stealc | 8d7b689b82c96ef823dfdf5cb8140ce630150936797bfed423bb7726b10cacbc

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.4MB
Sample260930-e585basz5r
SHA256 8d7b689b82c96ef823dfdf5cb8140ce630150936797bfed423bb7726b10cacbc
MD5 204fa83e8ac3b122d6613d0a8929a2d9
SHA1 635d9f5978e7040661160530f62d5e603e5eb99d
SHA512 90442ab752f7d44d908258132f58efaad09a73c2edc1de1831c9fc5db0ffe113d4415a60084a575b88fa0a956c7e361825da4fe03d5252029220f54ccf7574b9
SSDEEP 12288:vibwAEUmeF66je6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:+DF66je6nQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1036501353AE0D073E273207108D2D7B56BBEA9B19F61978B7B80177D5F343918A2934A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc ransomware spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral1/memory/4216-344-0x0000000000400000-0x000000000056E000-memory.dmp	family_stealc_v3

Executes dropped EXE 22 IoCs

pid	Process
1720	alg.exe
1524	DiagnosticsHub.StandardCollector.Service.exe
2212	fxssvc.exe
1520	elevation_service.exe
4436	elevation_service.exe
4316	maintenanceservice.exe
1952	msdtc.exe
4368	OSE.EXE
1116	PerceptionSimulationService.exe
2020	perfhost.exe
796	locator.exe
1916	SensorDataService.exe
4756	snmptrap.exe
3472	spectrum.exe
5056	ssh-agent.exe
2252	TieringEngineService.exe
3620	AgentService.exe
1872	vds.exe
3076	vssvc.exe
2284	wbengine.exe
4168	WmiApSrv.exe
3268	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e001270a5ef7726b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112140\java.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0e025c79450dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab9de4c79450dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005d8cd1c79450dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d859fdc69450dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014c048c89450dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000476d10c79450dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb7e42c79450dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003ca62ac79450dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d76451c99450dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe

Runs .reg file with regedit 1 IoCs

pid	Process
4900	regedit.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
1524	DiagnosticsHub.StandardCollector.Service.exe
1524	DiagnosticsHub.StandardCollector.Service.exe
1524	DiagnosticsHub.StandardCollector.Service.exe
1524	DiagnosticsHub.StandardCollector.Service.exe
1524	DiagnosticsHub.StandardCollector.Service.exe
1524	DiagnosticsHub.StandardCollector.Service.exe
1524	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeAuditPrivilege	2212	fxssvc.exe
Token: SeRestorePrivilege	2252	TieringEngineService.exe
Token: SeManageVolumePrivilege	2252	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3620	AgentService.exe
Token: SeBackupPrivilege	3076	vssvc.exe
Token: SeRestorePrivilege	3076	vssvc.exe
Token: SeAuditPrivilege	3076	vssvc.exe
Token: SeBackupPrivilege	2284	wbengine.exe
Token: SeRestorePrivilege	2284	wbengine.exe
Token: SeSecurityPrivilege	2284	wbengine.exe
Token: 33	3268	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe
Token: SeDebugPrivilege	4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	1524	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 4900	4216	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	88
PID 3268 wrote to memory of 4644	3268	SearchIndexer.exe	115
PID 3268 wrote to memory of 852	3268	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\SysWOW64\regedit.exe
  C:\Windows\regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\config.reg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:4900

