stealc | 8d7b689b82c96ef823dfdf5cb8140ce630150936797bfed423bb7726b10cacbc

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.4MB
Sample260930-e585basz5r
SHA256 8d7b689b82c96ef823dfdf5cb8140ce630150936797bfed423bb7726b10cacbc
MD5 204fa83e8ac3b122d6613d0a8929a2d9
SHA1 635d9f5978e7040661160530f62d5e603e5eb99d
SHA512 90442ab752f7d44d908258132f58efaad09a73c2edc1de1831c9fc5db0ffe113d4415a60084a575b88fa0a956c7e361825da4fe03d5252029220f54ccf7574b9
SSDEEP 12288:vibwAEUmeF66je6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:+DF66je6nQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1036501353AE0D073E273207108D2D7B56BBEA9B19F61978B7B80177D5F343918A2934A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/852-86-0x0000000000400000-0x000000000056E000-memory.dmp	family_stealc_v3

Executes dropped EXE 11 IoCs

pid	Process
4388	elevation_service.exe
2020	elevation_service.exe
1180	maintenanceservice.exe
3384	OSE.EXE
1692	PerceptionSimulationService.exe
4228	perfhost.exe
2372	ReFsDedupSvc.exe
5208	SensorDataService.exe
700	ssh-agent.exe
2656	AgentService.exe
5416	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
	\??\F:\	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c162088131e6882f.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\javaw.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000422bd7c29450dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000003fe75fc39450dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d6bbf8049550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002735eec39450dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007209cf049550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe

Runs .reg file with regedit 1 IoCs

pid	Process
3792	regedit.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4388	elevation_service.exe
4388	elevation_service.exe
4388	elevation_service.exe
4388	elevation_service.exe
4388	elevation_service.exe
4388	elevation_service.exe
4388	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeAssignPrimaryTokenPrivilege	2656	AgentService.exe
Token: 33	5416	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5416	SearchIndexer.exe
Token: SeBackupPrivilege	2372	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2372	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2372	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2372	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2372	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2372	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2372	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2372	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2372	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2372	ReFsDedupSvc.exe
Token: SeDebugPrivilege	852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	4388	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 3792	852	2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	91
PID 5416 wrote to memory of 4132	5416	SearchIndexer.exe	103
PID 5416 wrote to memory of 2480	5416	SearchIndexer.exe	104
PID 5416 wrote to memory of 2036	5416	SearchIndexer.exe	105
PID 5416 wrote to memory of 5788	5416	SearchIndexer.exe	106
PID 5416 wrote to memory of 1228	5416	SearchIndexer.exe	108
PID 5416 wrote to memory of 3012	5416	SearchIndexer.exe	109
PID 5416 wrote to memory of 6100	5416	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_204fa83e8ac3b122d6613d0a8929a2d9_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\SysWOW64\regedit.exe
  C:\Windows\regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\config.reg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:3792

