf78ac3ae6a1d2dd90b45aa37d537b293d03684eadd8168f62ebf3f34bc0d5ce50e192289e18b7376b
SSDEEP 24576:qa7/ezSC6vUyD/aqgrvWE6q8wyusrKhxr+EHNmT8oW4ll1JCrLKXI:d/ezSC6vUzPvxHjy+hxSMmT8oWgBCaX
TLSH
T15E756C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 11a1f1ea595fb81b1c6d676e7c9d2d662d7ac91cf1e0ad4306837adff7f9d3df
MD5 09775fd1b4cc851212d2b6e222f795a8
SHA1 973b8db7048b486a7181a794f52d36c0cfcc9188
SHA512 efccb5b603243d1344ac5f334b59d9544309dfa202a9e3443c6734b299315fcca67d22d6688ce5f0100373bc5fabad8ad7420a0c834449594739fd4f13cef5ec
SSDEEP 24576:HVbqPb88hv/l+6VrKhxr+EHNmT8oW4ll1JCrLKXI:HVO88hXl+FhxSMmT8oWgBCaX
TLSH
T1EE559E66F6748331D073C07AC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 5a5cc0f1d3c59144486c3200a94037eb43f4959c813b65e83e2c7c72c492bb17
MD5 c06ba6820684480d31e6952cfb84a4f5
SHA1 dfbee7738b9f08807d595a94664e252c543b3f28
SHA512 2792b2a5dfbd76e1c697ebf299679bdb6e09355c950ac5ef141815b68c2e14470860e445c6024e12d0eb741ff90d5aafda29c0dd808444dc7b32e7ec662afdf1
SSDEEP 12288:uHKJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:uH6rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T18A6523759F0E64ABEE3B8335F872571299990DDCD1412E3B8F3A3FAC3934C5A9052212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 39f3b6f0b68889d2a6a30a4afcaa36bf994bace2fc44ec39d1f2ee566a53c45e
MD5 a6bbab4fb95a8a785786e99fa07f9720
SHA1 fc2fe2083a2ca26a36b809b5307c585bcbc9b086
SHA512 f13a2eaa778844c6d651b7b3f379b187609640d3a67628d4fe7b749b0beea5238251d6dac0562df4dec101947cb2176693d734281ed59574ad05260d53f21627
SSDEEP 12288:xeBNUbTVO86ULJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:xJIUtrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1A985CF3BEE28FCD2C67A8D785A918700D7B278704B52A3CBD175830D9E235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2c03aae0015cc9058ac52248457be70f8b162d0f4b2eaa3b4b98c24937fba00a
MD5 f3962e442dc1c5fe60198f849c6c8c8a
SHA1 31121fb4e24c447bf207eb992eed2c27182ecfbb
SHA512 8f92b51671504bce0461e886f7e4007f27419bdd544c69d72614b4d2fdf48c2c60c4c0afa0d19bfcf281933741b3d0f0d02e97ded8044be41e9ceb4e6658a978
SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH5:CQvGAdlCEL8c/yRNw5Cv+M4FHX
TLSH
T172266C656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 13abb0e4ef2eb2daa87310c876ca9ae8645a686925d7a5783d2b8f520544cbef
MD5 8c5c8a5761555bb9086abb87e54c72d4
SHA1 539113dcd064bb3f5681c70fbba3cb9181f29bb8
SHA512 e3d4ae380d96039425087ee68f13eab0092914666d31ff1346c7c7b1ab98cd2f628230f625c8a63116ebe0ac026f7db9dc3810ceb3884b2ce8fe493f54d50223
SSDEEP 24576:g7ewsAjrrKhxr+EHNmT8oW4ll1JCrLKXI:Clj6hxSMmT8oWgBCaX
TLSH
T1C385E031FF74E036C67F0D766B36C716586C6A604B522AC3E3B88E9D59302D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b1e252110c933b8018a47b0f6d988801e306b852bc4c2e8b982fc8af481d6e4f
MD5 6571e37880b7723a8c32372fab598121
SHA1 21da84ae95bf75bb0a6925231f4fd120b07345ac
SHA512 bd788109679ec5a3669f7bf01e3c2581fd17e90fd1fc05f1d0eaeeed144ccfac0207ec051f677a88699cc0967f1113bcd3c1f1e271d931d080875abb4b85e930
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHS4:OUEtQevvqc2W1cpV2EI32S4
TLSH
T18F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b502dabd3a43699136c1bfebb897383b2483403a77515f6ba973fbb1244cc952
MD5 d1077bb55961682c8b389d0baf903bdb
SHA1 eefce9ff5f7801364efb99a7f0863d1d175b1e3c
SHA512 2fefab01d4f8d38b788a99c927d9a56e25ccb7a937e0a7b13698e7106899ab7465dcea379001dcf155e6030e0d597a184ceab18cfff2671f4bf0cb2e2d3e6cd2
SSDEEP 49152:HCbRquA/m2yL5zTfFiV+XenmE3/zahxSMmT8oWgBCaX:QoquVjnmT+M4FHX
TLSH
T1E4D58D1976B8C1E4D1F6C37886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d538f48786571f66e9d7b983f9fec6ba27535beb5a04a0f414103f0a9ff1002f
MD5 3978a196cd2e6ad6c6bf531fd7baef8d
SHA1 c26d531dc12c2a01d78ce2a1e6b0509f472c633b
SHA512 e9ea57adfa7bf8370fd2608645a28405d643f0111aaa5cba8bd7fe0bc083985126f397418389c986a9962d186ba62a93fe5d185ffcf4c34729a9acb013976675
SSDEEP 24576:YAhGLJIFoiwtA5l7S53ArKhxr+EHNmT8oW4ll1JCrLKXI:YAMyFoiq5jhxSMmT8oWgBCaX
TLSH