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1720

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:8

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2212

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4436

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4316

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1952

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4368

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1116

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2020

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:796

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1916

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4756

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3472

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5056

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1964

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3620

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1872

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3076

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2284

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4168

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4644
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 89c351c2cd22dd42eb924eaa2be5e65007de556139c6dd654f1296f91dce908f
MD5 dd731b3eded8d9370060644953e4f922
SHA1 4d2ee34b57ffcb7087c7a1326811115bd26efbbf
SHA512 a91fedeafbd0716f4a51722d8737f8deff7b864a74278874857c878c2f8e1191bfcc6919917b336ad5befb3abee2fe2f1b594a6e6e7062af6852786c33361e49
SSDEEP 49152:pb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnBQ/lFTjN4:/3q6HjBFLm
TLSH
T1F8D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 8b84d47a9160c470518789657c99308ca54e09e04c4ce48428161ec4bd3a67fc
MD5 67a75d1fbebb7a12fdb0e1fc5702b545
SHA1 ab0e968a6e58d424fcd8811a76380039c617e90d
SHA512 2c724096f718999f47b46b20bf784097b539c2188e75ec9a9148c101c2ec91b323a8cb148aa2651a25a92ee00cd989b8607999d114a3384cde3feb77c6c8b816
SSDEEP 12288:41XLsswWkxy2lRq2czA+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:+XYfDtczA+nQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1C265F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 8bdc34ee4a8fd3f8c5ce385c0b2b44c29438a3a66f7fdc755d82118da392f097
MD5 e6efdc31a87903da260a7c21aca102ed
SHA1 ed0ef51d38f4ccb433c5a1af92e756e3619bbd2b
SHA512 81498f8722c0cb97adaa0aafe3b5cc3c7109a06e2644bdb213a6d72a2ad53fc32272b78e9fc8987b7f80a90785b93b1fd9df7abf75c47aa8bd8578a45833580d
SSDEEP 24576:i0Le5ji0hmxLrMZnQ/tbw/2Mkjy6Fr7g0o2:iPji0AloQ/lFTjN4
TLSH
T1F0859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 dc1a6b681d9392dae3d252beb42358f53ddbe1c43d4a4a5fa03d06b5d37aa9e2
MD5 952066d1e2adc574c782d09b5e94caaa
SHA1 48756a804419c70a97adc736358305bdb99342c3
SHA512 47fe60afeea14a936de9195b91e1112ab071aea413580f5e86342404b3b5a6c82c68fb111a90a6f262df8ab4fb2c5e410b96a6be9d6dd3c0b0eac56f8b6f63ec
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWE6q8wyuvnQ/tbw/2Mkjy6Fr7g0od:E/ezSC6vUzPvxHjysQ/lFTjN4
TLSH
T1FD755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8d9f0bd4229c0d89f46699f7b8a72c8fa5160e1bdca28e09ebb1aabe6ed5dfba
MD5 73d52ac2a3159d67e6d5be2655a94629
SHA1 09dd4b534671c27d74857f0fc6fbc9601536fae0
SHA512 a2d2605632df6ef9c54f511e0fd4d4f781d903a1b75bfd683bc0b513f27a4b9a18ceb57d6b109148e00da20f8ce1293c513e16dc156bb98681fc0d3f36d6e98c
SSDEEP 24576:7VbqPb88hv/l+66nQ/tbw/2Mkjy6Fr7g0oj:7VO88hXl+dQ/lFTjN4
TLSH
T1AE559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a0dddc1f1ac2293d3dd7d5f30cc92ef9d277672717b66ed4673cb784f0c95655
MD5 585db6bf4c61633e52d57e0053de6dff
SHA1 3fcfe3d21c2b56cb7c453b8f813adaeebcd9b64c
SHA512 3ebb69fde3a9e5a54786847f18caf01a41a417535c610e20cbe69f4cd7f698e99ecde1833d0b124dc21ec3546999458b06ebedadd82c4c9b2493198650df3df0
SSDEEP 12288:XzFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:XzlnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1465523696A24F897FF2B06B55C828482AB7B0EC1BFD4A74E6744322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 7f299e53626c99488ce1f9ee1d32a228ca952b4def0d76615d0a6c3250bbceed
MD5 17e3110529b0f92fe17843d00edb28ec
SHA1 2f8c869b12d125669d9ed58c594e4588e49a6823
SHA512 4aba8e01967c9c634958565f894f595f8cd0df13ee278058a9999189b696c4223b864ae3195f2196580af322014d70de75e428b98d3d74a1640926bff414f954
SSDEEP 12288:UeBNUbTVO86USGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:UJIUSnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T10875CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8ef5b07c998ac2d35e2b73b6ffed57087b6819d4ba46f7ac51e2abe9991b325b
MD5 8580b2fc7cb2be9f8ea6497aee1e1f13
SHA1 c506d998ceac1ba63e7bafb6aedde092bbfa4a38
SHA512 69ad995c23dac8dabd1b65e978d222dbcda1278a4d920e51dfd9eb2c6682b6ab808328637a1b5d13ae88218d0d8d3bf6cdbe2dcc8603a6d74d4e9c1b83ebca16
SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THo:sQvGAdlCEL8c/yRNw5CULm