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2020

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1180

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3384

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1692

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4228

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2372

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5208

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:700

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2656

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5416
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4132
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2480
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2812 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2036
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2944 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5788
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1228
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2812 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3012
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2944 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 08b910765749f82bc44af30465512d45ebeed2238d8b67e841e6421f871836ba
MD5 aa88162b2933d9f8ab9f6f4a58d7619e
SHA1 23be994eaa1619b93c36ad8d69d2ffdd6fb4f4ab
SHA512 ba75af9aa5dd99862a75c078d657a75e9fb9f2bbc8017ea69ff3ec53413b579b97024f9d1ed798d35ec5af457617edb5e0705703c6e4a774f56bd287817c54f9
SSDEEP 49152:qb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnCQ/lFTjN4:c3q6HjBSLm
TLSH
T1B1D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 7d6e0df29f04fc94ee79beeb6553bc15e6ada7a47a154f0eaa0b5551e1288591
MD5 5e9963cd33e9f3e054410708fc336329
SHA1 1eabd6a5db07b13ef84e27449c96a3053ce0910c
SHA512 7c31443c1ec17781e7e56a95369a2f3aa6fedc8295c1856be788a81e1c2b50403ffba5e5e8d8378301e8ef4cc4e8ee8b493e325493db9bc1c48848b9d0445c93
SSDEEP 12288:N1XLsswWkxy2lRq2czABGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:jXYfDtczARnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1D265F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 9140d2854c8965afba84b8531d0fcb682e18ba6b0cab276d4b99ff84269cf4d9
MD5 fcbf01aa602010ebe8dace5e6d2bc094
SHA1 d7efbd04aaa37895dcf256e83cac04ad59e643f3
SHA512 2409155a68b1a6217c61a2be379c6ec29a23bfd59d59c3e757abadeef5b58e9c316cbc6f0a9388ccc8497fc2e70b694eb7400f5d4fc29489860704663cf30434
SSDEEP 24576:J0Le5ji0hmxLrManQ/tbw/2Mkjy6Fr7g0oZ:JPji0AljQ/lFTjN4
TLSH
T1C2859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6aa846d7d68d4f4e72d2406ddfa569956cdd3b95f96241126de28918d0bc7c41
MD5 70a254418accc98a07731644a9066542
SHA1 708774eb5b5a3e15e326bb64d2e6dcca283c4b44
SHA512 e1f8690dd003f25e932975cc691c14e2177cc1cf5c674debc88f3a80ec2add346d88da5dbcca35bbb473e0c9d44544d0ae6b4328bd3be6a16e34fcb231985e09
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWE6q8wyuYnQ/tbw/2Mkjy6Fr7g0o+:m/ezSC6vUzPvxHjyXQ/lFTjN4
TLSH
T1B6755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 af6f0213b8be0e3b79d4154707cd62fa4be83384c66bc96690c2d2c157a8adc4
MD5 b8d4d6d357da8a079d26d4d0e1209514
SHA1 5c2366e4a7597d9596dbefee7710a0ba33bbd38d
SHA512 5c27b9db365363ed3d2f03a9d14c3a240b061790f799eed59ce7e22cd095bda8400eadda19fbd42b3f3871e83fbebf6f06895e317eda8f566b7caf642fa87b3b
SSDEEP 24576:4VbqPb88hv/l+6NnQ/tbw/2Mkjy6Fr7g0o0:4VO88hXl++Q/lFTjN4
TLSH
T14C559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 95ef7f9ffe2b8e639405e3561db4572537ed14e7ad4fad0bb73cd6b4f2f1dac4
MD5 0bb824cfda4c8ed97b01ae4f306a38b9
SHA1 0c3073d5c2a17a67ceaa181e1933c921ff237469
SHA512 a65608a900a39cab20a3aa32f3e40921fbdd02858389f1f8cbd87b9382894902c73010a22ca4082a45ae9b277afa62201eb92cecea1d3792d668cf4de2264681
SSDEEP 12288:ozmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:ozGnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T13D5523796A24F897FF2B06B15C8284826B7B0EC1BFD4AB4E7744322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 0555b19180f42329e4293d707d208a94645cf9c2d7ca561488faf71fdd067ad4
MD5 28a1b18769787ce2187243b802dca92c
SHA1 781137736d39189d2510a848fbd1776b5a634497
SHA512 c1a8083bc784f2ae6886f691afa1fdd5b4e682175b83376623c6bb004804db2a79e5d1328e5c7499e6e02254d480eb2c4b0fcfa70d1f945832b5dd8c9305d169
SSDEEP 12288:0eBNUbTVO86UlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:0JIUFnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T13675CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c94748e9c950c39282912bb56a088564ea923440cdd1559ffe38f99503a43d09
MD5 f45606302ec4ec6f51b276bd8e0bd402
SHA1 2e3a8b32d99c917e0bff94b1033ab6d03b113088
