stealc | 90aecbbe4d37573aa14f94679aed880c58308cd90e0d8e5ec4e13777803e6ba2

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 05:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.4MB
Sample260930-frkp8sfc68
SHA256 90aecbbe4d37573aa14f94679aed880c58308cd90e0d8e5ec4e13777803e6ba2
MD5 1690c43cdea94c05c860756263bfddb6
SHA1 afa6e53e59b7e1d6516431aa53aa0364291ca805
SHA512 c3473ea5d083a5baab80bc35ff594eeda6fa6a122aa4292b44b1234c40b058210c6d653b98bcf152698fdf56dde846ba278a196b7537543d0d7814ed7f19ab7a
SSDEEP 12288:aibwAEUmeF66je2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:hDF66jeWnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1AA6501353AE0D073E273207108D2D7B56BBEA9B19F61978B7B80177D5F343918A2934A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/5080-86-0x0000000000400000-0x000000000056E000-memory.dmp	family_stealc_v3

Executes dropped EXE 11 IoCs

pid	Process
4988	elevation_service.exe
5368	elevation_service.exe
4388	maintenanceservice.exe
5640	OSE.EXE
236	PerceptionSimulationService.exe
708	perfhost.exe
6092	ReFsDedupSvc.exe
4516	SensorDataService.exe
1496	ssh-agent.exe
4836	AgentService.exe
3652	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
	\??\F:\	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d0ead855b68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaws.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f30907f9950dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c767717d9950dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000338184be9950dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006f5bde7d9950dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005796cf809950dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000779292be9950dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000005efef67e9950dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000092a58be9950dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe

Runs .reg file with regedit 1 IoCs

pid	Process
5176	regedit.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
4988	elevation_service.exe
4988	elevation_service.exe
4988	elevation_service.exe
4988	elevation_service.exe
4988	elevation_service.exe
4988	elevation_service.exe
4988	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeBackupPrivilege	6092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6092	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4836	AgentService.exe
Token: 33	3652	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3652	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3652	SearchIndexer.exe
Token: SeDebugPrivilege	5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	4988	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 5176	5080	2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	91
PID 3652 wrote to memory of 4812	3652	SearchIndexer.exe	103
PID 3652 wrote to memory of 3992	3652	SearchIndexer.exe	105
PID 3652 wrote to memory of 5100	3652	SearchIndexer.exe	106
PID 3652 wrote to memory of 5064	3652	SearchIndexer.exe	107
PID 3652 wrote to memory of 2788	3652	SearchIndexer.exe	111
PID 3652 wrote to memory of 52	3652	SearchIndexer.exe	112
PID 3652 wrote to memory of 1020	3652	SearchIndexer.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_1690c43cdea94c05c860756263bfddb6_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\SysWOW64\regedit.exe
  C:\Windows\regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\config.reg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:5176

