stealc | c6a6621cb07e44b76c69fefd3915e0c1d64a6cd7ce477ace8785e81ad2ce7cf5

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.4MB
Sample260930-evnevswend
SHA256 c6a6621cb07e44b76c69fefd3915e0c1d64a6cd7ce477ace8785e81ad2ce7cf5
MD5 250ed25aef383a40f7526f42d2d25723
SHA1 cf53e973837233210535894e6597c5426a3cea3d
SHA512 ab96a9f433204428993223f66c79817e63643722bd1d76c5f03d91197ecdf848765424ee58f2fc2187ddaf90456dccd5ea4d78f78caba4642779ef356e8f4e2b
SSDEEP 12288:dibwAEUmeF66je6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:4DF66je6nQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1406501353AE0D073E273207108D2D7B56BBEA9B19F61978B7B80177D5F343918A2934A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/2488-86-0x0000000000400000-0x000000000056E000-memory.dmp	family_stealc_v3

Executes dropped EXE 11 IoCs

pid	Process
3464	elevation_service.exe
5128	elevation_service.exe
1452	maintenanceservice.exe
728	OSE.EXE
3512	PerceptionSimulationService.exe
6120	perfhost.exe
4856	ReFsDedupSvc.exe
2416	SensorDataService.exe
5676	ssh-agent.exe
800	AgentService.exe
6008	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
	\??\F:\	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4fe3c6af67fac3b7.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\javaws.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000d537816b9250dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000338346b9250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\explorer.exe,-22002 = "Disk Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006d45dad9250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe

Runs .reg file with regedit 1 IoCs

pid	Process
4812	regedit.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3464	elevation_service.exe
3464	elevation_service.exe
3464	elevation_service.exe
3464	elevation_service.exe
3464	elevation_service.exe
3464	elevation_service.exe
3464	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeAssignPrimaryTokenPrivilege	800	AgentService.exe
Token: SeBackupPrivilege	4856	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4856	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4856	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4856	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4856	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4856	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4856	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4856	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4856	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4856	ReFsDedupSvc.exe
Token: 33	6008	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6008	SearchIndexer.exe
Token: SeDebugPrivilege	2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	3464	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 4812	2488	2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	90
PID 6008 wrote to memory of 5672	6008	SearchIndexer.exe	102
PID 6008 wrote to memory of 5924	6008	SearchIndexer.exe	103
PID 6008 wrote to memory of 2604	6008	SearchIndexer.exe	104
PID 6008 wrote to memory of 624	6008	SearchIndexer.exe	105
PID 6008 wrote to memory of 2424	6008	SearchIndexer.exe	107
PID 6008 wrote to memory of 1276	6008	SearchIndexer.exe	108
PID 6008 wrote to memory of 5852	6008	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_250ed25aef383a40f7526f42d2d25723_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\SysWOW64\regedit.exe
  C:\Windows\regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\config.reg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:4812