SHA512 14835e7b208693ef2f730f37dc0e3f9108605f2b6019590b50de2da934e898aaaea823b1b833d67337186e8b79c3a51e3673d7b179d5c373f5577bb94901a8d3
SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH9:WQvGAdlCEL8c/yRNw5CrLm
TLSH
T1CD267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 26f7d01e2cc16c91dd09fb109be42e677298d00115fd3b5201f1fe370d0bfeb1
MD5 8fc4a19ce07bc6b9266f63f83d2c02e0
SHA1 5161977c685ab96f996ea90a4a26c8e427e7ce5a
SHA512 26c7798b44c49766338648673ef96fbf1bd4449d63543f639e80c22f06c6924d34e967e8d44d6f17f9ba0695e7deb72c8312c71f5866ede488aeefc5e88e7823
SSDEEP 12288:/AwSfxL/2Dc39DLLmt0LDQewsAjjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgJ:IQewsAjTnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T19775E031FE74E436C77F0DB21B22C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 81c608c34c2fcd41614d0aa22119f6b726058b3b596ae638b5ea6a63617ba5dc
MD5 2e263efa179ab2cc3e9c7985e2d1401a
SHA1 be440c6bc65f81ae18efafaf1379a162dfd8b56a
SHA512 1226011213fab2e177b9312a51e83c84473d62bb9d7dcee000c8f2a1c60cfd8c4dbdc9f493807ce8aa615d8df4ae292cfc6346af34ed2510c57cddce2f81ccc6
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHwL:qUEtQevvqc2W1cpV2EI32
TLSH
T16C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e5c4678912e0ef2f26dc97539ceefafd3419f39f5f995461df63babf7c1cbbe2
MD5 c6f47f16069e71c4aae85e003a85bc61
SHA1 3783692876cf4480e7b413680e6e5dcd656fcfb6
SHA512 b92a802497603c89ad32130aff2a922cf83bdfbc2211e518bd962bb3fb2254bc3aeed216cb623d2a224cf497afd5fa3fec4bd14810a0416ca4ee3558c1307010
SSDEEP 49152:hCbRquA/m2yL5zQfFiV+XenmE3/zzQ/lFTjN4:OoqtVjnmvLm
TLSH
T179D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9e6450b23175f43cb50e2d89f7cf2445784c2a05ef93aec1378424e4da4647f7
MD5 66d8fc4cac8ee34f1443b65b78ad7d1b
SHA1 7219354b0085574f646e1e5af0e3aac721a5f344
SHA512 cabdcbd1225378161a88cc2fab5987397b921120278b3eb8ca116cdf31d06208d3c745514075aebcdf7ea360e650b37afe1a6ac4e2bec620817dfb8888d7ab64
SSDEEP 24576:4AhGLJIFoiwtA5l7S53snQ/tbw/2Mkjy6Fr7g0oU:4AMyFoiq58Q/lFTjN4
TLSH
T13435AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 2f1505edc733a6fa454b5893f60fcaf7818d1ef10c801414629c205b94068d45
MD5 6b598a7142c5079e491b058c492d0051
SHA1 f57844d489a06f2046aaf2ae2df9d25d71a6f869
SHA512 963de7d8bc51cb5b85a641cdf7ac6528728cf1b0ffb39a6a115b723ae19404411cee8bb79e1fdd2291da112e19202cbbf875082b520d494193de9c1a40b62854
SSDEEP 12288:umw5HEjsChN2BFgl0WDm+C4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMX:nwuHOW3nQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1DA65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 715e84e962de02a6d0dc618e382dfc4c79dbba59eb98f7d18630fe1ebb4c08cc
MD5 968e4f7aa9ec493de7d880670c05269c
SHA1 41addafcdc0a571c89216524e8e15f53274d12ec
SHA512 167b654b956f30a556ab178389f0fd019efdc739f590f13dc1cbc5ac9e1e57d805a9d7b89814de62609db18ee7fb488eefb4251282b436cee0a04a9852ced17c
SSDEEP 12288:kXZ1IyTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:kZuynQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1FB55126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 14104de808225b05dabd52356a1033098ef3fc756390f687dee434081b88a9a3
MD5 0bb472551990a8b9efd604f09dedd8e0
SHA1 037f62cb34d942e57f512cbc4978712c38c6800e
SHA512 9e332085aa797c2bcc79e7a2995b5d17404fc19794a52b61912416a3f769ae9c04d7449baa5bc204e6ea7ffc5b9b09f258759dbd72c935eb188572d2e2815721
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ux:FQRQyi36YOcPQLvw2gAf+PN3+Lm
TLSH
T17F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6cab74c94093392e5f9e2450777db6c543bcbf1bb2228775c67694f535dd6cf4
MD5 333f73d6df143dad64f17ad8c1a6b362
SHA1 18f11594a81a9dadf6926d2a55ecc672cc3b1c2c
SHA512 15c2ef9a1d28567aab5462c85c26dab6ad6a5e63a6c1997cb9f9c6ddbb08de0242aac6680a3038636702a28357da0ab9ab07bd81973bda8273974094a131a8f2
SSDEEP 49152:oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ux:PQRQyi36YOcPQLvw2gAf+PN3+Lm
TLSH
T11A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3db9abeb934bffbd87407bfbbcfc65aca5d9c423f6a0d886fa000af499fc3797
MD5 3be81b2a6e2d00d83ee3963f5805b942
SHA1 b37cba2d65b639919e08784db66bf44f634e362f
SHA512 7b9ce333ab632d17c0230e318384c30d48fd06661e5568b449c8b24e32774f51748a14748600befa2281e83f00931554f2fdc49ea1bfad1384d6469c49b1aefb
SSDEEP 24576:9wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0CnQ/tbw/2Mkjy6t:568Qg55nhheWu7PNU3/jQ/lFTjN4
TLSH
T10CB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ac2abdc5c6d63bd68583a33d74c63d02c6fff9d18705979147b67d5c6a84c820
MD5 07b7c967c611cf09f470e504d52617ca
SHA1 22e7b7fc0373da41e56045fe9b7f97b95c6b21b9
SHA512 34f3659c3d025d7077fd916388f54d8fdcc9d2713961687ec9adc0589882efb1647003eb5524f1830ea26db2dbbc38cfbc33bdf9d534d635f70a8e974e9fff42