T11535AE80EBF955D4F5B3AA7899B68171EA76BCA95E31C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 254af3549399f5769585fed52f837c1cdcc06aa63d5d8545e4973603a637ee78
MD5 81fd48b8fa7d51660260937c20ff3986
SHA1 167e13c2e5d895f724f7ab948b95ea387ad7fb48
SHA512 61902fa27fde006eb079b72297b8dcb35822c7dfec81709aa74297332150c7b72ad79514fc3e140f2ec2dd3572053705fbbc14d6f2828ad249af2f40d52bd1fd
SSDEEP 24576:qwuSOWKrKhxr+EHNmT8oW4ll1JCrLKXI:qw9OYhxSMmT8oWgBCaX
TLSH
T15C85F14677A91CF9E9678238C557C136F7F2BC052621DB2F1770C65A6F33221AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 0de331f3ac3c60346f67c9d073b857560f533faa7f1a56a5d550e5b997dc4335
MD5 e02cec450d37251a1f4668310d2e124e
SHA1 fe3847c3e51c4d25441a5d07b96a367b43266eaa
SHA512 3582f57a66bc4dbf8ccc80c1729ffc1cae1cb1beff2754c7985f492b379deafed866d06a5eab05016ab7a4a3874f2929a8e27ced9e63c94f86a489bad3e11d6f
SSDEEP 12288:djZ1IyFJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:ZZu2rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T12E75126A279870FAE967823CDCE14605D7B23899633143DF1A3947A92F33DC65D36322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 16b3fbbe5d61734931da47790f48e02f96cc019a48c088b9292fc17f4c4457e7
MD5 08af19cb107c2c19d50d08a42feae91e
SHA1 3f5b0d7df9229e3761b7c6466aea61f4abb5276f
SHA512 b662c44d79cf1bfaab003acb61a1034c9cfca2014f874cfd879362202cbc0436bc0d5e6537a66ac90eaff2dcb454177ed2b9f9f3e8bdbb57904f45c281d17551
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UF:qQRQyi36YOcPQLvw2gAf+PN3I+M4FHX
TLSH
T1FE667B13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 44a965e15227ac8eb7929097eb5c107d2f3235aff27c86f1f42df13e86f57d00
MD5 5b8281886e8d4028f560dad31bdaaf7b
SHA1 06062461f081dfa7dd6154e411e55bf8a1bbc954
SHA512 c29e0f8ecc60e8804ff1a0f7b73e76d568df6f5a671ed51e3f4606202026b4127f2e849e69b28a19103d31a65032457b7c0e5b398fd9537d74e12e263a7ee3a9
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UF:/QRQyi36YOcPQLvw2gAf+PN3I+M4FHX
TLSH
T145667B13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 44e8ea3f7324eccf110b86420dafe91b97c90cc832c96ad83e72792070ed61d8
MD5 6e8c968dbc8a83f7655d1c3c9577b940
SHA1 9e1cc9bda03b8e6944eb6b6d9a33ccc70c3ef8de
SHA512 fbae75f770210bba6857ce57ae87cd5e375e891c68e1007ce8715051922ca90a3a3ca1b1a4190b69ea567e52aae313074673429407db110942844bffd821f011
SSDEEP 49152:V68Qg55nhheWu7PNU3/qhxSMmT8oWgBCaX:jthWRc/q+M4FHX
TLSH
T1E6B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c93413f42ab311728a9d744a831021ba387597dfce6daf300246542c574a5ce6
MD5 893025a31b2f6769b64a1b036af51a2d
SHA1 1e9efe948952bd3596afab539312d6314a0d1411
SHA512 4bd3f2a724ca9cf184af4245512d5b2fa1f94ddfa7a0ae114aff550611e3d1d33e7d4305e3c1f3525fc4393e8b553843284fd658d1e798ba2d11014866c2a6ba
SSDEEP 49152:T3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99/:Gy5112gYy5azzVvL69nLKnhZt+M4FHX
TLSH
T1CB167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 342f2798856580bd657c409d00e569d93fdadd8d01e2c57820c4e07d713f6bdd
MD5 42b52e02a06e2b75b4d67d82b3b6c594
SHA1 3bfb1aa3fda56ff5bf5fa1e8c131feb268a4173d
SHA512 c439bb56efae1903717d2b937490a34d0378982d81536e0b6e4cdb76de2cf8cdcfe906efe69882f25d041b401a4bd8cba7d9a951aa700a6c6644dbef51f78d8f
SSDEEP 49152:wB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glfhxSMmT8oWgBCaX:qu6JmVxd2df+M4FHX
TLSH
T111D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 72b201097f557eafc53704ef5c6b404d5fc02f6fb0c09e89feab7c993f4a1b70
MD5 1da67e53dc3be441c049f72160684edc
SHA1 aa3e953637da5a4694a1490b2e1b9480ea047fac
SHA512 788b5c1b90b6c4675528566b74024448e7264cb524ba533ef70e304dd54cf6463875aa2d876fa99477147c6af4b6bd6e18afdb32ff026fc8843807aeeef10a01
SSDEEP 49152:o1hpsNoJpF1A6UU44CwH7R4x0hxSMmT8oWgBCaX:omifPbRT+M4FHX
TLSH
T1D7B5BE13F2D900E8D06ED17887569632EA62BC450B34B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3875508ae07887477823d8fa742e0127a12764574f7c955a0c5550200557fba7
MD5 cf6232a4f8fb2ccddc690f84b2786ac1
SHA1 0f4a0dfc6f694cdd3b64647142089864c0cd4d95
SHA512 63c70fbf705ad87a99a0b2b14b3ce3d2631b0bdd86f5defcdd5fd255f0d866735f7978f6f39c44cb184cb52db1c67a28a9675b2e383dd71edf657c8fc0e37922