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5128

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1452

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:728

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3512

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6120

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4856

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2416

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5676

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:800

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6008
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5672
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5924
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2604
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2600 2596 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:624
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2424
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2600 2596 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1276
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9ca0dcfc21e4a5cdddfd07741f61ad522eb524c29019fd3d177df4a451808ff3
MD5 f4e155e79640ddb1bab657d374ca8cf8
SHA1 f3fc43777cecbd0c393366d199fd873b8f8a20da
SHA512 1632d6d1c4c5a1adc09e41db3db9e7732aadb6ccf151a5f1e954604992bca0facb75139ead07fa497e69afa8c14ff04b38930a76d9defa2762da91b08088d494
SSDEEP 49152:Vb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn2Q/lFTjN4:r3q6HjB+Lm
TLSH
T17AD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 4ab0a77faa6919eb179c373439d603f8fc2a92245f6ce4ff16b11882a6de6d89
MD5 b3e5b162a8221242e3675b21db2ae8cb
SHA1 8349172e2151e6fdca80ec1b676862ba058ae68a
SHA512 5dfde3158539c24fbd62423183646d8effcd2117d32b5d8f78f53c3af930b24af168dba5fcd66c623523c42b22afffd01fad193856ab16436ce52e9fca86ca59
SSDEEP 12288:V1XLsswWkxy2lRq2czAVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:7XYfDtczA1nQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1FE65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 7fd659dcac5ba6205ebc5d4e4936783bf9e99c233618cac4d655c42de4d3cbbe
MD5 e6142329f749718459c7b9d324bdb30b
SHA1 8b94072a0d2e02b801651dea567a4dfde0ab45a9
SHA512 dca38704230870f9d2b42d82ed78055bc829b79dd309848645ae27696d921ed716136d02ba4fc5e5aa772cd9e30f2d8748b62c2dbc91a24e86e7ad7c1b3ebf49
SSDEEP 24576:O0Le5ji0hmxLrMenQ/tbw/2Mkjy6Fr7g0oa:OPji0Al/Q/lFTjN4
TLSH
T1A2859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f1f32225c3f5afac5d521fd0535f05d1059a409673efab5421caa62dfba7469d
MD5 627515f752f779f39855eca440d2b268
SHA1 547eae52f29c0db5db37439592fefd54e520723f
SHA512 3f31453cc1986554f8a86e533ee7d949a889a9bb3c87e7be182d261e80f260ba5bb8a4d2f3c1d18201393d2ffaf1418c8d86fafdbdc5998931b6af974d8bf0c7
SSDEEP 24576:ja7/ezSC6vUyD/aqgrvWE6q8wyu0nQ/tbw/2Mkjy6Fr7g0oa:O/ezSC6vUzPvxHjyLQ/lFTjN4
TLSH
T19E755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 871e857ff253e880986c4a94b57976f1b4e44cf76f2e0a74e25102e800fc45bf
MD5 ece646337eabc6ac1dacaf8ea11b2b35
SHA1 8072274ec9f22053aab71740a1226c93c9bb85f6
SHA512 e569de886fecc561eb36503db7a9839b8c627096593ab8840e3cdfe79be8f3fe546df4ed7c77359317f3d4844e231ea1c9f885b595abed5248b63a360f6e4665
SSDEEP 24576:BVbqPb88hv/l+6ZnQ/tbw/2Mkjy6Fr7g0o1:BVO88hXl+qQ/lFTjN4
TLSH
T1CF559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a67d8155d41d382c26adb58efdc42cce6c5ac1242671983bc1efcb3c7f91fd2d
MD5 28674203c5175fd00229d632a198960f
SHA1 f90f2885792b59401b81dbf323a8d7f66f03d927
SHA512 6d3da8bd5c88c4bffe32ae9036d590195bfa543c4bc4a8fbcf431898de9d9ef1861f6714ff8746ecfa87dc81405e379315a463b31f006dd9dc8c5a250450cf98
SSDEEP 12288:UzCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:UzCnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1A85523796A24F897FF2B06B15CC284826B7B0EC1BFD4AB4E6744362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 2a06b9a648889ab66d273ca6ce05068f80840f37c59c83dfeb2fc179f5b5ca04
MD5 2aeb484dda65103fc2458d1a8c3626af
SHA1 727579c74b5dc35c0053c95528fd52fa88f8e995
SHA512 1c886a8273a387c5b503ee974498d7bd2631cd3b90ec183627850979ea74be19faef80151abf22b9619e14f6976b08b40c9ef1d9edf715a4d713b4e9deff1a9d
SSDEEP 12288:EeBNUbTVO86UxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:EJIUBnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T19075CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 843b5aa6086ceb5bef720ed4d89fb87d4610cc34ac379fb02963039e965e1caf
MD5 a53e8c13eb478189538b30a02c90293b
SHA1 7b1aabda14602e7ce00bdd81c0c37b1cb7a1f8b6
SHA512 934f2658ca89aa49636054631aeebd913a28a1e5e0e2828441c5c3ed6ea96b09e1b8bfba9e8be1efbe60f90c22dd21b57af31c27d74ed08ee1ea774131e19840
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THZ:RQvGAdlCEL8c/yRNw5C3Lm
TLSH
T11E267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 89fc03de8c1dc5fdec0c0daffa176d67ad555cd7c59f45206ef164709715322c
MD5 19ec45aba33008ccaec01af03b1888dc
SHA1 dcf082e063cc452123b1266beccb9b7e72e6f6f3