SSDEEP 49152:k3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99L:xy5112gYy5azzVvL69nLKnhZRLm
TLSH
T1FB167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 22edc8d312ec326087e202a54d313e1aaea83d75fdaa42433bafbd07f9c5cfff
MD5 6a349e23f3cba2181ae7a5d8edd771ea
SHA1 ce0521927437833dc5176ee1762cc63fce80666d
SHA512 d622b7701233ed6448e072a84d0e0b04bbd1906b16023edfd2e835eefb0300dd66038c06179ebe8546dd177c4d626a2b7cfcae4f8c2ec7686592b48dd2501eb8
SSDEEP 49152:zB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glhQ/lFTjN4:Fu6JmVxd2dGLm
TLSH
T130D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8e6555fb1a6a3b49c5fab93297a905dfd51398755024fbd675bbb2a85faf3492
MD5 f5b37574406f1807467ddd87154c3621
SHA1 0faec711691b101f37ea720639cf2af985bbf5cc
SHA512 5a6aeaf23ee42ccc9e93d745060467fb39210a0eb5d7716afcabf2710c837addf4817a10fa1bb233483984e68a96ef592b2e4ea976d0b2cc9a371af6acbea051
SSDEEP 49152:T1hpsNoJpF1A6UU44CwH7R4xlQ/lFTjN4:TmifPbRvLm
TLSH
T156B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 57c483d2efb0f8a766dbf1e9620d810f587a183d84ba5ce9296020c28f84053b
MD5 30a3510f72ec4cae52a5d1c7933e6ab7
SHA1 6da1d9b9c2d47159aa97ccbf7d402b2628280d7b
SHA512 d32aeb3a15513590cf809a2ccd3f4de78f2e3f2f851445a617acd3b5b5761124089d864f396d498cdfbb28d41f12d4016e12c8eb5ad6fb95646f58eb1a1a0f2c
SSDEEP 49152:uSuZQIY0Be2KRRVtOnks6NMHqyQ/lFTjN4:g5dKTi619Lm
TLSH
T15EC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9480ab94f9d56cf25208759342b293293592a25ca48d33a1e93db7b6c20d5707
MD5 990dadc3e49900c7574dcc3ec3315123
SHA1 2b7d29cff3fc7931243fdee987f940f657a2d537
SHA512 1ccb215f4634a338103e944ce215b39c468f745b7dc549e527f99d8681020f83a150b78f8f52e001182061d58a561f5b04e3b9100ab0fa2ef472b165aed075a3
SSDEEP 49152:ThtSn8EApI0figngiDn0AP5wRQ/lFTjN4:SX2iyphjLm
TLSH
T1B895BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1f7a10c4d843345622b9f7e1a417fe0fa9a4689c06c7a43c701f3d37ee0b0661
MD5 81c3f2c5a7d28168f5ef190ed65a5e64
SHA1 8dffccc27d58775497d01088a42ce04d07904a2d
SHA512 cf3d3c75c174b1e2528d1601a8f60c75390b5e586d0881c5dfeb177d89620da0821b853423be4ad7adc22124d6f47530feb0cda7a6546cfc570c2a64dea2d039
SSDEEP 12288:k+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:k+nQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1615523697965F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 74b4aec23a5691740c3aaa41335ab2825eb4db4425a4b481c2381ab4d2377381
MD5 3425a6117336e91696e94931c6d0668a
SHA1 19f15b1b3b6760358232c56df49a41251087ef15
SHA512 1b03af2a486497880eb4ab4538b0e9b6e9f1f61dfbcacf5c4115594df65fab414955364f388be58ca87dd0866c1b94266bf6bdbab71d0130fc3b659bd0cf4010
SSDEEP 12288:YfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:Y/nQ/tbw/2Mkjy6Fr7g0oo
TLSH
T15B5523797965F98BFA1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 07f1aa233bacb902174040709e6708899bb818d29e29b666a87a7168c51cffb5
MD5 626febcf0e2fb20a5736c1c2ce2dfacd
SHA1 903aa47584b0e895032ca763568c3b0d0d960cf2
SHA512 ad15d9dfb4f7b2f3b665214a4477251170b9dd5f8838e2c38c2316464c983bd0327df9f30c62c589c4cdcb56fa8812099f1ae449d744c38742a089ffc4c6dc92
SSDEEP 12288:89GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:8dnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T17C5523697925F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 addd8f68916d870238db4dbce79a459fca230596492050c176edcb8927c64889
MD5 2fa2e1dead023b95f26540ace3e64e90
SHA1 4c7d851d4e2d5e52f703b2d76b9ec9cd6e48a086
SHA512 4f28b01e898bb8c9f369624640081809f37d766f6fec3674c4dd89abefa299f7423aedd530efb5e1d7b042275c12c4e4cc75bccdb710236a5c1a541e66df3534
SSDEEP 12288:YVMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:tnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1595523693A69F4C7F92742B4CC938142E77B3DC6BBA1A38F6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0edb104893480563d77aacd4d8325cc960987baadf646a529c1c92cdf8fc6cee
MD5 16279a0f5068a8cfd7f3e536025293f2
SHA1 a4d6f80ec76696357a3e61121e90bf8506b2fb59
SHA512 99ab212097fd6b7746929a6b368b5b6ebe0a0cc025a1608405964fc9a5a6f8c5c1bacf56af0f03bc66e3f4378007915dd02afe4f778ed0dbfa7061378dbb462e
SSDEEP 12288:CUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:C0nQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1CD5523697965F98BFA1706F14C838182A77B0EC6BFD1938F77482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 cc20bc89a9d9d2ab7b76f238f95907f86695abdf354aebb6e94bca8271b3ce40
MD5 e063954a9b865d91e3f37f000c6a83c4
SHA1 b5f1a4b548fa5c24024b7c0284f442e1075e6617
SHA512 deb88b9b0418f679c1408c807248381b74cafdd43330c9a7a1a7c413ae7cb59c0cafb66cac8112cf5d4c3f00dbe94ff40acdc3627af3e67f1b4cf1648e5c902b