SSDEEP 49152:LSuZQIY0Be2KRRVtOnks6NMHqZhxSMmT8oWgBCaX:Z5dKTi61Z+M4FHX
TLSH
T168C5AE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 453e650f46194320171a154e7a44e661dcf85e877efa43f07557f23c8e263c3d
MD5 99da8e0425a1bf2fb60472be52fc2e1d
SHA1 90c5454429fb71393543f68b4fa1d141c76258d7
SHA512 be332cb2f9fe388b33887a5965f41944faef222cce725f01eaffa1bf9e4e5c265b16a49491fd3e3b99a7075bfbf3d898aa7e5c9a74392017be8c6104398c0fa2
SSDEEP 49152:LhtSn8EApI0figngiDn0AP5wQhxSMmT8oWgBCaX:KX2iyph3+M4FHX
TLSH
T15395BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 36c4ed145d2f6be0bca5c7a70762c653479bc9ae4fc6e5a66a4c91dfb2e64d58
MD5 ece5941b2282f661a84c2f1d648c6239
SHA1 cd94c70845c375c95cd9b5bc4d65881708c1ace1
SHA512 f0352d806a9403b65d16508b8764c5b566340cce02992c4cea09c166cba23c8aa75352b3a3e460dfb6a8daa0534d8dc7403a933c7083ab8375c11f36354ffc4f
SSDEEP 12288:XiJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:XyrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T10F652375AF0F94EBED2AC335E862471699DD0DDDF202163BAF3E2E683B31C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 8d4fbf69c05ed704f84701dc4a8c8cc7ee4acac5de16bbf9e115e0862b57aa3b
MD5 4d160b6d37879dea994d16316a9a1c71
SHA1 91dbc07387f885e56e0f21bfb2a1ff36740d1bc6
SHA512 f30d617c1f94de0a04746dc605a3dfdad1a8aa23a01b36a92c1ab7b966277dec47b5e01ed1d1dbf0408e2aa2bf19fc93df89c01a601fb837356844ccbd03af70
SSDEEP 12288:0xJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:0HrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T165652375AF0F54EBED2AC335E8624716D99C0DDDF202163BAF3E2E683B31C5A1152621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 06c6cef278ddf5a52aac02982309930b681b56a315e01789cab601857ad551b0
MD5 29a97cac482de485b4ef861344be049b
SHA1 d6a25d89f6400d3cc5fe7862c64a6ce09bd6a253
SHA512 94878f10739aa6771c028678e081a59a74e28d07dd17167cf348d96dfc934c6178d06029832e8d68dad1e683491e4d2dd25f74e46a57114802c4e1312416fa79
SSDEEP 12288:PjJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:PlrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1EF652375AF0F94DBED2AC335E8624716D9DC0DDDF202263BAF3E2E683A31C5A1152611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 b71c812c8f8f49446c4ed2b641538cb7fd73887193d4f718b497342b1bd2eb3c
MD5 46e73518064d45a264a873539fb39e87
SHA1 275354da0940f716e5bf1485e1d4080c3876596e
SHA512 d88395575c8a1a6c04c058f815687299e250b22af281bad394f4644b5bd1a1119b0110813eb12c681a5d70c44e7944921350d99a89eb82ac90bff9a2eb376554
SSDEEP 12288:rVUJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:mrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1576523656B0E50DBEC26C338D8724712D6F93CDCE322277F9F251E682E31A956931B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 f2840da4db24f3d942fafe59c7f144e3406907734f4f4e749328b5eea53f0dbf
MD5 39dc7f92da9f8c57202e0919f6b00a22
SHA1 17a39255c7c5a29d119e5a9274c453c00ffdf791
SHA512 af63f859b550e31f7f673253a9471f313e767a427f33e1a3503ae5501e2d82663a33653412ee05c7b84acff88bd26cb8077201bcab0992c18cff67070769847a
SSDEEP 12288:/8JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:/orKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T11D652375AF0F949BED2AC335E862471699DC0DDDF202263FAF3E2E683B31C5A1152611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 f8a4e61ae15a78cccc684f5feff9d29b5a2491fe1231cd3d24f747155d36ce82
MD5 54d50b85807d10dbbe1a3e90c0f4c35c
SHA1 d907e3e87b2533033e3e2d97d733aa0e82b60767
SHA512 d21d12f926f0cc8610b1dc298aea35fa7356e2dec82286b533207a182039fe59a34d8f81cb1246d09a7a264b2da2b216508c78f010957637fa18672b754626b2
SSDEEP 12288:5tJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:5jrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1CF652375AF0F54EBED2AC335E8624716D99C0DDDF201263BAF3E2E683B31C5A1152621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 1b91a33ac7ca1b160b64b37a9dea1651d0e777f430b5cb7aa1ad477317fc5223
MD5 c53fc2eed0a9f45c9ad38fa44d098add
SHA1 d431e066c3dab6a4410d836a690ea0078e573b3f