SHA512 294cd5bf8a58604f8316066969bac8d3b6f4403ffb5f9256dec2a007f59b2f9f80c139f689b101724da0f26aa180adaf9abc43b7ef9d1e9ce63fb2097f2f7838
SSDEEP 12288:QAwSfxL/2Dc39DLLmt0LDQewsAjvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgv:lQewsAjPnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T11D75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 994e983b262f1b52312406800b6a0a055aa3e45732d426eb4cf77726609e10e5
MD5 e31c43a02a86d0630a12afbc5c2b212f
SHA1 4f0480ae092eaf182817ed47660182a477f7d345
SHA512 2d53d1d6eb1e817aec42c008a22cf086e16b2cecc42612c6ad062fd4598d4d0ea58b8f66bac1718a3b7902893b6c0556db6d1536ba1da0258f283268e9ebcb90
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHML:lUEtQevvqc2W1cpV2EI32
TLSH
T178474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6fa216c4a74db3ff1f3739fa38caaf6fec2bd9ead50bf043d7930edaf8f0c276
MD5 a380e9e5bf9060d3102598d9a89f7877
SHA1 48cd0199ca9c8378a807dafe77eed343f5edbbce
SHA512 665dcdfa6a1d47b250370b041148532528b75be56a34a6c8232b1e55d96d85499242838c6028bcc7f8b18a5628de272560a3df93d6227ae19b9cabbbbbc2b47b
SSDEEP 49152:4CbRquA/m2yL5zQfFiV+XenmE3/zvQ/lFTjN4:xoqtVjnmzLm
TLSH
T1F5D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c1c928f2b180c385192b506a8c96dc814478a34be23f7ad105f287910499c129
MD5 da827e59dbd55a65476535003c16db9b
SHA1 483ae81b1d348725c8ebdc087315eaf0c2a1f4fb
SHA512 816f66787dd435dfd47c044642f7d6a4c4bac7743dea57e4fc1475e5d95f36266d50f811505453ab369cc496824b3341f208aca7d8d0c294749515baefd7941f
SSDEEP 24576:1AhGLJIFoiwtA5l7S53AnQ/tbw/2Mkjy6Fr7g0ou:1AMyFoiq5wQ/lFTjN4
TLSH
T18835AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 d9267fc3b9325335c690b8e09b1db00b027799fcf028ccd1e706ee76eb43d2ae
MD5 dfac9e58c8ee6196a10092a0f1d65462
SHA1 57e2c69bc7ba512fcd3b2d348757ba8fe0e240e3
SHA512 1376e022bf821ac9db388699e426eda462a7d07c4eb89ee9c7e8b785e7af30aa39accf84663a1c24f655070000e9ccb86c6536dc2802a30e33c192d4fbca43c5
SSDEEP 12288:Vmw5HEjsChN2BFgl0WDm+C0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMb:QwuHOWrnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T14965F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ef6360e428fd0e6341cdd2f52be3e13bc0c0a38ed552620a75c5a985c93ad139
MD5 b0c9d9273e10c2394f128717e80adfe1
SHA1 da561b4fede60fccd94f29509bd73fa65428a1fb
SHA512 c6ed1779677b3f16bc46817fe408c1dddc09fb6b0a3239a62fd4d0d0cae148cf32ecd14bb183aee0b3f61ce663bbc115074e9a476b612d97ba47e50924c6e994
SSDEEP 12288:HXZ1Iy/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:3ZuGnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1A655126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 262cd1e1186d111f372f703fa8f5931b25dba69947f046dd042e1c545df33f4d
MD5 6fe42a6d753f66c60830c063b9e975b4
SHA1 18726a723ab415ea95df9b1cd1c4603b7e4de011
SHA512 cb9d5fc836b41342554d09cab06821e98474631b7aceddf16e7b0094fd0a12d186fae916d54e1a6ee7903dea3db31155c0737e6eeeb1bedfd8eaff4bf933bc0f
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UF:5QRQyi36YOcPQLvw2gAf+PN3SLm
TLSH
T1FA667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ed2a076db69900ebaebaf0b351a63fcc02b1902204390a5563cce65f59b9a6d5
MD5 de2228279ad174ad297c62929165892f
SHA1 55c06455b0546678047363fa110e34627673b0ac
SHA512 88b511dc393bdda5332248a968b19772781b90e5b8980337e3b1aa98e46da007ed11be7726570ff4ac44127128dc99072788b914a1d2cdaac02688360ef4caae
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UF:9QRQyi36YOcPQLvw2gAf+PN3SLm
TLSH
T154667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0319f2d84dd07b66f69619d5143d0acbcbf88c9f6bb51d92f66bbdaafa8f3334
MD5 67f55604c5740deb2fc49b45e215a0ab
SHA1 f5125ad1d8d665d32535a2410feb987038f16f24
SHA512 b49925d76af7f19e6dc44af1dae69ee24b3b6a1f264b4d019a4b663cef9e678caaff6ae6e920405f37e68b80ef318eca3e8c64cf7ff5bd4e03e5930f0e7e0f9b
SSDEEP 24576:6wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL02nQ/tbw/2Mkjy6e:068Qg55nhheWu7PNU3//Q/lFTjN4
TLSH
T1BAB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d25605d5c9e42e9f8eebc79dc39e016231264b36eda94bfc78f8c7593dfdd589
MD5 ed513bdc00d73d10d626eea33d32a5d1
SHA1 0b9058abfa391ec7f7d2eec809d45ab9216dca7a
SHA512 c99245affb8b49038afa2c85ece2b425d5b3bbe6f9494f46aa97b4a58cdae69a609d024a32c258e32d8698e585471a51b6444540a6f5d351c7cb837004ae0134
SSDEEP 49152:Z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk993:Iy5112gYy5azzVvL69nLKnhZNLm
TLSH
T1A2167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ffce6b3671d1f4134c814e573f591c076e81f9eee956e3c746ff5c24e056b7e8
MD5 0d3be206745239578baddb4e89a14faf
SHA1 6f7eecd5fd786b3c7cdc216063c13d52edac7bb0
SHA512 94a847eae55545c6de6e58bc1d60bc5f5c55304aec15cf84951e0195b8c5eff72a32ef968dd3e8a79129cc1a51ccc28d2da8e443e1c14bed01e1c8e123bd3649
SSDEEP 49152:tB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gllQ/lFTjN4:zu6JmVxd2dKLm
TLSH
T197D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 02683271a820c5ef65585bead3ebe69aedb6b519e08a6a9da440d956135a4753
MD5 0d7c763d8e1a6754ee45eca2fad8ad99
SHA1 8dff79fac0a243019f072dc28571bd2a9a57c64d