TLSH
T15E267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 17f39eeceaa05e0b1123a076433daa8733ec4f19b5ef47bd8a974ca0243fdb24
MD5 5d73051368220a86cda21ecc2772059d
SHA1 20fdcc26eca3dec114e70f1bbd3b6fbe1c9e0f81
SHA512 fa2da73f82648e1260183494069e06ccabc5c50cdc69e5e2730abfd77f45a2808edda89dabe0eeb1eb4a1334dbe64dcc0c9b84eefe2c6204fb7a057715e82f93
SSDEEP 12288:nAwSfxL/2Dc39DLLmt0LDQewsAjYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgd:AQewsAjYnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1D175E031FE74E436C77F0DB61B22C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 365e08dc213174ebdb1b918d2b08871f07454ac7e1dfb95d6d1e0698757d830b
MD5 3a6cd89b20882c3fbb9fcd8f698ceab3
SHA1 e418a6fb760f4ce20b96e16bbef62644140942e0
SHA512 3c90428f2ee6df5c3b3f28b3d73cef388f515f414a3e6549cadab6620458242b4bb15c71f9e390865a1fcf15286985630ef4fc3848d4df003a06254c0abda2f0
SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHTL:VUEtQevvqc2W1cpV2EI32
TLSH
T10F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9d4a3237e25881eafe4dca70f9359a6466af093c7cd1589dbadd0948cd7773d0
MD5 89d601bdba81255f17fa91681583505c
SHA1 26cf3bd7c42dc0b86392c20f29fa2f2315408f2c
SHA512 133c367b7ce7c7cf66e5565fabe4546de21750affbdded8c72b2f4ddc466738c61f1d0e6479400b3c7022a2cd36fba3a33a8c075173e0bbcd4132b910f2006dd
SSDEEP 49152:9CbRquA/m2yL5zQfFiV+XenmE3/z4Q/lFTjN4:6oqtVjnmYLm
TLSH
T14FD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a958ddd1db7264c3c9ecba794db1ad059fa9b04ef46985dd1bd93620502dfbb1
MD5 d1e11194785078a269a6d9bdd9a1690d
SHA1 b2775136892f9a206aa622a6e6a88bcf30d7d544
SHA512 87366b51391bd3ae4d1a6fef5cded470977d573b3a6de68115bf6276b42c5531017f619ce02daa6d189bfeb9bef1dfe038f5777eca533edffa47bd87fae075e1
SSDEEP 24576:TAhGLJIFoiwtA5l7S53TnQ/tbw/2Mkjy6Fr7g0oT:TAMyFoiq5jQ/lFTjN4
TLSH
T13D35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 ae6c2db082ca42fea7625f3cfd259d9333eb5597cb0546d7ff9d25402f5b1a1a
MD5 46657e4c8e3ac5e8c82ce23a09361400
SHA1 337e34c10111ce0025ebbca48c3a1725938cdbd9
SHA512 eb3de63df9449e4d680d8108f713776d84360457258ccf360e9c9c993a6126658d9b3fbb7bc482cf7adf31154e8c9c14ade07b69c34c10c18a3d56dfbfb8b17a
SSDEEP 12288:imw5HEjsChN2BFgl0WDm+CvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM9:7wuHOWMnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T12165F14A36A45CF9EA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f66aa219d9d148a76e7869348fa36a732968156d83b3f88ab18294e80a2972ee
MD5 6bcb421413015c04d87c03400fc6488c
SHA1 6316058a50ad7b704df7c871bc3211a2f34510e5
SHA512 a8eb0820e3bbad891583b0823b661c23ac81175d2a7bc7f44ab5346e7b64dd8e8dc86e899ef09e1a010dcd93ad47853b9b000c3a5c40034ee071d19a3c2c6f7c
SSDEEP 12288:pXZ1IyIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:xZuxnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T17055126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 54db146414e0845e81a446ceaec02e91b1094e887f8db59a9aa630c52d2782ff
MD5 9bb5d5c6e4acf43191feee687a9545a4
SHA1 2cfea7a63b75027d1ebd7e95752df122bdc13f38
SHA512 d05508b5007d1a74bb1d7f240e115d2d0525cd55bd761575434d359e9ef7243925c39fcf1e27c20e60a125a35895a44834521114f87ce81635e927b88f3d4f48
SSDEEP 49152:bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uc:KQRQyi36YOcPQLvw2gAf+PN3hLm
TLSH
T13F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 194b71659d1c3e726629ad6584c45e7d71102163a107b2c69a42b82424e3dd01
MD5 af9f11b4c08ca3f71dca538f4d8b3d9a
SHA1 783daa52eab1a3dde483bfdfd83e238c18865fd6
SHA512 0b597c1e9f622ceedd70a15a3c2812a138bd2bb1e2b773f4db7f06141a7c345180e6162c620629783e0410d742f37a1177347ab783aabc6960069c37b9ea40e2
SSDEEP 49152:Bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uc:IQRQyi36YOcPQLvw2gAf+PN3hLm
TLSH
T1EE667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f03357d438a7ccdcb31a98d8dd4d3775737ee47e8f1f0fd48110f472085fb662
MD5 903477efba840d8f2703cdbf5404e4b5
SHA1 57e6d7af7b632cf43207937985c3d7ddd456ca0e
SHA512 0e19c3dc3e1575988e4f15e8e2a9206f00abf3cd7681b9e0871aac4cad606b0ca7bb2220eeecbd9eb338752f465809d4823d377333f5dae9ccf150f98f883f18
SSDEEP 24576:ywvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0BnQ/tbw/2Mkjy6g:M68Qg55nhheWu7PNU3/oQ/lFTjN4
TLSH
T1D4B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7817804ba118a44f9299573834eea78ddf0c1f43a7524cccfc791cd969f16744
MD5 6bf1bddd2b5cfee56a57412952ce1b4f
SHA1 68528b869eb7ba4ec921bde2ee6012f596790eef
SHA512 1731049ed0e133ba0afe83da23658c91d3b6c61cf1b87572e9cd372aa66ec9ec1e5199a040d96082379bdeda09f7c818a3bb8acfbb566cb5d1f2c29f4d7641b4
SSDEEP 49152:p3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99+:4y5112gYy5azzVvL69nLKnhZKLm
TLSH
T163167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 76ecad06ed7f258071a34f849dff05a7fa198a09b22bb92c094b6c99ab18e042
MD5 b36a3a554cb52164c2aa25bd88c4fb1a
SHA1 0db5fdfaae8494cabe9ffa8e18e3343ee698263c