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5368

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4388

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5640

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:236

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:708

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6092

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4516

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1496

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4836

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4812
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3992
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5100
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5064
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2788
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:52
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5110bdb6e5b40bdc9092335b3623cb5aede5f5d9783324ef0364469e2184c8b7
MD5 eab3309cf7e8ab6364804ae8f3a9bc1d
SHA1 028c2187c147a235ff5f3be984eec0a2a95223ff
SHA512 3cd9df21ceae251f7ab8eae2082f8e1ef50b7457da34ea0855f021d3d7efa72d36c132c7974c8ab96f551b94db775f76e43109fa8fe9857872ebbad6594ad23f
SSDEEP 49152:pb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn+Q/lFTjN4:/3q6HjBaLm
TLSH
T1C5D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 04ec9561bccdca0135157d6c006586ac3e1141f1ec6644a58b155173580638b6
MD5 f77146ef92225589466b39b18f554fc3
SHA1 c9fe6223e96028cd91eeaaef607e4fe5e72ca3e8
SHA512 cc519364ef36ffd74a07ced65172f8aec0a1a6c63e646211e5fe97ae55b6b53ce42c4bd89796d9950471d8bfd141d8f0c9d815bd80ab60115162b50001ab76a4
SSDEEP 12288:c1XLsswWkxy2lRq2czA5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:qXYfDtczAJnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1C165F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 de88d202c39acf067bf0925bc063aaff32334bf222019b110d21510f9651da12
MD5 80ec723e729d9adecec4e93057553696
SHA1 18d208f20d31f43fd963ea951428afbeb14a720c
SHA512 f58c060a9f0f5c10e2af5388ba812886b336f5bffbd6a1f7a53cd5bdc3348ca8fb594d1db16977fcd13beedbc4bb4db379719cc8822e9947704958954c022c82
SSDEEP 24576:r0Le5ji0hmxLrMWnQ/tbw/2Mkjy6Fr7g0od:rPji0AlnQ/lFTjN4
TLSH
T1F8859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 95b7c878199c2983aed2b3b0e3949214bdf2fcaebe7706b9f03eca277baac1ad
MD5 f1c5d7d9ea30f3f5a8ca50a49811e715
SHA1 64ba30a0330bce085eddef79b0d104c1b50f4ca0
SHA512 334513639a36ab723836624364f9e9699d77a6d2a43fc3790c3266a78c394fe9416a0cd9fe25dd8c942d47904f21172919280b21c919bea4491e5b4e53a7fe2f
SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWE6q8wyuInQ/tbw/2Mkjy6Fr7g0oe:I/ezSC6vUzPvxHjy7Q/lFTjN4
TLSH
T121755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 68b35f3d811a0e7872b9b5f5fe262199129a31e01ed4026d358579c623c9e5ee
MD5 d9d736901faa8c1294e47553e460763b
SHA1 84404070a2296dd5c12c22382d4f26a98185a9b2
SHA512 9412a9db29ba95403c664f010d9f5eca77bd933486942bbe799eb3537ae06f34f3f163389e8a592067030045a7f0cabe36afda59d63e1faaf352790957f018b8
SSDEEP 24576:PVbqPb88hv/l+6FnQ/tbw/2Mkjy6Fr7g0oe:PVO88hXl+aQ/lFTjN4
TLSH
T12A559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 74978d61ca5d7b15be4f03852796291d1fe1e31fe8077a8dcda0667db8a3b0ff
MD5 474f43900648bc97a2f94a2126b68bb9
SHA1 5dd810e78c880a584fc5819ef0266366e3fd1a26
SHA512 7a6ed6fa6fdb3a9d1cf7d4440e33c6f7f8ba4761f956b8aaf95eac7eb9ff4ffbd9547546a21a78ec5b096499a737d0498312a964f0f696ec191cc53d096e8dcd