SHA512 1e674b57406fe98bec7f1225a6c48f60d0c0094fb12f1661872573292f8f7b4c4f354638bc7696e57e2845eaaee53a821fa379ccde166bbf3809a6b905dad02f
SSDEEP 12288:c5JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:cvrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1D9652375AF0F54ABED2AC335E962471589DC0DDDF201263FAF3E2E683B31C1A2152621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 0a862a881d64a4f0f4efb19272c594ecc935c821c2ab731d951184e292310cca
MD5 0d2a2a933ad2a7683305e1fbc0e3c2af
SHA1 647d7b915f15a53b836df37e756ae56385c5a465
SHA512 34e737ed6f7cb3032cccb85963cb80af14a59726191f0225e951ba2963cdb1c34820f70f019001dfa10b296c57006d797ce4b45064aa61662e3c3ccfdf355860
SSDEEP 24576:eZMEzFVSOnrKhxr+EHNmT8oW4ll1JCrLKXI:eZMEzfihxSMmT8oWgBCaX
TLSH
T1658502A5B35018F9EC67823ECD218906D6F27C594760C61F07B8366A6F337A11C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 fc77ac25bf2ab4f8dadfc2a8f40194b20ce83ad197b3d4c7b2a76ca12eba0e0b
MD5 068621d7044ebc91279e79a5801c7de1
SHA1 d08a483c09b8f55ba873562d12d54ab14a26205b
SHA512 fcd9a268f178ff975f98a4bcece5c0249ac6faf50a79d786e0ec423b93905a6a5d9b3449a0b2e5ccf366af14d246c55a684522c016aada4f95d80b43df0a3145
SSDEEP 12288:MGJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:MmrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T104652375AF0F54DBED2A8339E8624716D9DC0DDDF202263BAF3E2E683B35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 94a0b15e5d8f3ddf2b401492a3d9e7eb6b011fc75ae5dcf371d23a64c916c8ab
MD5 8fc38f7c67052bf39c3291f96b0fc745
SHA1 de8dab04caf9b389b949dcf0eb93a46f8906209e
SHA512 4d4c73de5d9772fe6881fbc9593c0883de32ff9b17016b48bb85846b02153d258900ba4b7df8ea953438418ce6f60dc0a3538fff794067980ebff731fe475193
SSDEEP 12288:NaJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:NqrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1E2652375AF0F54DBED2AC335E9624716D99C0DDDF202263BAF3E2E683B35C1A1152221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 5542bc2ecda8d2cbbd9de3d81731ce90faa3927414f55797e925788dac6ec58c
MD5 f08d59e2dab42a55007f58b5f884dd76
SHA1 0a7560d8940633f00d2f368204f85ca36eeefe5b
SHA512 48d799cf54f5fda1b8048f544f394e575eafb670276dc9931a4f83ef91930b8b4c5bc1399fed10607def3a3c46dad76b3bf6b7a69bc59b5361865ab870f91da8
SSDEEP 12288:eyPz5L8FJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:DzybrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T151751217779630F9D5378238C8621A02F7B57C7953209BAF5B64077A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 ece269b8f4949024a58e334e76272a21282a6c24046b2a860087fbf03cc3c451
MD5 0e965c9f2ba5978465de9117dc2c44f8
SHA1 25dee1a1173d14a53a482f3710269ceed96ac4b0
SHA512 b254eb5146dd040cd93b5f7014be97610f9016952be81410c8533b6ae706ef42e62890ea2e504068e97e2f7e4be2805453e76adfd2270476d2457a1d1aac06fe
SSDEEP 12288:ZGJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:ZmrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T169652375AF0F54DBED2A8339E8624716D9DC0DDDF202263BAF3E2E683B35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 cc00968fe3456c12e447876b12b3af463f7f10ff710f116499a27a9825bb5879
MD5 55e4c852aa4a234fbc67803f254264a2
SHA1 cdc894960bc46e18f45f8bb5b1320a2c40acccb2
SHA512 ab4ebc6344c8ad225bdb38c79a56d655a9fe32e6001f8e1f1016257a7949a9272071f73be27aa4f2bba0423a0d990e15ea6ae9f3e5cb88ecde2f60a2a946667f
SSDEEP 12288:AGJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:AmrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T169652375AF0F54DBED2A8339E8624716D9DC0DDDF202263BAF3E2E683B35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 165327a917fe6dc8f895cafe43354ff3630913745ce2c7eb24042280f0f3e01b
MD5 9ec0732fe13c58ac4f6c1a17f878d5af
SHA1 794b8cfad2f724b8315606e743afbe74dbdfd063
SHA512 83b0059f998e0e50d302860a4f351f0566cfc834fbdf7380e7ad17c78f803144ef1ae8cfa46859ba33b078d5893f4b308fd203216da734d9fcb6a0bd2a4ee2af
SSDEEP 12288:uyPz5L8FJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:zzybrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T14E751217779630F9D5378238C8621A02F7B67C7953209BAF5B64077A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 dbce54fb4ecd890a85625af9f224bb577686dbf1e7821d91a0a62b882e240ef0