SHA512 4112f9f843fc251f79c60a846224dfdf18d8605a27cfc9980031e2b23cb5860a173daa25db807c569be585475f938f5c477ca516840a6fa7a45eb87bb25ae2ef
SSDEEP 49152:yB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glOQ/lFTjN4:Au6JmVxd2dpLm
TLSH
T101D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 74ebaa6249cca285b811c2c9556b44f87fc9683c2c502b7394d6a169243167d3
MD5 59c4692da52b9088c38b1690e8d1af5d
SHA1 2497cfa0c4222ab96fa916f790e5e4c2f662de72
SHA512 2d7d361027f26e01403f990ff94c3e678d19bef9e67835237750a722641b885b61b5e79bb59fada51877ebda6b5722a5515a1a07e5ea66fea5d2fb7dccd58e5c
SSDEEP 49152:R1hpsNoJpF1A6UU44CwH7R4xyQ/lFTjN4:RmifPbRYLm
TLSH
T124B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e4454c5d3fe887c115ba6ce013450a6a24a912f5242fd23ad0b54766a552c3df
MD5 c88a6f5e388a885f2ec044e6b9215e98
SHA1 e27c57d337e741e0d86822d8358c14373cb1502d
SHA512 218e219ee5f2a50e3ecf9d1c6aa03820f8e07e019796e04566a6f1c6fb2ca8deb4c770e32fd2a67f7227136f4914e0099a349818856a354c4600f16bc71c381d
SSDEEP 49152:hSuZQIY0Be2KRRVtOnks6NMHqxQ/lFTjN4:v5dKTi61WLm
TLSH
T1B4C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5a6bcbffe0ab85824c497d0951b4fa4b018e65bb30f286572a2db86ec86c65a5
MD5 12c8dc103012519f5b36228501408572
SHA1 77d1935b7db60aab9fa9141619220ee057414b28
SHA512 14336efc924e0c28de86d16a9687e2c04d5aa3c60bf55a4cb4f0a6ed59fe74d5707c2af9906b108ebd2b7913185d89a940053d2f6ef8687e20c96d9ecf0ab032
SSDEEP 49152:ChtSn8EApI0figngiDn0AP5w+Q/lFTjN4:jX2iyphMLm
TLSH
T17A95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 7443e7bdc301f0059be01ca0f21a5d09ed4385cf8869f682e98342b105f637f6
MD5 53fe08ccefc4916bd030fb4c4961af35
SHA1 179cfc45f693bc7e8facf7f9e605af91364b3ee6
SHA512 17a33603d0872c12faee9c702551346f003adb930ef9de5fcd79fb58195c4200c0f2a222ae8afdfbef7f0e1bfda3c1c927848769ce82e2e687bdd8583bde3ecc
SSDEEP 12288:99GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:9dnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1485523697964F98BFB1706F18C828182A77F0EC6BFD1A38F77481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 aaa810f8564d2e907a73f217d035981e3c02b6fbec7600be2e5d75ba30784512
MD5 c7253a64d2e83b5dfafbd4d418f36651
SHA1 2029bc94cb903f22f01095e18853d7731946b1a2
SHA512 b8d600231630934f4dd008feb05679c9ba999513393cbe03ae9d4b2b953ec4754e5f15ad96219370f1c29cc2ee0549818a8c6f997cfa3d74659cfa5d3d74b60e
SSDEEP 12288:n0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:nUnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1DA5523797965F98BFB1706F14C828182973B0EC6BFD1A38F77481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c10d0522e624c4c9590476ba8d03f981a8c5e3c4de52cb141f47e2b7bb33fabb
MD5 ca1b8ac869a2ee22deb50e7fa82df43b
SHA1 82f09d0fedcb267b02131980e9eb2149c211937d
SHA512 3473098b161f68895d82f478142c4a0120c0d149d085cd0344e6651dc9cec90196f0e122e8b6aaab3403e0923eef3b4379134e0024d66b6d08a4060fcfa4d953
SSDEEP 12288:2KGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:2KnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1395523697965F98BFA1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 4cdeb94a6a28a4ca417c63505e8f991121ab918642f9221681b9bda9a43a68cd
MD5 c5c1145dcf1ed9327ce34ea304b382f6
SHA1 d316aa8dfdd817a9b9dcf9b336eb148e57d0cd12
SHA512 9a8e36802aa2b4d78df3bc94b19bfcdb0d2064ae17ef611064567715c12ba839f4f4066c457635c00b2b62100d3051ede1158a581908f7bdab53b11ca252203c
SSDEEP 12288:QVDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:ynQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1DB5523693A69F4C7FD2742B4CC928142E77B3DC5BBA1A3CF6B04111D4E793D41AA5B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 b6f37ee50fa9ed68d386779fa8df7e859c504c5220e9ae8b0a1b20f31e7cca27
MD5 247514d34e831bea4aa029e2f67b0b4f
SHA1 13cabd468e14aa06acad3c0d144f5b5f7e94bff4
SHA512 3009ec26a94843ad3d905fbbe7a647dc75e69a8f65e4010a54df3c418aee57454db437a91587c9c6bc4ee8497faa22ce6dcec8865737feb8a47b0601c3d564ad
SSDEEP 12288:mLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:m7nQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1F15523697965F98BFA1706F14C838182AB7B0EC7BFD1A38F77481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a569fe255451734956a20ead9e7780f63aac7c76483a672bd5f61055596a9041
MD5 c6eab862318f0dc7773c0b9060b0a8c6
SHA1 24370d9fcb5177031d87c04b47d8109afac20828
SHA512 467800471eb3914dc9aaad09e746b6d51c17db6d2f95a5b8e8d67bf3ac763afb0196c27c514babcd5b524dd401baf7c0d693f8e365af415bd950ef03875fc3ca
SSDEEP 12288:8QGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:8wnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1085523697964F99BFB2706F14C828182973F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 9f02f42abfd13b29b47e9b15b69d6f7b90aa1fe4a260692da6861f72f926c6b4
MD5 96e782ba3af109be60d23fa5edeb5065
SHA1 1941ddc29df4061648ac1755c73203d4a27d425b
SHA512 70cd01a7a8be377cc40f00bec6bd264c111fdfedbc145b9002a943fdaf45c47f77c079164ea425563c074465f0507ea31d6ecde2da80e3ee398e6f87ebe67ae2