SSDEEP 12288:BziGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:BzinQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1A85523696A24F897FF2B06B15CC284826B7B0EC1BFD4A74E7B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 84543466dfff602576070f88731287d5ed48d98e6ce4980d5e2be802dfabffb3
MD5 73ab081dfb5b6dc0a3d4d005ef453f7a
SHA1 80cbaa690d7e5878df46a3d2934bf33208e6c598
SHA512 2f5fcdbedecc43dce0c3463f289a092066727220c9842f5468677c9fb52b5d7299d81e55fbd7187535fd100b50d14b991232b531ee8d6ee44770fbe7c1dfdcbd
SSDEEP 12288:feBNUbTVO86UdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:fJIU9nQ/tbw/2Mkjy6Fr7g0oK
TLSH
T13375CF3BEE28FCD2C27E4DB85A918640D77278704F61A3CBD164820EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 70b78a08d8eb8b659c3032322085cd0f223163ddf7354df46030f1bfbc1d5b81
MD5 723963e4c85a70c53e9522ae518e76d9
SHA1 410fe34233da06c52c565798750d45e6b88a9f3b
SHA512 2f1a63ff7d4b1b3e276566dbe5d72827a93d235c1fdef04cde604e653cc85bccc546cba2c5716f39bc33598f632c347665457816ebe839b39727178912538096
SSDEEP 49152:9QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH1:9QvGAdlCEL8c/yRNw5C7Lm
TLSH
T1AE267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 6618516291ce8a87abc26be30fb67ed9ed62f346c043e1ccb773ae69b138b133
MD5 83a4f8e6bcaa9439e8bb87770a5855ce
SHA1 1f2b3304fed1a4b944fbcadf5503881bc2fb1b5f
SHA512 234318f257a5b28a31ae548e486821d22a02ef0dccc841230a055080c4a477d0f3e2464bfa4bf52090e2a3f75b3bd39298d06d87902f898a7e1280a8cd19ffdf
SSDEEP 12288:9AwSfxL/2Dc39DLLmt0LDQewsAjXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgt:uQewsAj3nQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1E675E031FE74E436C77F0DB61B22C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c2ae4c170bdf6a1742201dcd2183298b1a814db82b01068811689c7d2b9c7cb4
MD5 53b026bafbf4c0ff75d1e12d7ca43bb6
SHA1 8fa5b1da7866e744143959de4cfe155884099ff9
SHA512 b8a2600d972fa4acbead6244581b0138d8db8e01755d8b400634563ffb792d078f2c5c8603bb315ce8b57680e9aa39639dc2edff72058b4452e19f0940526881
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHUL:sUEtQevvqc2W1cpV2EI32
TLSH
T1EA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1e7af6098a37084ba4cb5d600db8436fcf908749953b4cbc77dc4d62bc293484
MD5 a5b5f13382c5cba603d696a5ded8cdc3
SHA1 3ec69c4cc7cb2fcf7837a8328b9cd6ed342c8307
SHA512 cc86f0825805b842ac00bc9a8ef3aad5568a76eb4e76aba62f7cbc2d6b7ef1113e3d8826e09be30c11d7ece773fdfb9b0147dda89fa20c0cb44737cb0eee7038
SSDEEP 49152:WCbRquA/m2yL5zQfFiV+XenmE3/zXQ/lFTjN4:boqtVjnmfLm
TLSH
T100D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 de0b2a02f4b9982951bdbb3c7d8d95f13b9545777107d0d3052105782ee6a69b
MD5 a2312d432eee8bea9f2241172f2f2d2e
SHA1 6de82202f226986bc655cfa91f77d2098234beb3
SHA512 9ad5bc5bd700d78dd54447a83ba6b1de5c79f312c3e88d0b9aecdbce44b649fa35d37b1307a2ac618595ca8e8cc17cc2b00582117ca09de4e85792ba7434ead6
SSDEEP 24576:TAhGLJIFoiwtA5l7S53cnQ/tbw/2Mkjy6Fr7g0o0:TAMyFoiq5MQ/lFTjN4
TLSH
T14935AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 3a42c6bb3231f452540986944b20294d4da2d9aea2f2e44c8d6710cc719ca100
MD5 1bd57a21d7eb4202ac19859747a27435
SHA1 b3fb79fb01f726675b3e558be4f949a1057c8728
SHA512 015f24e21353096d4c2670fc7270008044338ca0f7d89d0eb4e5551231ae721591db9c0816c13c00cdbda1e531f0dd39cc8747c63135890f9e69ca1a98064d9e
SSDEEP 12288:Tmw5HEjsChN2BFgl0WDm+CoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMB:ywuHOWbnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T14465F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 4eaf44d0f15b95dbdbfad359185b0f72db5b123f937502e0e4a93a19bf8ed4a2