SSDEEP 12288:m7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:mrnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1F35523697965F98BFB1706F14C828182973B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f24204ffd7b51021c6d8ed709bcc82c640f8042e4d9de7983cf41291d6e60080
MD5 aa886b4b9f169232f90ac2ead0f7af65
SHA1 3f715e50589fb925b94ceb239882395c1c7cd3ad
SHA512 37a81fe9cde5835aecdac5ab34e11f3989f5b100a903b7c73f77bae9398c4c0e0e2a666624794f09844b041a421b50308c72b961b992cde1b00a357723124ec6
SSDEEP 12288:anGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:aHnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T17D5523797965F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 bf6173a1102fce0b61b4182b06e6772a01d1abf0ee4c255cd1e4029841fb280e
MD5 79d3781b6d3fd7d50c7d358e80553942
SHA1 96eb690df42cbb680a98cd42d3ca40724ec0dacc
SHA512 967ef0772467628d28084bb9070cd24267a41aead46b82d4b0594b70b243290d3b01e3161b973b882da09e92952695a7f1f9d57015f6ede5a0298e4f174c3000
SSDEEP 12288:QiZwbDzzFEoS2cPvy/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:TZM3zFVSOfnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T19F7501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f470d2a79bec933f7cd704f3db656a9116c4fd13067facb5be1276637b61d262
MD5 c121b0f264399ddd2da83103c3c09084
SHA1 88611bdec1710844e978cee8027407f705def45e
SHA512 7d23f2b1139e3af96ed14edf9cf482e3986474d8283d3830a4dbed27a22c513e1db2d2c2a3b6135a974e9737e5cca5269198e32541f5c58457b2f3964e5b35e8
SSDEEP 12288:SiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:SinQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1925523697964F98BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 95bf0ad597056f62a7aef8ac69779cf11f2bab57b90e5dbc191a0acf85a830d6
MD5 aeb88ac8b339de260a3626e2b92316f3
SHA1 e61492aa9570e0464869c5c7e7572775c71093f7
SHA512 b3cca571981518ae921fcce2a0c965f402baf764825444c30928a0c1cf6d216328d9b67b11bd4c6ab4ad0a5dcedee8f32602ebd322fd2918f49ce1e6889cd83a
SSDEEP 12288:vWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:v2nQ/tbw/2Mkjy6Fr7g0oU
TLSH
T18B5523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 6b2ae253da163b7ddd408d70e988eeba01937cb0bf00a839a0dac0e130817584
MD5 b1f92f88bf74818d323962036bdde41b
SHA1 1050f43b83a2481dda1e8cbcd930f1a4624dd17b
SHA512 098b1f9c329410c4daadc191517c76f388ef1140291ecc8384be50bc1cf4ec8eef92cf1a5cab0034c33d9adb3dfb0d8d84c27682677f111d3bf80a856003ce4c
SSDEEP 12288:tyPz5L8TGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:EzyDnQ/tbw/2Mkjy6Fr7g0on
TLSH
T17565021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d4df287b3979b3a5b88cca61a238fe9382785e1244f9abe2b5216e0b8c702f54
MD5 a625373f9f009052fa234502e7dbb7c6
SHA1 9fdced7d1a34e4049600a8e36fbb2b3b5492b089
SHA512 2f628964114b9d7466ba933376b7c25e729a063991674ca2548b7613710c1a6a25a592159404079b76593187d05a2aaa0316b1144609b2adf29d05460037edf3
SSDEEP 12288:XiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:XinQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1515523697964F98BFA1706F54C8281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 472cc25b2a60515e14c0242148a052a699181276ee17c83226af18e5511c50ad
MD5 a7992bb3384439f8e8f6b81d3486c1b2
SHA1 ba92c9f6431f83efb4298f9249152309a765c677
SHA512 6816d71248bb57b542534afefe038da40db33bd832d7a3cbb689b0b4cd2c8767aff30e39356de53651502c9aa053fc038f20b86492a984e8cd5bc2d709444d98
SSDEEP 12288:2iGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:2inQ/tbw/2Mkjy6Fr7g0on
TLSH
T19E5523697964F88BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 1edd92393eb6796e7c4e5d154beb24e66ca6f75863610547cfd3e7bbc63d842c
MD5 02587674802c88e673a339135f46e4fa
SHA1 7ba190f7a93c90109467f28d2568ee5b3ce91f9b
SHA512 bbc5f71602aabd604e1f03c35ec3958b10808b4e88aaf67e7551a1dbb2bf496893cbe7823cb95f8fbc9d5bf831079f8da29ff20377a81e24ef069ef80203e661
SSDEEP 12288:4yPz5L8TGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:ZzyDnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T17965021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 e1adbb248f71023b2a0dea97d16aa7d9adb09212fb734cb46c5e401c56fce2ea
MD5 16e070bb94449b1378cdb96cf7de3969
SHA1 18f1e55821fbd048dd6580166418b259d6afeef2
SHA512 ea99f9389d0903df795c5ca690325395bf82da509b7d26a2411a5f4eddec398c8a345a62762fbe4505efe215e3aea800bff8e0854daa6cb5ed391ab6960d3665
SSDEEP 24576:7T0aLl3z0zDtnQ/tbw/2Mkjy6Fr7g0oV:7TDLljYQ/lFTjN4
TLSH
T1237501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 87b2290f6011cc2aee607108dca61f19123db684a527466c18c25409234a6b33
MD5 ec113eb0f372ec9b4962f8df253ebadd
SHA1 6f6cc62950cedd44dcd8ece30d77a837bda4ff71
SHA512 7f02926725b793c202b3b6e093898b0d558d444644418b4117bfa22843402e44a3b404bab13adf999bb9acc748c268ead81c10999347ad312d6e27f863213b84