SSDEEP 12288:acGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:acnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1CB5523797964F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 e8acd6c5a5ae59249c1a0646689370fa38f432cddb32406dd547ff5df4dea677
MD5 8f7dbe48ad60f63aa281b174c874c3b8
SHA1 7fda916086df0e1c5c308c569898de6d8580ff5b
SHA512 d76ff2510c206e5bd7e4459b4eb52c121811b1c3f43c60c5ccc47943603660fb276dcf9cb2f3d1c65680f092e71ce9d4ddc0fc5c548405918ae880b02f49ad00
SSDEEP 12288:diZwbDzzFEoS2cPvyUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:gZM3zFVSO0nQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1E07501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 eb7a57347bc357ac5a87bf64ce3011eae1282a9bade377a09e1a9248985f3906
MD5 ba89976131f3b3862f1e4c2fb7896f4c
SHA1 c237b2f5aa9a791b2aa44da95462b923093da2f3
SHA512 e31d855883862ac181d6a735a12db4dfabc364719b1ee9a9ec0abede45b7aa8f4c77c5adfb45883dfb2ab2afeefbe124609f132dceb0faa472ee90ccf3a1e082
SSDEEP 12288:HRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:HhnQ/tbw/2Mkjy6Fr7g0og
TLSH
T1835523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ff37cb229332b856973ae18f0e98086ddda2c1493e8d677b9ab65b9674b9ae7b
MD5 c9e1ef17594c2721c089bfedf839db13
SHA1 9bcadcd1c1aa275b627b61e5b1d518de75914cd9
SHA512 a49dfd927d38d4d305ad042c54742aa73daff38e48b43b02487f16450fec2146ec69c8a91f2cc562dace1cd94a02abb3f83a4b0e4b0188539c1e4a4522dfee2e
SSDEEP 12288:B1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:BVnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T10F5523697964F98BFA1706F54C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 abfd36efc66d08e067bec0edafde55e674e59191b5a1f1810ad8da0cc8c5c09c
MD5 32b3c480c0005ace0238a8cbe518cc69
SHA1 a6f39c05f06970318799c9f901a8861b2238a194
SHA512 39e482a5ee79835c291f3561ca32350b57815fa12f477fa01a8fb745cb122cdfacd517eb536e1e79a9707b20c111116e48931de78e9e6a617991f94596a5ffce
SSDEEP 12288:HyPz5L8IGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:qzyInQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1D965021B77A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 aadcb5f38ea820d142a7ea102b5d5c23bd37c7ccadc33670a082df9eb3c2a3a9
MD5 f8a91e0114b1c242ef71c2337f603d84
SHA1 fda28aaadc93e24530791f1eb431a9e8cac4ec5f
SHA512 d8d7dbae9d969f9fcfe913075ecc13d7309ddc633ccf299b1eff848b95b16c933cd9d0064d3ef5c98743b8d00d5e4fdd8387711b2313852784e8ea4afad52c1b
SSDEEP 12288:+RGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:+hnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T15B5523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 9b62933f684a0c0d4a1f65c9cfcd851a5ca5d928b5c7c3e8549c90cca6fcc09b
MD5 d501cc185dfdd839beb6f7319042207d
SHA1 cda6c84e1aea41811d63e9e0afa856d5a75280ae
SHA512 0ba7c8d1c6aa58fc3d95776c478c95bbcafb52bc770ad7d6598ca35ed8ec652df0c6de813dd4947992e5b58f3c8152391c6e13c22ab056feefac6e107f4ff23d
SSDEEP 12288:GRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:GhnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1715523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 deb39b698162be8147c7c0efd2134086ba20f9747fd5b563f7b9c129a113a1b9
MD5 23db5f4e2e115d82893f483665f8af3f
SHA1 0067de384b6ac44f600c40d8b66c51057a50483e
SHA512 c7f1c05b2a20df1371404c28642aa29aff5d5218c44ee8dbbdcc273baba7d65088059d28954a4977dcb6f265b9d946a91001b7491275d232122ea865c2a04884
SSDEEP 12288:PyPz5L8IGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:izyInQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1A465021777A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 84bf3268d97836afa72ca3ce6c2577943b2d36db7cc4768d46d6405370741f02
MD5 2b63279f5b79cf7379a759f4ebab9b16
SHA1 81c10f1701856808c5cb5bdf28d9f6f5efb9dfa6
SHA512 c64c9a97ad7107721542f834e205ccde8cd1d2190eb0039e0300553fa4b13d359900575707e0fcb4387a6b6e427d7b85b82141daa40846e740d78ba6e725a260
SSDEEP 24576:ZcP4mcvIjkGOxhKP2l71nNKbrh/8KBpnQ/tbw/2Mkjy6Fr7g0os:uP4m4IpOO67W8KfQ/lFTjN4
TLSH
T14165AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 d4720ad4abb9107489732ff6ea66d5fc0e2aca72157f165b04aa3f133d337789
MD5 a10ee20e8624210118800fbba2f500f4
SHA1 a5083373e0b79331fa70d84e41f98d6f480ce6b0
SHA512 fc0215807e6193e4cf159f67c2fce68f705bcfbf5f0ec917c2fa8b041745920b38698fa90403703cdf39adaaa505c369293dcce7df51ec21d497f7a06112aece
SSDEEP 12288:FssfhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:lxnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T12E65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 83cb3279c5e8685ff1739d35182f7ab03103a99e6a491794f6efab18d93c63e1
MD5 8f5c884343b0cd2e949f046b9ff3da16
SHA1 3791be9dc9a79f3f3e322bd3df4ed10c8976dd14
SHA512 02f9b6925ee9555975ca2c9a87f0fec5e4796c8641db8d98c6aa223f2bf300123ab0c46766bcbc6541b98fa487855fb0f1f32b07acea964cbb87579e941b0f08
SSDEEP 12288:+BGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:+RnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1CA552329A768F94BFA3B16B05892C151673F0EC5BF90D38FBB08222D957C3D40EA6745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 4883d8b86175385f34667e8a247bc8e25311fbcea1f188f6cadba5a4cd736c2c