MD5 9aba9fdf134651d594cedd926e1b4d6f
SHA1 bba0564c9381e6ea1b33598105ee48bb7b97d7dc
SHA512 0b1bde94a23a6e865d696b8b5d32699e1c8215d8b780229b2e7448db0ff0561ef530b7a1cf3044d5e621482ce9a821ee242ee63df70d0adda110130ec56dfabe
SSDEEP 24576:RTdaLl3z0zD1rKhxr+EHNmT8oW4ll1JCrLKXI:RTwLljfhxSMmT8oWgBCaX
TLSH
T1688502A5B35018F9EC67823ECC628916D6F27C5A4760C61F07B8366A5F333A11C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 0f8afa8c537789fde3c4d920a2271585b0880ceb7dbe25d1630ed7964fd6556e
MD5 c5c567ce3d96651ed0958dfbeb8e405e
SHA1 2f71df944f625ee84b11fa1cfa6b902b9fc8d56b
SHA512 d40c0ed6fd6556f39cb578eb555a747265012e1dc0050de3e2e9f6c684ef9eb6d6b0ef4fb2d6019c70f69bb544ede72551ff4d938a9588c636fd6a2b10abb11e
SSDEEP 24576:E35d9CHKy7GZhrKhxr+EHNmT8oW4ll1JCrLKXI:O5d9CHKyaihxSMmT8oWgBCaX
TLSH
T1F195CF90F3E414E9F0B78A35CD724511DAB67C995B21DE8F03A8265A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 1b9907c397ef0b457807f2c3dd126454d2eb956b07388683777ad40fe59040b9
MD5 1ba690c2eea3181719c030228f8eccae
SHA1 fc8e55500b8b9dd9ee5d9f6f89f7088ad95fd9d1
SHA512 9024ca750a178d68311eb752c77e8fb8bb710df586048b305f24bf6d5c24cdd6dd8a720619fc7ebdff93d530bfa4d33ebc94f8cad0249717fd0a82c473839739
SSDEEP 12288:XDJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:XFrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1BB652375AF0F94DBED2A8339E8624716D9DC0DDDF201263BAF3E2E683A31C5A1152611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 133dbd82cad28602285597439fdec079a303d7008345a635e87b8768db2e634d
MD5 3bb2754a8755dadfe7b115561403e496
SHA1 4a45aa702c619a964c74becb29812f275a229dcd
SHA512 75302fab79c2504ce8f2d4268644e3c1df357a1a808b7361d4f10d956e7d2dcf4a803e8ab071abcd28d0f4e7c6d101ef9b7a0ad447bc1c55fcd4c51adf788cc4
SSDEEP 12288:1lJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:17rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1D2652375AF0F54EBED2AC335E862471299DC0DDDF101163BAF3E2E683B35C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 45d51d0ac4315c319ba74cb5bc2a8bcfa196923973318763398c66e8fc3ff95e
MD5 5b0800c058ce6ae47a8b38bc95114d56
SHA1 af90fef1af261a4c0d534dfa6a76560023158811
SHA512 0eec16508388806d4ab6072f7ef1c532df0ae01ba2435b7fc8c7077847f90a98c0f2cdbf54f7e102e491910e058ca925164babf83c7c3b6afd12cdad84db4d64
SSDEEP 12288:/YJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:/0rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T164652375AF0F549BED2AC339E8624716D9DC0DDDF202263BAF3F2E683A35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 bcadd4483d9b6b6e3d3f88d02822855d2cb3d5944335d56473337a3c365a72f4
MD5 2aabd2147cf74c1fc65dab0452473e92
SHA1 b1a221f2b22a52ab4d86fd5ecff307a8154972d1
SHA512 e2eee36dd6f1afe26ef6506d7ff806bf85baab984713f27bad21674865664b5df468662d585bcd237b81487840fc060021a003f030926e1a6ff93f1c12377fe8
SSDEEP 12288:mGJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:mmrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1C7652375AF0F54DBED2A8339E862471699DC0DDDF202263BEF3E2E683B35C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 cf33483f0e249e7805fdbaac6191b7ae35ce5ea9b891f754ce6950783d81b593
MD5 7282fbbd4e1c5fca3d4fb429725baf85
SHA1 307b7f897b39465869bc915f221ebca62c71b658
SHA512 ed1e5291b0c102c1d632cf495e9c72e628def50eeacafb7ee5d3731c4f8fa6efdeb8e3f1d2ff058c289ddb002bb275dc333a619c7ea8c398066a0d9318aa902c
SSDEEP 12288:xDJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:xFrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T15A652375AF0F54EBED2AC335E8624716D9DC0DDDF202263BAF3E2E683A31C5A1152611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 544d9816c9343f12586049a9d967b11dd454c2dd01e0526db18e1c500d8203ed
MD5 09cb6939da39e7d2f8ec907083052490
SHA1 c603bb727377d44cf0751fcfeaf0907acc6f5dae
SHA512 88a082314fd279741242a68d8044977d32f4c5b7cab6d3aaf227f3842a286dce206e23e0568d642f9388c17521de377fa980711d19bb3d3b980a512e27b75c0a