SSDEEP 24576:731d9CHKy7GZpnQ/tbw/2Mkjy6Fr7g0od:b1d9CHKyabQ/lFTjN4
TLSH
T1D885CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 102d586c157839ed4cb3a0f3939d972e62560f5a4c11f04538c22c449e7addf5
MD5 5fcd8d04c90f790c9e3f315fcabd9615
SHA1 be180a10870165d155a01396e8cc0d516c33ebb9
SHA512 0ecd6c746e09d305baa79b9449b05576f3ac677bc279a8b279dae7c30d42ec0136e4386826f3fe8016349d793b736a8fcdf08d45920a09c61788a4379457bd4d
SSDEEP 12288:tdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:t9nQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1EC5523697925F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 960ac7560e36b9d943598770a2e26f74a4a63f02aff66263d44db66a5b0eb739
MD5 6d7062a589b27a74b4aba67a6972551a
SHA1 21fc2dc57bcdb01828f26c5e3e380c41924fef7b
SHA512 a8cbed6c30695102c5a3be99acdc27471d211e05577493615af1b16e3eeba916fae587a7b4013e39960c078fa5d086b2545a8065fc53820262c99255e0dc9ed1
SSDEEP 12288:lzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:ljnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T14F5523787964F99BFA2B06F54C838182973B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 c2c7a985a85a7d334f250ba91f6a29e08aa5f18b0311e8a9f4fa02e252fce737
MD5 5a1fa36942034d6ecfa5e3555196441f
SHA1 ee5a1391f6e19082263a01cd92057d1e19713232
SHA512 06ec09a850bd6fb21a31505b57734fcde474241757f8e8e01e5b9f489900546efe6c0b1628976efed89226305f4215327ba3be4c406e46155da16811d29a05fa
SSDEEP 12288:fgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:fAnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1535523697965F88BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 86614e0259fad1fbd12328937d6707c4a0828ccb42a32b0e39785ca686d8a7cc
MD5 b236e53ced0e8547f6848a6510b54375
SHA1 76e7ae8c74330240f79296dc376e7e8a53f45829
SHA512 b72e0f5795afe03eb4110859a400ad109b3cf19f6fa62965e8c79b5cc9da9032d33cc7ff1c154fc91a0acd8a08f8bb38e5b57b1b610e59e67788267b5f1101f3
SSDEEP 12288:MiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:MinQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1435523697925F98BFA1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 b35e16d7b8a3e388c5401cb7fe7d15fb704254eb3e8bcaed68e1aea8db97fe7e
MD5 1c0091b7e15c34eb5fe75fd29591a9f3
SHA1 d7504ce66c3a0ef74b064e6a9713304de2135bd2
SHA512 be28e89344af7b3f5fbd273ee8ae1a7c8a83e57d7ad0df302fc4e3e85344645e2281d3c27a29ff59b79af8c895359fd3cd6d54f65fcfeb85333151d1c091773b
SSDEEP 12288:WdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:W9nQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1F85523697925F98BFA1706F14C838182A77B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 e05d0e42e65943e70a52a6e3c6a3626eb0dff2e8de850a73fda7303b54c93215
MD5 3f55ecfe7a983a4ba505dd46d2138d2d
SHA1 a1a3633fc27761f91ef3f72be0880062d788cca2
SHA512 7c8cbe26904f177314df46db5a436aa4da274f9071eab4a31a4c2046e0c1cce525c421617021a559b5762dd430c661132f39e3a0b92ceb2c776d13353f1fb841
SSDEEP 12288:iqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:iqnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1615523697964F98BFB1706F14C8281829B7F0EC6BFD2938F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 89b71a15ad0c9fc4da28acd689f7f6f94fefab824615efb0b3057c86228109dc
MD5 d50a60ab206ddf024626b6d46607eb68
SHA1 e7f58fcfc0a56e2ad4054bea0c5112bfa5205a9f
SHA512 7089ae841e0c237806068e916f7217ec0c27de6426b4e0eed318d1c42a4adce65fd844e1cb1808d3093b47c4a399f48d940d6aec37a6e821f3f26dbb548da18d
SSDEEP 12288:nUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:n0nQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1FF5523697925F98BFA1706F14C8381829B7B0EC7BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 d625bd5606a038886059961fdd4744fd7afb3dcdc2e9c7e38c219e2dd1679dec
MD5 380f17066d591a6b9e8c3236b58ca760
SHA1 bd6023cc7cbc6059c1204cab399f3ca25f222b59
SHA512 4d2c7e8860e179557293b70e6e2d69602f6ca6a3bfaa2863e7c6f68aced76259b4244e7c177959870b985f3c68d7760387de6631d8424211f8f7502f6f863dda
SSDEEP 24576:Ifwv/k9RX6wkyAImnQ/tbw/2Mkjy6Fr7g0oV:HMnYImQ/lFTjN4
TLSH
T1C885DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4ae3cbc25dba82367638af20d01bf16fe7d79b02438dc3cc7160de597a559be0
MD5 ba82ed64c217ff4a275d6d25440c3c6a
SHA1 45081d8f983dd0f4e91c401bb2f579d9deaf6de7
SHA512 797ca83ee9e687912d78116d39e14d4bc802ba06f9adc927d50a3d3721e613bafb0fdf8bf48266831870b6363ff5c72e9979c6b4b54749d1b2e90fe8120c0065
SSDEEP 49152:CYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0xQ/lFTjN4:8ySzPeLm
TLSH
T1BB066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 cd0b8ee09e894c8f281a8415297ff4a5eaf89b43a15aaf3fc34494123d2e63ef
MD5 3ffe6311aa8197af1f2113bd4b52f612
SHA1 f5899f8fb1b28a0474cc61ceb97a417b7e2ad257