MD5 ef13a1e91a2cec17c130059cb4e574b2
SHA1 331b994a9402a7a8836b77a931812b1d6a6162dc
SHA512 3e9e787051db72baa9314e6b11d3c5ba274ae29ec2a47fc75fb39c0f02282bdc76350425bc476a2e3b9561efcad485fcce9a516c9610e1e51cf09714ec290994
SSDEEP 49152:Wa0h2GEkuAe73q3pp46zwwQ7Q/lFTjN4:Wa0hNYG4JwTLm
TLSH
T1CE859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 adb256fee2b820d6cc32e68f08abe780a2e9dfb85f2b5d8152be95cab3b56ca8
MD5 3dae421f6d3b0be55b7bb8924476bc96
SHA1 9ef8c6ccf93e8fa2d812a7b7f6f3483ba2148e66
SHA512 a432bd7cb98449be971c3916b54c94c1744969adf6d0b4e24cf50b540c8c7c99a628747f7dedafc6df6b6b6cdd1785a526e1163b723c8e791d02a3776d7c9ba0
SSDEEP 12288:BhbHjfXEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:BhbHjPknQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1A955027E26AC30DAF63692BD88928546D7327C552B11A3DF2381427D4F3BBE40D79B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 c44368bb452a706571afc7e40cd5057c2ff428ba4539206aacd5964fc056daa1
MD5 cde663001f3659bc25d7c2a051c89ab1
SHA1 419a58272955413460a7e8b615f574b94371ca1b
SHA512 35d7d0a0aec4ad2dac719a70893c5ac30cfd2bedb85d6d6461987d3fa3c62e415f6f9b4166b259fc36a043d99a235d8ec34319d17eb8c0c23060bdd2d79a5719
SSDEEP 24576:x3YgnJcRTk4yti+R5dBR/MnQ/tbw/2Mkjy6Fr7g0o8:xIgnaTk46pBR/MQ/lFTjN4
TLSH
T17045BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 c4617fdcd222c1231a982d8c0dbf3d837ee4516ca5ad71762359277e42f17038
MD5 8fd1f3b0267edce390291d64941e3114
SHA1 994a1be53faebc680f7d544c691fdafa893da8a1
SHA512 4d3d4274677303915726866ce6dfec2c51826830a2193c046268ce4ef1272dada10d3858008614e2ff950573b949fa8cace74e54cd52535249d295b77acc1b4e
SSDEEP 12288:ylGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:yFnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1085523697614F98BFA2B06F54C838146673B0EC17F91A3CF7B482229967D3D41AF6780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 01b369602a26bf6c4d7c9615ad5b49997758496aec85827a2c798b1044815dd7
MD5 9bc12fa99e92b38a93eb7763ef0b5058
SHA1 241d67d02492d4f4f8060c34e4c0f0cb78682432
SHA512 fbbed5ff1407afed498dd7b4407ca80d12aa5359ec43d51d974e41c18a80c693486cccdd6dfbc8a41a0445150ef6df28715451ce198967bf73f66781e2839adb
SSDEEP 12288:nOb4A4LWOsvAYFT+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:IwL3UT+nQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1A775F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 56033c71be86f7a9b1f9454d19ca3c5a4ba9428875e490142f114b79c5490617
MD5 661f3b695d2397c82c075f270361a05d
SHA1 40c3b30a66ce3d7e8b4a1f55adb3d41c4a9a9351
SHA512 9cd443a33192870a09993995cf4e1dedf4eff4ed4f8d0dd13a3bd71bf293a365e44a0d663645932ce1b13daf42f68cdb17c3d27cc7d309f4b2536cb3cfe8c5c8
SSDEEP 12288:mpFtCOyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:TOynQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1AA55022D36EC60E6E536527C89838209D37278921B6253DF0780817E5F7BBF85C7AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 213b5281e8b31989e2796222917cef0b6f3f3e1999e2bc0e619b8ceab1f117cd
MD5 068d2a5cbaf5def62b46287595748fc5
SHA1 fadc8ef2b00477a2e93a69cedda5a7c737866c6e
SHA512 184ab3c22c45c473d0813fa679da2c3c422b8ea12d77c5d87e94c3524c538a3e09ea31d039fda9158cda20c7a2464015f377d97e455c647cc827624b69f8516e
SSDEEP 24576:p7NM9YqZqmWMUkPjZM48Mv6bEhshnQ/tbw/2Mkjy6Fr7g0o3:p7cBWMpPjN8DbEhEQ/lFTjN4
TLSH
T11A659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 da4791aeb4c1fbdd33024fac0e2719425e225e133a2d7105c8f77cd78a1d7ff3
MD5 33f69faadf39e59afc892a67faffda88
SHA1 f90c0323fe8689d21a4c076b89ca17c7470c38ba
SHA512 3faee0be99c550e7b794b20bdb1555682f9f0674b4104e19e11f0678a773f5db809a60db4d02d95c07288d7094282c0d52e06a9b877fbfe26c7b8c79f92c56a8
SSDEEP 24576:wW6BApg2YuyuNDYTabvcdvNYf8km13nQ/tbw/2Mkjy6Fr7g0o7:wF2YuHNETovAvNYf8kmBQ/lFTjN4
TLSH
T119857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 ef4d9e9912312f25014127391381be5aca8f18e079d1f12df1c6abf63a130df3
MD5 dffd53342aee85f0e6e41144c32da931
SHA1 04ad5da0a2840514300ea931501c80062fa66342
SHA512 ee61cb53f70261f50a144118bf6c4ff04ba1ec687bf07a8d341f4fd4fee11924f6e39dbd53d90e053342a10dc967a03edfa031432dd2c671f336f757a5884064
SSDEEP 24576:nAFs06+Omlf3NXEbTo2nQ/tbw/2Mkjy6Fr7g0o9:AFs060lVXubQ/lFTjN4
TLSH
T13F65AF2F66AC00D5D07ED17D8997C91AF7B1746307256ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 c9ff54fc1bfc7f229067ddb16942bb046517144d0d5e90934a42530ac43bbd4a
MD5 5555a80261f692a5986c0c7e92169426
SHA1 86ea565349d4af2f2c396eec6f8da9f687977dff
SHA512 9d66aad4cb5d31a5739509fc0ec458f782c21d331648cc610429ee10264f73bec24ab19f5aac5bfddfe4b33253231a8caf2106917eb6a691043916345b88bd75
SSDEEP 12288:8CJnJ5D3VkrqzxxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:BJnJ5D3WabnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T13575D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 2697f14bd7bf8e589110aab44f530d9c7825697a0c4118a4c7afc14e13810840