SHA512 a01927877db22cfc05933e07e513f60e3aac7b2e8aaa857e2af93d80e1057bee3217a7b2c854009c2e37d01d1815984352e15a1262938d82d72d63459392e062
SSDEEP 49152:I1hpsNoJpF1A6UU44CwH7R4xhQ/lFTjN4:ImifPbRzLm
TLSH
T12AB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 75a5244ef68488eb0e415c32352ac244ea19c7679605d53e51355d4fc57e058f
MD5 71acc3158e24808417ada027d1231d03
SHA1 89e4cc3a909d3ad4d615fed7a409be0819dfaec4
SHA512 90cb5f056098612ed5abe5ba928dc2b70c001c17b21e39a38861c644be6763c62a5e9bfa8dde031bd064f5f28deccc00c0f5c6d9d35c40adc6003a234d97e67d
SSDEEP 49152:mSuZQIY0Be2KRRVtOnks6NMHqGQ/lFTjN4:o5dKTi61RLm
TLSH
T17DC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 558bfff3f45eeb025eaefc1289c4638611ab1181c05f958fdd1b587657f0640a
MD5 c7c3e35776efab235cd019cdd10edfdc
SHA1 6fd9c0af966e2a1aa91a5c8e1c5b24cea18bad6e
SHA512 e81f7da3c4cf3b38e4ca5230ce3bac6fc78e270bcf2b03358f7e8916b566112f8fa5728e8987d2d6c9de1f01db29741c5359eb1085944194bceeb91b528cd885
SSDEEP 49152:LhtSn8EApI0figngiDn0AP5w1Q/lFTjN4:KX2iyphfLm
TLSH
T17295BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a433648c002c6d826a11b1f682730f482459747cb57d00042dc76038beee9851
MD5 93dad278db63f4120e87f0a1d0277274
SHA1 f093e321a54cd218388fbb4d1cd231b9913d119d
SHA512 7de76fe5713758cc95c07afc2fd40a7f742cf9917d3a09610decc14acbe6bf506403e3129e9cc7fb92d0e31f09b2690afad71acc21c93cabb0cf3b0f6685398d
SSDEEP 12288:5qGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:5qnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1515523697965F98BFB1706F188828182A73B0EC6BFD1938F77482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 0edb5799f01fb9ba3839c8de7d62ac1a4efa84ba46a2d72fa941b424f5b5e00b
MD5 d7dc9dadda168444a6c23621012cc5c1
SHA1 5990903f938869fdd5dfd7ffcd656d8cbae69f18
SHA512 1a473ea10bfccc59bad5cf16b42890e5d75c2bd14137c2a24471de555ae57089477d01fb4f12972d48667115ebb4dc466a18fa4211214773bdf072ab4bed9d4d
SSDEEP 12288:DTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:DDnQ/tbw/2Mkjy6Fr7g0of
TLSH
T11A5523697965F98BFB1706F14C828182AB3B0EC6BFD1938F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 98482e5821b115620b8ee3741de6ce81cac28af088eed2276ef24230651bf84b
MD5 e131ee974e2a0f05b6b8dadbc1fe3844
SHA1 b24a38979943e29e4ed59193749e30c48167401d
SHA512 9b0924e6043c4deb790a4b435ea4dd99762fdcc78a75d6905fb30d900f910105a013155334773fc254781dcc21b01d411a085a64770e593208e71cd226fb7ce6
SSDEEP 12288:n5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:nJnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T18B5523697965F98BFB1706F1488381829B7B0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 a8d4b9f11dc2ab723057f9ba3ff23ced6988a57ff3424fe557fd624b18a3b6b7
MD5 c51e69ee7f96a937c87dcb2c738795eb
SHA1 6ad71be8374497227befeffbbe54b0b0a3c2ca87
SHA512 564b15eab5d563e3b7f3414d43fdc8cdf5015a70144a1d31f4b23f577b0b23ecc361259af54fcc82438e6ba69d0580da464870cd0227a8787ec876d9d4508a21
SSDEEP 12288:CVAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:7nQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1935523693B69F4C7F92742B4CC928142E77B3DC5BBB1938F6B04111D4E793D41AAAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 05934371cdce6c866dfe5d0946705d7df3d98d788f2af2f403fe4ef25d5b5436
MD5 4a0f3f4737fda81575cf182c7df6e171
SHA1 62015c6caa7e8023e7e58e4215919eb6e4c61c58
SHA512 c358e12d3c2c5e01bb18cae059f2f21b04040a633e4115ac6ec5546e41d35420f63e0ac2e5d9b9e28123f1e2a84af0fa334135e34ece8847f1e98fdefff96844
SSDEEP 12288:9YGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:9YnQ/tbw/2Mkjy6Fr7g0od
TLSH
T17C5523697925F98BFA1706F14C8281829B3B0EC7BFD1938F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b472e724df4d31a39515e04f622f04f83fbe6b03dff02fd986670873e3868462
MD5 fae4386a6656f2d4749a60f84d6af183
SHA1 d726b694effc89c8688d9561fe745b08fe632efa
SHA512 b87103555cde902a9de638deb27aa33ff1359a351704ee0594b60a7ba748b44009bcd899c1a5696ac1517e9c5dc4cc2d59cea9b2e6ba1c6b2af53edd842f9bd9
SSDEEP 12288:0XGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:03nQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1035523697965F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 e65c8d148918f9f9caac445f95cbba48291e863f077c5371bd79f116bb15b73b
MD5 f34df987a0aafab9be06863ef67dd1e5
SHA1 3b14c9ebe688e422093ab396e576b9540afb67c4
SHA512 029a790ea40dfc59ce5b770b3797e649288658dc527b67d833f3ac00582f341be48786169d03a56e5988eb7d5a921fe8514f5006e8c2f8ffb2619fcb82441da6
SSDEEP 12288:rrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:rbnQ/tbw/2Mkjy6Fr7g0on
TLSH
T1125523797965F98BFB2702F14C8281829B3B0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 034f91c63909f886c3bd6aa59237bc5c72671a76f455b603431e46c9adfe7ee2
MD5 8406d00208111bd55f20e0efcec7b131
SHA1 c3275d958d0c68d29cd1488005dda0c34489f294
SHA512 3fab3db0c0c314b312880db5b7ec83ebe9d0ea5da90cd28d097e0831a8dd7d9f9f8ae72f6051860de18f9575d2b7a141f9c1e63cf6c1b1fc5ee445c503543a16