MD5 f5d628a73858c3df2188c29dec9b8e47
SHA1 4f06001a8c5af43b1fca5d4a3ffd55b55afa4968
SHA512 e0c076fcd816c031c240ee453b95a76ae401b8ab33c8339a9127e0a4dde1b967600a55aab9d0fa4fa769c32c6279323d24debbb2795440d9048866c53b3a4e67
SSDEEP 12288:cXZ1IynGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:8ZuOnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T16255126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9f165b49fe6fc6856d4f2008971472d6e434f789dbe8eef6004bd9f3fce8cb99
MD5 c1c33f5990b1cb784ec44ec43c4d1d47
SHA1 ffe8a7b6cf4c62b253711c3a90bbba144f0074de
SHA512 0dc584cda0949489f32b827ad8ca6ae50ac491789aa777c858ea598bc4a4665aefd395248828b1fe2cd2433a205c3b3d5b8cc788809bea7cc6384fddd22d071a
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Up:LQRQyi36YOcPQLvw2gAf+PN3GLm
TLSH
T1C6667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d8d40699ad07548a4fedf02530e7cad9c03dcb2c72e09d721ada435935592425
MD5 2197390d17073743f271a63f30768329
SHA1 843247b158855046c3e92a41077b59506df48a98
SHA512 fde1e699cd096d776f522bfe61a1a2da6400d08487407f00e6604a8812c557131ae9f5fe21a4d95d266d8b09249e57faa7b479ed1846708fe9cabade336e2455
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Up:cQRQyi36YOcPQLvw2gAf+PN3GLm
TLSH
T18D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 63e5186bf0c88e21ab6febdafb27fc4efbb32772a2714a0c5460a39ca83c690f
MD5 a7ff40bc08bc685628a85cb80a34a6c8
SHA1 a131f7fb9453cb361cae09e0cf824ec1993596cf
SHA512 1ee462cc3e4203044dac0275c380190f3263b61580b3120c9c83e30b74c158a365643d3e3b2668fe8764a6cb79031d52587f99554c42501c23aacc7c15a3e9c7
SSDEEP 24576:5wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0+nQ/tbw/2Mkjy6O:l68Qg55nhheWu7PNU3/nQ/lFTjN4
TLSH
T1ACB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e0f0ceb2eff99f829c814eaf1b82756ce4f94bc37f0c482138dad5e3c7ffbb68
MD5 c09619eaf6bb73fa28315084d490c3d8
SHA1 11b497ddabcda108f48c89560eb9af006cdfb8b1
SHA512 3e1f1595605e7c96cd7f4b16f5acc680f4e92da9ff5561f8d50c9502e18a547a4dd9d3acfe1c2a937f53670aad8e41e2a3ab7f8bdf8f115dd14391babf0228c5
SSDEEP 49152:h3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99f:gy5112gYy5azzVvL69nLKnhZtLm
TLSH
T131167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c7f350f878cb29dbf9c64a55d42e5cbd2214cf638a326f67a6307ab1e971124e
MD5 77d8f131327c36e6139300e7896f06b8
SHA1 d1109f4a826238fdf7d77027dcad0093cffb8664
SHA512 f25b3338775992b9d8ae2aa4293fc97d6d25ceb9e14f00993bfe0b662febc39682d2021505f538c1c24c5e166b3a3e2fde96318c4ba90a426bdc6095a610521d
SSDEEP 49152:YB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl5Q/lFTjN4:yu6JmVxd2duLm
TLSH
T150D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d8c8dc6df70f0f3a7a36287a0a0ff70520cca4c0257bea19f6e5abda348f71d2
MD5 e54f64c3b35f238aa835843da8277a9f
SHA1 9f0c9428fbb070b784122475f720bf4b1c528e57
SHA512 123858e63aa41b80d77f6a4e1b7a866fc0bb1cb5e57f759a8ca2ce7f3e6b43b9fe127ac50563e9d1fd49a1b802f073dd205e7585769d72acabb928ba020f3cdd
SSDEEP 49152:X1hpsNoJpF1A6UU44CwH7R4xdQ/lFTjN4:XmifPbRfLm
TLSH
T183B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ee9876cfd24f84cda04f54694ac47de4934e98337d5499cf502db245eafeb99c
MD5 1eb3138efaae7d18a555cdd80cb0fcda
SHA1 e30b8679d028fcca77524a6ccf21a5a58ee009f4
SHA512 3659296f0b14d467af224ea7dde98f9f2d00dad5b1242b3816e79d18b5fd33dd8de0f9f37b7314d633280bc81f9fc8483ec63dfe935b83f387839aef1bd93b0a
SSDEEP 49152:NSuZQIY0Be2KRRVtOnks6NMHqOQ/lFTjN4:D5dKTi61pLm
TLSH