SHA512 0abbf9b1c89c251f418ed876d2bbd21d9041b73422f2890de0a84f652944adc182893dcdeb2c7d02edf197ab318a5372d35bcd7a108f56d697be27e0492be93a
SSDEEP 24576:k47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYPnQ/tbw/2Mkjy6Fr7g0oo:k47JUQj1irIhCnDHUPfF/hQ/lFTjN4
TLSH
T15665AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 1541b61fc6ea3ca93abbb6bc077dac2a0532d6cc13376695fb74df650684c7e9
MD5 d1ce0d0f4a032d7e295bc0aaae2a8b4b
SHA1 f2a31f0ec8919065a8cf7297ddc54518bc72303a
SHA512 c59602352ae74d75daded71cd332c2dfebf1b207eff7c29d764f01395a7664c5972f677c517cefb8c4742a781e18aa4725fc0d6d35678d3e1cd8feb5d286936b
SSDEEP 12288:jssfyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:PynQ/tbw/2Mkjy6Fr7g0o9
TLSH
T10965F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 a5d1fbf6b2b9df0e3b34510a0ed6e92848832fb9571866dac1b9e25729af96d7
MD5 7afb225e67b3f6817fd06445697e281a
SHA1 72f4da7085feead3a37775cfec315618d4e70309
SHA512 10d5cbad788e96f05ad8237b9baa441a74e832b3163e5af37ddd88a731cea7b9a16f63c48e252ceefa0b3cce2fbccbd10e6bd0bcd2dbf1759e17ad9347868207
SSDEEP 12288:UkQmfPU3faYuzCIIACaZCk0zVlyDK1QgoQo8:Ukv3UPahORACgC/5lyO1Qgo
TLSH
T1CC251710B62ACB5FC6A940325E76D1CCAB707D41EE449F0372C9873FD576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 2745e375a50c75dcf8bea15a6c1abe5eee93fec0b0af4cfcf68b94be719a6284
MD5 d4d661bb450852be259208a0b58222fd
SHA1 1b93e99878d5e1526bb153b7ace482eeea0977ca
SHA512 72d21516239007cf67828ac23271b66c4b7cd52a98cf566862809ba6645f8b24936d4935aef5fdf50e67c1b79907896ce05a2b3482926b78aeb582575050e8c6
SSDEEP 24576:Xe4C+VfWvTGmwpypG2mpBcR+XwAZ8FUWkV/8e5l:ujv3al
TLSH
T18D750A409537E78FC1BA603247365B8CABB4EC0AB7456F2673C5053AD82AB15B4F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f560ef2befc071bc19eb4251bf187d0561260bc28126da3f169ee3ad0d0e1458
MD5 b068bc80f835864c8728bd579cae0837
SHA1 889de5ff073e83990e369195d548a79507bfeec7
SHA512 bda39e0beeb63c3dd25538c2d31228fb76709632c2ac2b9cbd9f9d0805507422220d524cecc0fe34426d24e749b237e30ce8efbc2bad4aa4b4af01ef0b869bc4
SSDEEP 12288:Q676GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:76nQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1AE5523796668F94BFA3B06B058828111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7ba64f3ad6a53fbab236c0fdd98aaed81b7c3142328a4e5fb801442bd2d65924
MD5 2a16e7ba4e859d5adb2e0f928eb63513
SHA1 2a904dffcda509fb8707a78fe865a290f8c3fac6
SHA512 6e8a6c7b78013fbd3d4fd03d42b689119053fcf65abe014759ffb8948135037aec2f33f36fcc018668cb80b03632ef42395c39d2f5cdbe400849a64486b660ef
SSDEEP 24576:mgb6bmBIi49WNNFpg1rSvFv7bYYnQ/tbw/2Mkjy6Fr7g0oK:mgb4mBIBhGFPQ/lFTjN4
TLSH
T1D165AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 b105a226cfa9cd9e149b43d660aa86140db93d961c1f74e3faa9c61f40133dc9
MD5 76faacea11e7df705adaa447adee14e5
SHA1 1be9446024365d3bf8cf010fd5b7d3019b0747f2
SHA512 205e2774c611f3559fd6635ebae38a1b65a3735f1904bcb9427e5bc568a2165223d7e9870e81667f781231baa8a875b6ca8b93a63dbea102ae1221489a517f36
SSDEEP 24576:dG88u8FpJqH1Qzria7/mfnQ/tbw/2Mkjy6Fr7g0oe:w7ZFPqVva7/gQ/lFTjN4
TLSH
T1F485F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 a53332e552c462447058cd7d3c20966e4875a8b4ca55a0e7320e943119a54b2a
MD5 1ff26f399243eb0a528d6ded7823afe3
SHA1 68f2d102c584ef4aeadf5f5c0f9a5c8818eb43f2
SHA512 a9e42c8c2d506c4530e68d66b0717815f56276398323039da07835faa6971ada2e9363bd61869c3bb4eb17300af7f0b0b4ce268ca54be13b8dc9e6cbe514dd2f
SSDEEP 12288:PHvUrBFrEjwaQrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:PPUr+NQbnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T14A65E12F26AC18E5F676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4031e28ea934b4b83b69a11e6e8e224193cf2a107fb2862765004d60609b0129
MD5 274397cffa53d26220f83f6f25892b2e
SHA1 fb2fad8e0ed04e2db8dd2552ab478fa18a033d40
SHA512 1ade878ebf71989a1e83972a1e4f58e9c2cc35ec9de02110d52e2043e3d1fae236f15dcf2d94f56bd2a953b912c04b33bb79839dce66b3c8b6dc66e4a42623a4
SSDEEP 49152:QBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjrQ/lFTjN4:LG05lO43bJLm
TLSH
T1D6D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 71466f2c7ea98ddb2968aa83059602147bdd227d5f4008c65f672d38c64bdb4f
MD5 1635a1fdb2e3ded96589a2dbabbfff47
SHA1 ec8a63ffef619789dfd8b3b1623f7c9659487d6f
SHA512 f59463072fdf7887f7c598271bb06b9db74d960a541156c966664b74c7fc24c98deb3364993cc5b9e34e4ef96257024c6b19fc9618a34cbffea64c4aab3b4f48
SSDEEP 24576:nfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnxnQ/tbw/2Mkjy6Fr7g0oz:fa5POZ3+Jt2pasx2+mjQ/lFTjN4
TLSH
T1E265AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2ea61ae52774b4fc2f69bc9fd819c8e4003780c57ae6b51e35b1cd04cc1aa737
MD5 74aae58bc602d17d51f8beeb81bbfbae
SHA1 e52f16fd37537c506774abed35dc0fef2ede9cca