MD5 08c32fdb6fa8ac54fdbe83cca1c64611
SHA1 e09f7fa6ede54bbde35c827f13daae694538d880
SHA512 ced9fea2631a913ee4ba7648cb9936686cd885e1aace832c58fd6886ddd21453043e2358408be7f268dff5915e678500b9969ba959537ceaab65b86a3cf6d50d
SSDEEP 24576:oEPghm6/7IIXdwcXrif7qQncjlP65i3VuMnQ/tbw/2Mkjy6Fr7g0ou:Hg06DIKdwc+eQnSt65aVdQ/lFTjN4
TLSH
T14B955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 ad5cd87722051971f5fbd14adbd851f307d2a153034f717872696083b45ed96d
MD5 00e4b68ee0091713d4a2f389f81beda0
SHA1 72216011e539647bf8d60fa2a5abfb13912c57eb
SHA512 9e5898f17a45eadfc57a94c02eda55aec14a47adcf4be16f1b2ebf7c14cfbe2660f88db655b8e176ae1cf8b4943b5097cf416721b6affcb75d47a3662b24a961
SSDEEP 12288:2EP3RSvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:1SPnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T19655126D37ACB0DAE52A517D88918145D373F4A16B5267EF2680823D8F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 2ad61c7d6b480cdbb43eeed709258115503d6ead5c19d113f8dc96c4cd39b442
MD5 2acf705bc79f9e587405573497f3f3e9
SHA1 a0fcefd64857edc2e70c1cf0f70494810c4f97ac
SHA512 4a7105c2bf6d530fd97cb8bf52d057e8dceae963e1e0f6be53048fc9d755ac452c93f9b3a9176a5ac8e6f93d491fa132db9b1f90c06b0c41d5408efbb81ce4d1
SSDEEP 12288:Kjky0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:KIyUnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T18F6512186398F4CAFA7A06788DA381919B367C506F2193DF6280F23E9F3A3D45D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 9b6120b6ef9f63e9c8800933725018fa2a0637f57e5cbd47aa3a1b8b2f8cbd16
MD5 760eb038293b5007427d4e1f8a29a6c8
SHA1 f0e9e902dbc9eb84fe9667a891f15b0738e81687
SHA512 d8b0bc4046d3ac705747ed29bec7c24eef7fa5196c2bdceb465e37cd3edf39eee2b1bcd93f7a66560f7307e8607b0afb3968620faeb8bd3f7f3f7c75f7cd6a95
SSDEEP 12288:20iGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:hinQ/tbw/2Mkjy6Fr7g0ot
TLSH
T11C55236C2664F89BFE2706F448928542973B09D17F9163EF36886239CB7D3D416B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 9c60b395027bdd368675c1ea8362c8d4afe15f3e584b8aeb3bb9e27fbab5ac55
MD5 ec5eedfeffb946f95f9a4b650d6c7d7e
SHA1 7f25396c8670fed022c1e7b87e02858a30ed48a0
SHA512 adc89678ce997bdd71339bd1d57b275457bfa0b95c9909a815666d2ef6e5e75de0eb8f761b86bd200ba66b5ba546e46e107d363789273739cd1e0dce77994e35
SSDEEP 24576:aQ9MxZKdcz9dw35nQ/tbw/2Mkjy6Fr7g0o/:aVKZ5Q/lFTjN4
TLSH
T1B7558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 bbd1191cdbdf8a05b176f0fd04b421746248fa275a7cec33b9b4f7529dc8e4a6
MD5 f0f6d37a1c56ae0c021fef422078d384
SHA1 ce5dadf17dd2f894c371d6eacb5f6f4ac7bd5330
SHA512 779738214d0981e1084c864910b26aa90e268ea7026f61c37e07e06f4c9322a444bd570524dee5eb6cffe3c1705229013f4204bd42105996c674abe141c5eeaa
SSDEEP 12288:3yoKo20Rple9pYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:3yocSApYnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1B965E01FBB6990A2E136813C88818745E773B4706B6263CB6691C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 6180898b2264dc43681cf111b0cb6b9abbc7223c8f3b83f1135ccdb8fae363a2
MD5 068d6c137a3940d0cfd406cd96517d07
SHA1 b1a3ffccbefa2d23c1a4aa97b96f2ec49bbee48c
SHA512 f52ff4cec6729fc279d83135cd7a45ea56a9d99ce65b1784ab8077c8b028da1fa72bc5519c1dea573cc6d03e9761e6683e6fce018b1dc246d41bf00d0aa9bde2
SSDEEP 49152:wWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKYQ/lFTjN4:i0zuNIZLm
TLSH
T13DA57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 461e1cc20ca6e2165f7555668ab986b8dfb1c5e716b14a0755a81802361a18a4
MD5 86dba54c71c3b1bc0de8c9d082978bb9
SHA1 3a70b48037f2ca721d44bb727c80e4a1b455eab1
SHA512 94c0a4c3b054a2565b900b8cd8bcf125d25b41406b29c72c6ff523a560577f35f384d3e23fb7ad7487f570d96d01193714270c995b598ff62da9abc62fdb056b
SSDEEP 24576:O1QT7EcpfxR+N5AWAz3ooiYtjMqbPnQ/tbw/2Mkjy6Fr7g0oM:DTDxR+N5YzTfjMSQ/lFTjN4
TLSH
T18955B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 ee747514a9ffb6d666e0d86d216eb9899c1449a9f2d982aaf4d418e6a2fd7f1d
MD5 3d68597de2fbaa6a365ce1c763c4bca7
SHA1 d965b2a8bb9cc4b6601b46d3646b831b26feab78
SHA512 f20bdbbd4fafacb045e2c4ec8af0fd8d7c77e00da9c83422fd49300da26635c89dfb0788f2b3f36d832ecfb4dc092e9f32862b0406064a83647582a250ce8727
SSDEEP 24576:YTMdOz0FFS+1mSLznQ/tbw/2Mkjy6Fr7g0o8:w0K+1mSLzQ/lFTjN4
TLSH
T12B75E17E636D14E5E53BC27D9A438906E67334620321A6DB0690C17D2F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 cf80ec2d05d1b83c280c1908c6e6b98953d4d047720a2cd4de068880c6d83eb0
MD5 04722fe3118dfb54c4adea0dd5315545
SHA1 f5f3bb7a9c43f78dfdb4b434c439d27e4837a931
SHA512 eab6686e8274c8353729c2c254af312c48f565b7bbc5ba351bddf80239ed692d4b0503e4334cd02cd37d1888e718924644a3f3ed0e3dc78128e022cee96e5519
SSDEEP 12288:64T+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:5+nQ/tbw/2Mkjy6Fr7g0om
TLSH
T12E55122D23E8B4DAF93752B48962414697327CA2276167FF36C4C23E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/796-286-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/852-364-0x000002B2DCD40000-0x000002B2DCD50000-memory.dmp