T16DC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ee08004d443c5d66a524978e8b9d773cce35b029fae68340853eb6071a765eb9
MD5 dc266a2b84f6267d9b2b6c51433f9977
SHA1 6267410ab94b3f23aff4c7a8397ad18bda0324c4
SHA512 52e28f035243b88bb2c5ef01eb620440332e5233ef54cf76c6cada8d70d9797ecddb7c459bf76a0ba3bf9959299fbb744624299eb73351a726687013488f9ac4
SSDEEP 49152:zhtSn8EApI0figngiDn0AP5wJQ/lFTjN4:yX2iyphTLm
TLSH
T14595BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 484a15366bb1d5c140294a007e8e0970292e2a0764d59323d61de44add65b067
MD5 ac93e7274f0706ab5d755fc0d2f996f1
SHA1 34bcbd3a3a6bda7c3a411f7b5ee820f1cedfb389
SHA512 fbaa8e6a57af7d1df1188782cff833c321bc0df6ed45713b88216139aa923b48ced1f4adb821b9c47519d507b53981504028f5cafe30a30ebfaf168cb182a901
SSDEEP 12288:7aGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:7anQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1815523697955F98BFB1706F18C828182A73B0EC6BFD1A38F77482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 92813dd91e26ea86a113c989dffb4156c26bee87cbcea245e8d9d8dafce80592
MD5 d9130ce8381b824cca5b0480ed8d61bc
SHA1 de17d7dbf3154f55dc11cd1582763e5587b23b8c
SHA512 e48b986db87a367031ce7cd973b813f11b80683f0ca388f068c90db61138adbe591dab6a597245596a0adbfc5eb5f713631391d682ed92bd690a1ecbbfe85a6e
SSDEEP 12288:1zGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:1jnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T11F5523697965F98BFB1706F14C828182973B0EC6BFD1A38F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 192601525816ffee7cd8110536e4cd40d8d6008068175511bd1323163e847cf2
MD5 4f9cb161db5a00da430d2fd446f0bea5
SHA1 b302fb286a2df52125075c167229c67b4ab34397
SHA512 041b1b270e0d1e579e23e94e8a8e8c51d96c58bcab0aef6ea1231431bd592d84fd2944676d79f76474d1ecba8c2c7729e91000c8f51aa23a38b003af46d28b4b
SSDEEP 12288:wVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:w1nQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1065523697965F98BFA1706F14C838182977B0EC6BFD1938F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 c64fae70aa493403d9039bbb7595a7df7222b11d390372b9270703dde965823b
MD5 bfc184c7506b899edbf4cde5b7395645
SHA1 dce92fd53279bbb070f173616eb1b00b43b61588
SHA512 fb0c9b4e0a5d7ec1c6289ece6fd6ded916551ce85bb5820be4b386e6c6a83e4aa8b66cc0884eb495f1b313e5b7aae770df58d210026e0476754a6953a12268cb
SSDEEP 12288:eV8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:nnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1A05523693A69F4C7F92742B4CC928142E77B3DC5BBA1A3CF6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 2c85919ee1576b2fc7317781ca5faeb28bcf7524a2dbdf3cb41b3b43ba39feab
MD5 911295d926094e69acbb881fc8eb49ea
SHA1 1a24d4036851e230b8f2789abe36e57afa5c4228
SHA512 bea61a6f2647622144b26803127a3c95675397aaded0d842407bc66f57731ba3a2a4279b48c33bb0188b9b7cc1b07c42fd4af4b116c44234edca673c9484eacc
SSDEEP 12288:TEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:TknQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1535523697965F98BFA1706F14C838182973B0EC6BFD1A38F77481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ef34a801fb37003d78c16a2f8f2ac56b0deddbf91313bc240b5209056f19f4bd
MD5 46deeb676511c2939efb864c70138e9c
SHA1 20b652de8d1c28cfe9a26340ca7cab9b611a8232
SHA512 4fcc0f8b111ebd40b0eebef27ae074e95c5602bf4b50bc8f5a270227696bab969d79036c449db7dfa3ad8549db6acd9dab4067c797020a2e1a92ac27072b7d56
SSDEEP 12288:sPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:svnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1E05523697965F98BFB1706F14C828182973B0EC6BFD1A38F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 869a5ea3f0342b2f97417a2c2f6aaef61b078633056cd9070d231ed6d76c9b1a