SHA512 8c5b59ec8b1e5624a5f92a5f89e901bc31a95cc4dc0fd4d007ea11d7d1ff7cc5145bcf07001d9621c897b6e78d49dbcd89390b07ae45e874a6f31150eb2d2a04
SSDEEP 24576:zNcwHdjbyQ4nLC18lb/EOjowL7FkXnQ/tbw/2Mkjy6Fr7g0ok:zNc/zEOVHFAQ/lFTjN4
TLSH
T182858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d0f3c9bef7817faf11d234c089ba3f35b3825050e1a79775f3065d0bf4ff8e3a
MD5 c4a12238f0d22d63c21c337f349f7276
SHA1 2d6e9aa0e8a03caa0bb9f813fe864b5cc6a85e32
SHA512 6bfd9c165932189aec7cebd56dddc8b80c2e57dd42cfe60b1e806e4fac767e7e690db0e128ada604ba5f2934ef97ce1e4d743e57104d284a272f89913483c783
SSDEEP 24576:b8kNvNnaFeYhJNtmZBm1nQ/tbw/2Mkjy6Fr7g0oD:b8MwBtOm1Q/lFTjN4
TLSH
T10355AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 a4c8f9b7042d89434dfc4d1738afbca1bab7d14e880daf00a7d4113f7d49cb1a
MD5 95a9555939a265cca442815e0c528138
SHA1 e066cce3b638a12d8fc048b77c7521456ac36340
SHA512 0bb6632b3150e536eb3aef60b6fedbf5cdca71d4ab4573e9a63d6bfdd5a3840364688907a5da426121cc1a9a415c76c2746e904d554fe5248da80771494a997d
SSDEEP 24576:UD3FHshBIYQgAenQ/tbw/2Mkjy6Fr7g0oP:UDVHeBIAAeQ/lFTjN4
TLSH
T14C75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/700-112-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/700-311-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/700-114-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/700-120-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/852-86-0x0000000000400000-0x000000000056E000-memory.dmp

Download

memory/852-1-0x0000000002470000-0x00000000024D6000-memory.dmp

Download

memory/852-6-0x0000000002470000-0x00000000024D6000-memory.dmp

Download

memory/852-7-0x0000000002470000-0x00000000024D6000-memory.dmp

Download

memory/852-0-0x0000000000400000-0x000000000056E000-memory.dmp

Download

memory/1180-53-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1180-50-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/1180-44-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1180-45-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/1180-38-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/1692-66-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1692-64-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1692-72-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1692-277-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2020-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2020-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2020-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2020-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2020-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2372-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2372-94-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2372-326-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2372-88-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2372-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2372-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2656-132-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2656-126-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2656-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2656-137-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2656-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3384-220-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3384-60-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/3384-52-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3384-54-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/4228-77-0x0000000000780000-0x00000000007E6000-memory.dmp

Download

memory/4228-82-0x0000000000780000-0x00000000007E6000-memory.dmp

Download

memory/4228-76-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4228-294-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4388-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4388-14-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/4388-22-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/4388-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5208-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5208-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5208-106-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5208-312-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5208-100-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5208-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5416-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5416-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5416-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5416-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download