SSDEEP 12288:2uJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:2urKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T147652375AF0F54DBED2AC339E862471289DC0DDCF242263BAF3E2E683B35C1A1152611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 f7da2d2e8a43eb1b9653406ccaee1572132abaac01b1bb8f4697f8014bef6b32
MD5 a0c9407540a3780478ea18580ae13eac
SHA1 fc4d7dc8c149cc7e332e6b3326a8aa98d0c02bc0
SHA512 14ed478aab51077407f609a7eafc96bbeece14c86e4a39232f9c34f11de66cf2099946d7f57228a456f58b7173738c664420fb9eb81caa19d9345b45861b9121
SSDEEP 24576:Ifwv+k9RX6wkyAIarKhxr+EHNmT8oW4ll1JCrLKXI:GMnYINhxSMmT8oWgBCaX
TLSH
T1C495DF29EBDC44E5E177923C99B3460AF6B178691B31C6CF026A53AD0E33ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 fa5d8239f63ce639dcebec17f531d3b3164f82d0fa5c8c05eef4461b84cd357d
MD5 9f82409ac2265815054e02da4568dc79
SHA1 ed6d84c4b7d57420617e3795c8f5ad25d4561725
SHA512 a12b747ade2c7eb5b277078d64cdab62f180d70d6d74a18fce4ae77dab4aea6bbad43fc0af58e3c3fa4998ae5cc3fa10b390ce1a283a8a30eda73a2168533c9f
SSDEEP 49152:hYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0whxSMmT8oWgB3:JySzPo+M4FHX
TLSH
T132066C96A16801D5C1B9C1B98F1BCC1BFAB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 070b27ebebcd5d2cffaa0b2e85ff727be4cac12aac5139c29d7ff24cc28ed2af
MD5 4febb786b8db7bb5fa4d0c0ee3b23df3
SHA1 86097cff48333c9d43ae3cd8fefed5e9a3e343cc
SHA512 da73393d6af0bdbca4fa68d475dae11b5fd2dd52de41ccc6276994be36cfef421c3c11def894d1776ca81de8b062ed624e23bf1571f0e6b0c41df866b7c511c7
SSDEEP 24576:U47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYXrKhxr+EHNmT8oW4ll1JCrLKXI:U47JUQj1irIhCnDHUPfF/AhxSMmT8oWM
TLSH
T1D865AE1EA3EC01E5E1BAD23885154A1AEA71782E5B31DACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 91421b24024939e4159f04a1943ebc297744909d4f5eac9c4c5be59beaee1c65
MD5 cf25f91ecded512e29d03360603d958e
SHA1 d712bb6dd564bd3e62730451d8afe99b989fbd06
SHA512 1e5d12d5a71f3bccf1a751ed615ff507ec551c2bae56a6776a1cb1d111acb504c7cf2af6ab9eed45389e4e797a3cff9fd4cfcedca85727e7022e5d809fff97d1
SSDEEP 12288:dzsf2JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:02rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1EF75F11AD24811E9C46E9239CB524A01F7773C6993E193CB5BE0F93D2F36A905DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1004KB
SHA256 24fad0fd1cdd9b6b5c3199fb00a5cf7f1f79b168ae4d7c735e1e37f866b9778f
MD5 acd3c2f8ee78927ef9cd8288a562b211
SHA1 b78256e2a06515b41e63e6d7e93bec376cb6bd1f
SHA512 7522cc8749156fd4c7fdfe18a722dc826c5df478f68aef97d29652f20e827842cd02f7cda03cba6bc8ef2748f76142d79212458c42a74eefa66ba988c459a248
SSDEEP 12288:+FufAU3fh4kXly4bxAR2ZiUHM4i8/vLE:+FuoUPhj04baKiUs4iGvLE
TLSH
T14D251711762ADB4BC6A940325E37D1CCAB707D41EE44AF0772C9873FC576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 d263c5bddc7d4ee513f42350f8e66edc0369cbf030a23e452af3c493c889c375
MD5 4d05f4697f55bdb7de7252c98a2d10c6
SHA1 be81c2d1074061f886280072fd937e2e53d5892c
SHA512 0b56a833dfcd951da0fbb7ed3b4e48c3b4152798f8247b103a6007dcf6775c16245edaad2193728cee2d9731230363670ba10cec89573e94160c2bb9442d2084
SSDEEP 12288:Ae67lNxlOS/XxVtI/1riiTeVGFGS+eAccu2L:Ae67v/XxVtI/1riimOQ
TLSH
T18555C640A137E7CFD1BB6132076A5B8C6BA4EC0B77495F6663C5053AD86BB11A4F83C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 10e20f0ad51d7d3b31d4597260f6a19729e5eaa8f0c7e1ece374feeb0c3cf010
MD5 76f298b3ecb8de6b5089b4370271a086
SHA1 fc8d2764a90d6c1d49011b15cac0b3a76f9ba9a6
SHA512 c901aa8b957b3837b7c9b9e057397c9778cab469ea39be9064950ae1095bbd8f8e983ca430283bbf5ba7764fc721f820e5731870ce08e1a07b232b4023251f97
SSDEEP 12288:0O79JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:vTrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1386523719B0E989BFC3A8334D8664321665D2DACD30055FBEF2D2BA87A31CC55D72712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 fd445e65a575d6e8fcf53f8a4084d82b56df15dcb5f970aa2831370db2b658b8
MD5 205c5e1cb578802106d45ed0dd7817f4
SHA1 85134993c0bafcb9b09b56a306aa3a44411a98d5
SHA512 35865df73be8a30ffe63a93d4a43f8badb383f141e23d73a0536ddea1b667f47975434d48dcbd73f6757d6261280bcfe72606ebb5f29b5b917f09cff654cacb5