SSDEEP 12288:siZwbDzzFEoS2cPvyzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:PZM3zFVSOjnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1357501A8B35058F9EC67427ECC518906D7B27C5A1BA0C71F13A8362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 93e0eb4413c574ecc53acbc56ad54c32b1d634ecb936b86f07daa0a2b6f6b07d
MD5 d858ae7e5225b6db31afc3f2e2295a0c
SHA1 19e09af5c3b140d9e41c08246214581b05fd06d3
SHA512 f4fdecaa0afad85876c0205fcbb7bcf6b54ba53edb41adf4cd93a492b451aef84d54ebbf2fdaeeb20e4cbd96c500fc86a87792b890848f4e5f8d1aa2486d8853
SSDEEP 12288:L2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:LWnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1915523697965F98BFB1706F1488281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e68336d69918b65cdbbbd763beaf50c3872571c4518b8eb122529a93d8e44698
MD5 1c553f36a1a652c3bf86ed1bf12dd59f
SHA1 cbeac0cc07610e84c568f4663c747471ee9fbc4f
SHA512 aec6ba61ed50a1f3a682cf154afa3714b905253926c59ca7b19b51fda154d7aa5164d10ed082ba5178eecfc5bb15c86e46d4506860f85eccf0c8c1977107efa5
SSDEEP 12288:iSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:iSnQ/tbw/2Mkjy6Fr7g0od
TLSH
T1885523697965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 80514485ce8e92eb328c348296237ff2ca25a5b9f6efbf8bc326720e1919e2da
MD5 7dfbda9648259d14485318055d55155a
SHA1 b1e42bcf2391435b108d18078a2461b40da43ddd
SHA512 1670abf1e49d80355cf43a97998a6ee50077e4fd7775682aa604b7a195f41e48f6448323036b180ef7c29a28a81aaf4747ceae30eae29099cbfbe2f88ebe8d50
SSDEEP 12288:wyPz5L8/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:BzyfnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T13265021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a2efec83b6929fcc6fcdbf56b8fb16fff5bfa536d702f09a252a1f24f63705f3
MD5 ef9224106cd219d13a7248200779dd32
SHA1 c3ee12b539f3f1a3cec1d39d099ad38b6aca8dc5
SHA512 a237bbbd86f350b946d2ce8d2b1ab128ee3f64d43a01f57daefd0398a28b3bc77bec0713de13b43cf092ee9bee2c60590f93bb6851bec9f744dbab6324ea2be6
SSDEEP 12288:p2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:pWnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1845523697965F98BFB1706F1488281829B3F0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0f116beb82fad8f86d520e91cfbb697097aefbb4e828a9f27e4c94c856a39ee8
MD5 26f3c4bc0defbc03b06f2e5e8fa091d0
SHA1 8aa765d60d15ec4b21d5e3ba08bc3abe6a09b4b8
SHA512 2165bce0170aaab042761b43956f30f4106d2bc0c13e9bb0bd877a4e3d62cdf7614ec084a2cf4a69284bbe32c04626d758bc1460861ca5a77265d0a4e50c9711
SSDEEP 12288:L2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:LWnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1F55523697965F98BFA1706F1488281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 eaebb6b2b657060c60d662c66329b37487799abfcf719731de3652da09b79b97
MD5 a9c6f354e95ce5e6921360e33fa9dcb8
SHA1 7e3c45e2cba9e18e1584cad1ae494456970e8941
SHA512 b1ca8fe64302e62fc7662456376ef463fb70f9c1af468de25db938d3cb2760feb7c60c35d13baeb1b6e49ad3d0df741c796fe5b2a0d243248525fa42a79b3e04
SSDEEP 12288:8yPz5L8/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:lzyfnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1A265021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 074947f21a0252dc582d31136e89e5f99d7ffd0f298240754b21346fb7e989e8
MD5 34e21de28c1e09480d5bb8ef5cfb3dbc
SHA1 2d319195c5984c233da8df944324fe8131eb31a9
SHA512 f92109bd37df5c50965065f052da8a63d574e7298530cbe4651ce15f1648c8464990afe7b1d4b6dfcac35bb930153a4a5a8655795d1ec0ce6d3e59cf02d2f094
SSDEEP 24576:TT0aLl3z0zD5nQ/tbw/2Mkjy6Fr7g0o2:TTDLlj0Q/lFTjN4
TLSH
T12D7501A4B35068F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 ed1da55895e03cf03f9eccbd0a4f94c85c5022953d0e15b2eb94ddfebda7b14c
MD5 d4924a8ab0630cec7ce7818054c52210
SHA1 0a08e62a0c4cb7ce8a6147e62d973d0e928a0aad
SHA512 f58dd1dfc9a86eb5764b901ec1d008cd362453a3e0e8f26ebdd804521739ff94055f83f2b137d8f07a4120d8d5965a05953bd4297ce3a6955926a713e9f63c64
SSDEEP 24576:l31d9CHKy7GZ9nQ/tbw/2Mkjy6Fr7g0oQ:F1d9CHKyaHQ/lFTjN4
TLSH
T12785CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 44bef26e008863b13f60c2570a56a489001b83d6aca6f751f347f838f068970b
MD5 c5bd6c136120874fbed14016c72de04e
SHA1 aab0d8b3200c88d3ab27c138cfa85c32e19a91f7
SHA512 5c3a6250de0838c2050010d3f6fad28e73365fe1972c05b3e3d576b58e89bb4cffb2560cda8d4c9f76bc7526315dbafefc1e6a5d06138f731d904a3e72b0a305
SSDEEP 12288:BZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:BpnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1C55523697929F98BFB1706F14C8281829B7B0EC6BFD1938F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 bfa94032f620a037c3860121a8c52578017d49405fa45deed77d1d8632844865
MD5 813a6fb30ed899ab9302786d578fe8b7
SHA1 7cba0a9d061c5382a744803efccc366acd4f822a
SHA512 05f20ca7584b89eca4c3ba7f25bb77bdcf702609b2162af6974bd00d817c5dc1b936d5cfe0bf5a59aa7928f582aa051509bf7f60d39d83fdf95b3470d41877d0
SSDEEP 12288:nfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:n/nQ/tbw/2Mkjy6Fr7g0oS
TLSH
T13D5523787964F99BFA2B06F14C8381829B7B0EC6BFD1938F77481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 4203af3c34ebcccb6b68f86b773d943550680d02999fa1335837d87d779eadaa
MD5 2779ec6d6567fabab83469a1d0056ce8