MD5 3b5cb6d9b50e26f980e95c79e9c09580
SHA1 d1813f0bd536ea0e7a7dd81c5eff18fa579b90f8
SHA512 1150cb9f3a875acb6fb7dc8f77cbcb4430d2e7054cb59defcb58240cea461f2f33a6e2da99375a17c295148fc22fa1d348def26d9acb3af0fe7fe524ca30a88c
SSDEEP 12288:ObGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:OLnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1115523797965F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 3f86be7fbd0c3ce3d4090b504487947754d03c23c9cc7579f27fea2cc9cc15c8
MD5 f4457cca51bd1252726d4702026e39f9
SHA1 2ecaf113439e694c4b6610fa82f206bbba104ee5
SHA512 0170037053ea9e2aed0c1695eb1756531259ffdebe7122afe5bb13a3ea1e104c6378c6af28c67ec1989e80a52fda611d9011cf1c94319177b8449ab605a557c4
SSDEEP 12288:ciZwbDzzFEoS2cPvyTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:/ZM3zFVSODnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1A57501A5B39058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 a6500b7b80711f432c026c97148cbe67cc90a7c8e16fb2ac52e9c85b68b4182c
MD5 2322820eac0db6864fad2b9b76b27f7f
SHA1 96ef47260f9478cafac7f0a1a82b50a33c936b74
SHA512 ce5cafb6fb476584a75b42de96b613a8306fa42eb2759d6c52f11dcc3cfb52c085262be48ceecaa097acda0473b50eef24e2c5397c5f374fce8954d8155a2b14
SSDEEP 12288:XeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:XenQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1455523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 9bfb620bb77004e06114c4b48683b2d1659a52d19e7ac8a1c759ac7d992f00e4
MD5 3e470d77cf41b76e4961fbcf93670e0b
SHA1 37694cf745815f8b7816c53296a7ddf9c6f05703
SHA512 798a6810ce6af92e9d3a4703307832b6fda444c71af242183cc3d2c19d3b9f18f3a50306da928d3d5699e1af219ef10df2d21e6fbc142da204c97ce8b6e16c17
SSDEEP 12288:OyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:OynQ/tbw/2Mkjy6Fr7g0oW
TLSH
T15D5523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 e647126eff73dcd08f7d891b3682c78f61d552216db34193f0c857df5e84fdc2
MD5 285b9bbb2e1c7743ecb2a443a2002c35
SHA1 f8d237d0aa0cf158ba7646634bce4948fa196511
SHA512 fb919acc8fedf38dd06b135b042c68b7dc7bb27f91e97f1983c57650e231132af01b9191c5293d8dd0b5a585942cb140f8d29d5907549443b3bc41e4782866b9
SSDEEP 12288:fyPz5L8nGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:SzyHnQ/tbw/2Mkjy6Fr7g0og
TLSH
T16C65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 17ff870707ea0ddd5d733f63d0996c89c0e581d847c975648ea1ef4c4e4cad5d
MD5 c12c71a4fd1bf1e25f1f9b4162d54a23
SHA1 04ba51ae97839eca0fe81e653df72cd45555d6b9
SHA512 e0955367aa0288e2f0bf53dc05006b795298ca6b716df24290960f8f42463c0ea7469fd5e2a8b234ae3db809be27db0fbbe3e73e7db5d6cdc834e3b1fb93ac11
SSDEEP 12288:3eGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:3enQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1025523697965F98BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 8bad5aeed6317becc38932ed91daf579a4ee14622d62312bf13d26b0c0b97794
MD5 8fe371c7bffc9c252d6ef1bcc0375765
SHA1 1f7b65f9d21d60dcddd84bf07b2bbd45142320b8
SHA512 8eda39d4616df4706b03fd947f58de7f31c3b389a2f7184ee35d9a1ea3801e82ee2822d662c4d64ac69be9f1928d3ca942084b2b2b196f9511f421c45218861d
SSDEEP 12288:eeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:eenQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1BB5523697965F98BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 05c14cb0cd903b1c9b219508790c7ad2cffac1b2150db15acc6abfcacf227538
MD5 0680ffa38637ee92c72a6d6635bcd6fa
SHA1 238634073080f646a786cc85cdc09c1fd81ac9c9