SSDEEP 24576:5gb6bmBIi49WNNFpg1rSvFv7bYsrKhxr+EHNmT8oW4ll1JCrLKXI:5gb4mBIBhGFWhxSMmT8oWgBCaX
TLSH
T155659E1E22EC02F5E0FAD2B8DDA64417D6B278161331D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 38fce2f19d8373b50abae76cf005f7f711e8de1312744de1d9e2c1e3bfe2455b
MD5 babc0fb38796f4177634502919fafcb8
SHA1 c58b8a5c731ecad6e7749394a2c80329d155cd17
SHA512 288043b8d633109d01a5d305cee017be3115c7da50b7fef5275f330133b769450207cf566db91eacaab75c838e6cebb6a4e0ef47870c366a5e69f8c8db5b04bf
SSDEEP 24576:cG88u8FpJqH1hzria7/mnrKhxr+EHNmT8oW4ll1JCrLKXI:f7ZFPqVoa7/nhxSMmT8oWgBCaX
TLSH
T17E95F16567E101F1D47BD138C9824663F6B2B8251360EBDF0BAC8B551F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 6ecf9801174d8bb4321b9e54b2b1298574b6982a35cfc0d2d41b4bd95cff4b98
MD5 20864d6e30778265a1fa0154d3510d68
SHA1 372cb00ee30166f9cfaf556fa456d5a6c7b41d02
SHA512 a1f8e349bbaf0a21e9914f888daf69957b1fc850fb48d9469d40f8079ecbf19f0c4cc805686509cb720b9a1dede90e5a67a38d39a75835a72b1981eccf320bb7
SSDEEP 24576:UPUr+NQ2rKhxr+EHNmT8oW4ll1JCrLKXI:UJQZhxSMmT8oWgBCaX
TLSH
T13A85F12F269D18E5E67AE13DC9824719F7717866131292DF02A1817E5F33DE8BC3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 53032a78aa703f9d9f2e8b8b029efc1ed09c27705809f2f459ec7c25ce01cf89
MD5 51be73a7543a782d44c8b72ec1366ad0
SHA1 af4d97435bb9936adb7591a7b052b9602096a593
SHA512 b7d0cfddb65f86799237ed932f694907b96c97340d5c6b8923565d564c966e28a6f543e42da0a4fb0e9cb8c1bc8bc5fd35297ebb40a42ee321cb765b32810cdc
SSDEEP 49152:aBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjphxSMmT8oWgBCaX:FG05lO43bO+M4FHX
TLSH
T193D5CF6E62EC11F9D1BBC17CDAC64A0BEBB23815032556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e5441667e8fb6ba84b35e5242fe3b6162749211cb2342579169f81d981e932dc
MD5 37dff63c87827e3188bdc79447c7eb94
SHA1 198795a7adc76729676bd402fbcbec9c2d1957e1
SHA512 2160a1152e2c228b46546afc1a298f1060779ab25b317c2ac4df36fdfaeb4d93869e45e5b2cce1b8ca469ec96e4240450acef773090622653946181b4462742c
SSDEEP 24576:Zfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnJrKhxr+EHNmT8oW4ll1JCrLKXI:Ja5POZ3+Jt2pasx2+mqhxSMmT8oWgBC8
TLSH
T13C65AE5EA7EC00D5D579D17DC583861AE5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 77121f520a4790646c2bd7c47801712d2e7a739c830b50ff510965cc90661cf8
MD5 7f7f061baf227047d0fd2763b0d1a6f2
SHA1 e33290f1534c73795f048ed1bdee30a111e30311
SHA512 70256a3ddef569ad7eb6662a67b2851891275a340f29bd81b55f9bc79a5ca6b7ba3f79510961f6a0a4df6955d605ca61c93d2173f975e79e5843eb244689d937
SSDEEP 24576:kNcwHdjbyQ4nLC18lb/EOjowL7Fk/rKhxr+EHNmT8oW4ll1JCrLKXI:kNc/zEOVHFHhxSMmT8oWgBCaX
TLSH
T161858B2623E900E4E5BBE1BE89779546FA717869533086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 8cd340223c31030189781770c27926aba876ab695b5b2e569a28b3e6fe99e1c5
MD5 965dd83e5b532ef0125e299789c53518
SHA1 b35d658b4905cde3ca8434027c123109606fd9c9
SHA512 3c36887e3fc90cc57d8ba0c40ec8566098b921db1d339d4c073ad90afb875d73f9d3c9419513008a1239ce9c2265e0bfd033aaa38ff0c6556d8e6ccea37b47d1
SSDEEP 24576:66DIClZBr5p3CsztyXRsy/GAwA2MhZnEV71XLL/d:66DIUZt5TkFyAnh1EVRh
TLSH
T1B825011D73BB00B5D16BD03DC6920546E2B3B07187925AEF0688C5B95F93ED9BA3CB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3fa2ea395fdca547a458cae9a2d4eaa32174b7a20be3d4a51b210b5a9485930e
MD5 6f1d2b2c7201a56afe1edac5fcc51150
SHA1 799da9a369c9798de3a9e22425e14c959033abb8
SHA512 43bb96f4bc11af0d9e2dafeec93e7d661713ae9a714b045e52f335e9428a2387fd2b23fd6329308562e840acef844ee3b2c708423de32a9efd511c1b0f3d8cf7
SSDEEP 24576:W8kNvNnaFeYhJNtmZBmIrKhxr+EHNmT8oW4ll1JCrLKXI:W8MwBtOm7hxSMmT8oWgBCaX
TLSH
T1DD55AF6EBAB845E4D1FEC674CD238512EA727861133293CB5390C13E1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 64ed80eaec2a4957426bf58fc7d60b7afb47f1baeefc21e86b78a7c122cc86e5
MD5 bdfafbdb986c44b8e13977dd7260f47d
SHA1 5f16f58fa4c29ac91475069cce935332a180eaf0
SHA512 5ace5968108f5bfefa5146bb6f8c73f7ae12135b4fe242d081c694aae81a47cff47c22cc282bf732f1a44c76634fb6eb8e74ad422a6d62345aaf96f2b2cf4091