SHA1 f8016a9559ed1a491ab938b70bbbe53e343c0567
SHA512 7d4de76eea3aea17bfb53447e1c88d31b55c1b7c4807e929e42f33e844419c4c7bcd11f2bf86ad3cfc767c21136f342be6242727f66a40f5f757d13d0711aca7
SSDEEP 12288:5MGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:5MnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1B45523697965F98BFB1706F1488281829B7B0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 d7e37cc25811d96155094a2a7905e5e74ebd8c1dcc5074edcd544ef9a7490dff
MD5 27d1ad2211d995892625e2c242ee5b07
SHA1 305b51aede6fc9bbb45f59af93847d58ed6bf444
SHA512 b4b5474681e407a45da11e299574acc74df647f9186afdfb03e65e9938ee8beb328ac4e6ae98b19adc1530d1c4397d4767ae65444c6df140023929cae9cd5b46
SSDEEP 12288:F2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:FWnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1835523697965F98BFB1706F1488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 278b2fb3e74be1bfb1da22374ec4ed54e27448a62b233b379f73ad2aadd23fcb
MD5 5cd38d36ceb9cdd636d0d51db876d67e
SHA1 8dc932fb54c8fad1565ee227627cd172ae71ee13
SHA512 643caf8ca9ec82c9e552842daa25ccc6589723aeace08e40966a502ef0d99121f1283058fdaaa7ebdaaceb9bcedb9befd556d70c68e326991c7397361d83378e
SSDEEP 12288:0ZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:0pnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1CD5523697925F98BFA1706F14C8281829B7B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 77f360041da1254089eeec6dcf1d9dfe738320122937012e60103a524720d541
MD5 dfaf1a3cedf32b9320c252fe59059256
SHA1 a8e9d3b102c9841711b965e0d68bb35ea6a0b1d6
SHA512 3606f16b17114c45668ea38cd3b9e0151053be1364a96fdcb23809cda5a4ae49fb782e37265db0e18613be02ca0f75d414c5f22dec8cc1f47ca04fb39a9a9d20
SSDEEP 12288:lOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:lOnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T12D5523697925F98BFB1706F14C8281829B7F0EC6BFD2938F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 a1aa9ede5ee2537fd97f97861ff184d72ebbda8042ac534053ed3dac48a389d5
MD5 040f04814e37853a16dbb69cc1598867
SHA1 765bf7d3f4f14ff5da0c2dd2ebac39f2a719ff29
SHA512 7fa21ca7b977e3af4dd8046c6bb0e999e1567a5e8fba81577d3dd78d531f8a6905c6de413157fba8bc7674f190899b11e7dad3939b9e96b46e92266d792b7521
SSDEEP 12288:7YGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:7YnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T18D5523697925F98BFB1706F14C828182AB3B0EC6BFD1938F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 e2a0b5d2290d725f143c17fca8413b8f62466e580970cf70fb5749a531785231
MD5 2d4ed7fec86688b576d9d96ff9fcf586
SHA1 d67dd0b47a0241498806ef2fac4018f15cb0dba9
SHA512 8280459f1af0ed2ebbdbacfc21d59bb88af56e39cae775c051cc79e316bf8ffe52c43fec0aef40f627a07eac206e4908d7c2c0058688505ec91e9545cafc76d7
SSDEEP 24576:kfwv/k9RX6wkyAIinQ/tbw/2Mkjy6Fr7g0oD:zMnYIiQ/lFTjN4
TLSH
T14D85DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 634006b1dfe9fcb89062985fb5e131b8999d1c92ab9eaae648d8393cf5f75996
MD5 9f094680c5faceae0b982574bef56ebb
SHA1 ee8bbdf21dff559abab33c370f7ebf41ad99bc8b
SHA512 9a692c49e4abae765a58f8a7b9aa0be8ed82692c8f4cd0f232c349c1bef65254f0578371b3eeaa2353615a03810bd8fbc6fa68f30520a5e71afcd6ace99ddd74
SSDEEP 49152:AYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0VQ/lFTjN4:uySzPyLm
TLSH
T109066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1db02dd3279b7b44d0df7b605d6ebb4d32b42579724eab057a1cfe998be647fd
MD5 7eaa28d7f73f0241f6c0af2d499ec272
SHA1 5b6aa8c15dab5e8c15895323de4aa9833bcac373
SHA512 9618cb6e8e19d8a99529b7efe19c9b5eaeba47f6ccc47e2e507d69f6c9e1e60dbb42d4590b254e57c6937667f5765cc8322af758bbea0a97740e5290250c3340
SSDEEP 24576:u47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYznQ/tbw/2Mkjy6Fr7g0ox:u47JUQj1irIhCnDHUPfF/lQ/lFTjN4
TLSH
T12C65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 0a6d1f738435d59141b2b60467897321711749fc420a02de99e7f6d200ede49b
MD5 807ee4dc0819504586815a1960ae348b
SHA1 32356b7a3e6a3ca67424bd3e7c9c69754ebd1206
SHA512 e00310473c89b2eb44de511b8bc576624047dcf872cb79ad9388004b76edad81b7340a45d350cee392d86599fdff0d0967a24f21c474671642c03114adf670dc
SSDEEP 12288:hssfmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:JGnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T10265F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 5887ab5e30bd99b70dea784be9300173f7920d575823e99b91092feae7b737dc
MD5 5b6d85b0c7c6511ca696dbedc882348f
SHA1 e9c72a976931ffee7ced160f0b99dbf4d7fd2b38
SHA512 e064dcc170a01a02d8543fb6db55dc845231b6fd6771f0cb21966c5c1f3ea522c8fcc61e00c0f903c95355dd2236449e434afa611d957830b53c0ee6c7b95ee8
SSDEEP 12288:iKphU3fV1nW+VpLEraMz0flfcLU4ddlIShSe8thew2g:iKjUPjWEpLEraMz0uLU4d/fSXGw2g
TLSH
T19A3528107626CB4FC6A940325E73D2CCAB707D06EE059B0773C9873FD576658BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 0ee8bc89770f987dae16863b74876ed7997bb6811193e3f61987a0c35d41a109
MD5 0e1a8c42051ce5e2ffdc018df3cc2b30
SHA1 592ec2e1b7aa5ec895cf0f05b2dc0d4e7ce9c264
SHA512 c64b5ba9db123b81e2410e1ad31e8c18cb694e06274b61a0cece168a4f49df632839cd925859adaff42e26c0d30410939b92ab1ee9466c20e703b54d75a55aae