Download

memory/852-360-0x000002B2DCD40000-0x000002B2DCD50000-memory.dmp

Download

memory/852-358-0x000002B2DCD40000-0x000002B2DCD50000-memory.dmp

Download

memory/852-374-0x000002B2DA250000-0x000002B2DC127000-memory.dmp

Download

memory/852-363-0x000002B2DCD40000-0x000002B2DCD50000-memory.dmp

Download

memory/852-432-0x000002B2DA250000-0x000002B2DC127000-memory.dmp

Download

memory/852-357-0x000002B2DCD40000-0x000002B2DCD50000-memory.dmp

Download

memory/852-366-0x000002B2DCD40000-0x000002B2DCD50000-memory.dmp

Download

memory/852-367-0x000002B2DCD40000-0x000002B2DCD50000-memory.dmp

Download

memory/852-356-0x000002B2DCD40000-0x000002B2DCD50000-memory.dmp

Download

memory/852-370-0x000002B2DCD40000-0x000002B2DCD50000-memory.dmp

Download

memory/852-371-0x000002B2DCD40000-0x000002B2DCD50000-memory.dmp

Download

memory/852-369-0x000002B2DCD40000-0x000002B2DCD50000-memory.dmp

Download

memory/852-368-0x000002B2DCD40000-0x000002B2DCD50000-memory.dmp

Download

memory/852-365-0x000002B2DCD40000-0x000002B2DCD50000-memory.dmp

Download

memory/852-362-0x000002B2DCD40000-0x000002B2DCD50000-memory.dmp

Download

memory/852-359-0x000002B2DCD40000-0x000002B2DCD50000-memory.dmp

Download

memory/852-361-0x000002B2DCD40000-0x000002B2DCD50000-memory.dmp

Download

memory/1116-284-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/1116-87-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/1116-81-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/1520-38-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/1520-32-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/1520-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1520-351-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1524-350-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/1524-25-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/1524-17-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/1524-16-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/1720-14-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/1720-349-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/1872-292-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1916-346-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1916-287-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1952-281-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/2020-285-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2020-99-0x00000000005D0000-0x0000000000636000-memory.dmp

Download

memory/2020-94-0x00000000005D0000-0x0000000000636000-memory.dmp

Download

memory/2212-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2212-67-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2252-291-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/2284-294-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3076-293-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3268-263-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3268-296-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3268-372-0x000000000E410000-0x000000000E418000-memory.dmp

Download

memory/3268-347-0x000000000CDA0000-0x000000000CDA8000-memory.dmp

Download

memory/3268-353-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3268-179-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3268-163-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3472-289-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3472-116-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3472-110-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3620-134-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4168-295-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4168-352-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4216-8-0x00000000007F0000-0x0000000000856000-memory.dmp

Download

memory/4216-0-0x0000000000400000-0x000000000056E000-memory.dmp

Download

memory/4216-344-0x0000000000400000-0x000000000056E000-memory.dmp

Download

memory/4216-2-0x00000000007F0000-0x0000000000856000-memory.dmp

Download

memory/4316-53-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4316-59-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4316-65-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4316-63-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4368-77-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/4368-71-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/4368-297-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4436-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4436-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4436-298-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4756-288-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/5056-121-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/5056-290-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5056-127-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download