SSDEEP 24576:GD3FHshBIYQgASrKhxr+EHNmT8oW4ll1JCrLKXI:GDVHeBIAAlhxSMmT8oWgBCaX
TLSH
T19095E17DEB5C04E4E57BC17CDA638A06E77138AD032266DB069481B91F6BEE42D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/944-80-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/944-321-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/944-79-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/944-86-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1592-62-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/1592-69-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/1592-63-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/1592-304-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2004-163-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2004-152-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2004-153-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2004-159-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2004-161-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2200-102-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2200-354-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2200-96-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2200-103-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2200-336-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2200-356-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2916-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2916-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2916-177-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2916-44-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3840-148-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3840-141-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3840-147-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/3840-338-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/4424-337-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4424-134-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4424-127-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4424-339-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4424-341-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4528-29-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4528-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4528-30-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4528-23-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4528-140-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4664-342-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4664-175-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4664-178-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4664-169-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5628-90-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5628-334-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/5860-54-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/5860-48-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/5860-47-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5860-58-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/5860-60-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/6132-77-0x0000000000400000-0x0000000000711000-memory.dmp

Download

memory/6132-0-0x0000000000400000-0x0000000000711000-memory.dmp

Download

memory/6132-110-0x00000000040A0000-0x0000000004107000-memory.dmp

Download

memory/6132-105-0x00000000040A0000-0x0000000004107000-memory.dmp

Download

memory/6132-123-0x0000000000400000-0x0000000000711000-memory.dmp

Download

memory/6132-19-0x00000000031E0000-0x0000000003265000-memory.dmp

Download

memory/6132-9-0x0000000002CF0000-0x0000000002E39000-memory.dmp

Download

memory/6132-14-0x00000000031E0000-0x0000000003265000-memory.dmp

Download

memory/6132-2-0x0000000000D30000-0x0000000000D97000-memory.dmp

Download

memory/6132-6-0x0000000000D30000-0x0000000000D97000-memory.dmp

Download

memory/6132-8-0x0000000000D30000-0x0000000000D97000-memory.dmp

Download