SSDEEP 24576:gpLEraMz7saG316rosaG3+6rzsaG3X6rl5zlzgFsaG3X6rn7saG3X6rbsaG3X6rA:gpLEraMz7saG316rosaG3+6rzsaG3X6H
TLSH
T19165E880A537A78FD0BB6032072A5F4C6BA4EC1776455F22B7C9453AD86BB11B0F93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 6d9c7d7f9b522cc97e59427a735645ed0cb8c85f52bf162fd4947b18f7255838
MD5 e41b23a5227fe1066c213d7cd118283b
SHA1 4ae5322d89b6791a33135e9318d8e4dcab582a2c
SHA512 4e732b42285f0251a0685ecb1fcc3dd82381fa55e33b549d46d49e6f8ee2a1663e1e5805d84a7f265762d47af3c54bf890e2d900db9e04bbf3007f995390236a
SSDEEP 12288:f67+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:2+nQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1D35523796668F94BFA3B06B048928111673F0EC5AF90D3CFB7082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7d5c3d885e986a598639fbc3a65679408400234ef92cabc73a2814759e3b97f6
MD5 ad8d9b311992b546836ef93fe6de1f28
SHA1 91653822d4de842a4866d7f14acc26765c396aa8
SHA512 fc4dc3171bc1219280f43cece428112b786fcf86fd60cf122a42c514f80458747d64bc0b8e8ba1a2679e3692bbccf93b51b8276c1c5af360ea8dafb5a1b5ebb9
SSDEEP 24576:Vgb6bmBIi49WNNFpg1rSvFv7bY0nQ/tbw/2Mkjy6Fr7g0o+:Vgb4mBIBhGFzQ/lFTjN4
TLSH
T1DE65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 2aaf688214b42af1d966ceeb7a05ec91c0369a5450ccf0cedee24752ef664043
MD5 638ddd1a91be66be70fbf027d25ed5a7
SHA1 7bfbf315c562c74d22d9464cebd3a9bddf889ef4
SHA512 f08bc3e8842f0d0dd58f9795bbcbba6c277a1b4ff1870a574f52c91d81a55cb6caf9fb7038c4d4aec4de8b10ea771eb06f00b783aee639d472111ccfff1dc4e5
SSDEEP 24576:WG88u8FpJqH1Qzria7/mjnQ/tbw/2Mkjy6Fr7g0oZ:97ZFPqVva7/sQ/lFTjN4
TLSH
T1B285F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 8f5a989edc122da90255342a09325ef30d6b04c02011756ba732b7e3a339b50b
MD5 4a6e7012ba764cc7d0da9ce8b85d8fab
SHA1 ae6f48caa11f60804d3d8618e20f3e2d40cbe92b
SHA512 437e4901c692abee2b3294721bd7ad7bdfbc01e36a415bdb2508d9100751d9091815f47d24328df6e5b4cc29c84807f26259d491ba9e53a49d17a32528f2fbbb
SSDEEP 12288:THvUrBFrEjwaQnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:TPUr+NQHnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T14A65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6f7598e27145a7ae5c3e5032022b42370b03b39a5025413cdfe8276460941ccb
MD5 56d04861c5d510d7712ed8863aeaba6a
SHA1 dadba7052f0b0b39fa7dfdf7676a646a32cc9d9b
SHA512 eb3afa396645e986c6905a104e9f55466ade541c41aee9c53786bb83790c7b7afdaf87be015456d6128f63163d433078c3236057899fb5bf14953cba539269d4
SSDEEP 49152:lBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj3Q/lFTjN4:uG05lO43b1Lm
TLSH
T166D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3e2450d7a8d85e8b70b83467f9e17d283b9e32907c2bd046c8d0a09612e6f174
MD5 aef8ba2d98bc832e1ae98ed3c691cf24
SHA1 b04ee66c74014ed3ccc1717ab41a7656935a8ccb
SHA512 d30a6a665f20edc3865e91a3c58c68f4722117e0f386bc425ac0cceccf4a74d909020c7f38e2bb8dadaa913579c8c1fa69c7135e81a2787e84278ab504baa42d
SSDEEP 24576:+fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnVnQ/tbw/2Mkjy6Fr7g0of:ma5POZ3+Jt2pasx2+m/Q/lFTjN4
TLSH
T1D465AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d2bf2725d97ff32c494652ef6165170087b6f82c2bb879137734e9bebe1b43fe
MD5 2c99453abff41039f5117a7e486e9c3f
SHA1 5065899ea617d3e12808a505a9620345cc06e0e3
SHA512 659e714b74c3a0833fc9bec56338d7a653de2dd1760754252b19ec349ffc12af98ab3fe812af932ede16ab1829b5e0d888102c37ad6bad3585727b10f462128f
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7FkLnQ/tbw/2Mkjy6Fr7g0oI:SNc/zEOVHFMQ/lFTjN4
TLSH
T1E4858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6252209c3d9ef4637e8899a5cf563fe92a4ae6d09601bd4dfd2f7eba9822ca5c
MD5 5dced721a3361518d8897d1d9e02fc42
SHA1 fcf25dbcc2f2f0fe3f50a43b23b5fe522421e35c
SHA512 dfe086b9525a9bc73dd1f1b758ea59349976856cf60fa6f98b1425a220cf9ddaf54ca92b26b679b1ae352a4196ff36165c70ad0013d7015647b226da01da96c6
SSDEEP 24576:u8kNvNnaFeYhJNtmZBmRnQ/tbw/2Mkjy6Fr7g0ou:u8MwBtOmRQ/lFTjN4
TLSH
T1C655AF2EBAB846E4D1BEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 b9c678c7a28c8d85303fdeb4d6607439d7eea6b81668e6ad5de146e4d434833c
MD5 5732c1dd0b8dcd4582838e56274fe51f
SHA1 50cdb8a6327c8a2b8c6c1fa9f8ce41b399d1dd80
SHA512 f1e4d43aeb1c04b7a6a13d0d281a560103dbdf39bb250ef5f2345baaefdcdcc132ca27f44fa29a19d8cf613bcf4cecc043b47704661c9f5be140d29f823f0ab4
SSDEEP 24576:mD3FHshBIYQgAKnQ/tbw/2Mkjy6Fr7g0oM:mDVHeBIAAKQ/lFTjN4
TLSH
T12475E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/728-279-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/728-56-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/728-49-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/728-50-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/800-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/800-136-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/800-125-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/800-131-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/800-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1452-39-0x0000000001640000-0x00000000016A0000-memory.dmp

Download

memory/1452-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1452-45-0x0000000001640000-0x00000000016A0000-memory.dmp

Download

memory/1452-60-0x0000000001640000-0x00000000016A0000-memory.dmp

Download

memory/1452-62-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2416-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2416-101-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2416-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2416-311-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2416-107-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2416-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2488-0-0x0000000000400000-0x000000000056E000-memory.dmp

Download

memory/2488-1-0x0000000002410000-0x0000000002476000-memory.dmp

Download

memory/2488-8-0x0000000002410000-0x0000000002476000-memory.dmp

Download

memory/2488-86-0x0000000000400000-0x000000000056E000-memory.dmp

Download

memory/2488-7-0x0000000002410000-0x0000000002476000-memory.dmp

Download

memory/3464-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3464-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3464-22-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3464-13-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3512-304-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3512-64-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3512-72-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3512-66-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4856-326-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4856-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4856-94-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4856-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4856-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4856-88-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5128-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5128-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5128-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5128-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5128-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5676-112-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5676-120-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5676-114-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5676-314-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/6008-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/6008-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/6008-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6008-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6120-76-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/6120-82-0x00000000009D0000-0x0000000000A36000-memory.dmp

Download

memory/6120-77-0x00000000009D0000-0x0000000000A36000-memory.dmp

Download

memory/6120-308-0x0000000000400000-0x0000000000542000-memory.dmp

Download