SHA512 652dd4771982a5c47930677ad96a88a722ddd222107d9bf6d0361aa2c551a4101b6ff0f3b6ab62b1315c2cf2978e2b24b1f7104cebe30ca925324c54c1b65231
SSDEEP 12288:RyPz5L8nGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:AzyHnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T19F65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 cd7e06e0c0e161c96d4e8908aacbfa9b06f8c838627ec7860b592dd78f479287
MD5 ae3239e57ae42e0045e6061614f0e5e7
SHA1 27bb7dfe65da52251f0cd5dcbbe35ff6bda8d10e
SHA512 f770dae3d63842a52436dc0435ed6d0d0fc496fe6d906b324c0814810ed114f9b66409c4f59ef8ede50d4257b3fdd0967880786ed3f2fe4b0e7fdc16520bf952
SSDEEP 24576:nT0aLl3z0zDlnQ/tbw/2Mkjy6Fr7g0oq:nTDLljIQ/lFTjN4
TLSH
T14A7501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 4c3a24e99477c8721a0f6309e4d451137a3e66d1e4364d12f55fbd64a89bc773
MD5 39e403bb0d3f94e0398bc079f4e6e48e
SHA1 4e5afb25ca2b5d0515b1a684bcdfc31eab139e08
SHA512 c9fb74b914a37e0f0f96dc481372766a2289a175e365dcff4444c08202f79e7a2c08552e8dcf9693798cd49cfc6680c46b9942a3e4c09056c353f8f6cdb4ffd9
SSDEEP 24576:G31d9CHKy7GZBnQ/tbw/2Mkjy6Fr7g0os:o1d9CHKya/Q/lFTjN4
TLSH
T19085CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 cb0eb8fcfdacb6b6909c15d0cb3ec59d0d776908628b05de794bc8e64b5fb65f
MD5 d2e1a4b60e9b0a0348a187d49ffd8fcf
SHA1 47d0c5694187e60cead982e0ce8d0178305d9d3e
SHA512 65d78d78d982abda8aef22888631fbe76838ce0f769a5fa25a68591c5260d25fcdaa900bf5eacedccd31f079d58c77b2d3a9b524bece027fbe414c31d9cabcfd
SSDEEP 12288:s1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:sVnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1725523697965F98BFA1706F14C8381829B3B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 be9d16e5cf8bc2c84275cb7bd2ff648094b9106f708cbf279ce86b153bc463d9
MD5 ff33e051408a0d78630c4410b1d227f0
SHA1 b2991609b18f0d51dc172a583b1bd00956c36c81
SHA512 93e3e5accc23ca02771ec4927eb2a77447109286c82911e47aa87024ff21d8c293f39e28e4295c4fe0f638daf744eb2dd84fa5f7c4c2e331a3688a9dffe23212
SSDEEP 12288:HHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:HnnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T17D5523797964F99BFA1B06F14C8381829B3B0EC6BFD1938F77481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 5e84f57a9f1d12c067535de953578afe83451df1f6728eb906ccb5be37466053
MD5 4f7b39bd0783527824a17e02d8d52141
SHA1 8daaaf45bb5c45dbd8ce66738019488e2d810d7e
SHA512 a961412413d2de287e476cd309c3eb043d766e4de8417a90accdcb94a66ede33a382837bd5fe59371743f2603884adedbaacbe84f8b7734c0bc6e969cef6cee0
SSDEEP 12288:TwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:TQnQ/tbw/2Mkjy6Fr7g0od
TLSH
T14B5523697965F98BFB1706F54C8281829B3B0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 7b996bf776693a83324bbc5b1484336be9ee99e324d1a997c64c056f04c51e6e
MD5 445e4aff99766ec8e0638535e547f3dc
SHA1 49cfa3e525862ae1ee00df7c08a4826dacf51bcf
SHA512 ec060e1769aa1c7ab0895f1647b3344465ecac2fb6c62dc9566cd69da64ab1d2e527ebbab97e7844e967a2377b0aca10400b23f0240fc42c9d55b1ff157a1847
SSDEEP 12288:xeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:xenQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1D55523697965F98BFA1706F54C8281829B3B0EC6BFD1A38F7B4C1128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f31130aeb950a99b9fec7c3899cfb6b49aea61014a8f73c1b5d8e1f14fb87366
MD5 78f04ee6db9aafd30bc85f8d146c2877
SHA1 5be860ff382a0f8f79a4b2bbbc6e8ec21225de00
SHA512 cdc039271965649fb1e743cc9e656f1ab9d60512995d0b535d4bee08e9be3e5693a56373ed2fc9970b9abc2a89d8c8bd5dc81b2c2ba81a0b1d3029da8c65eeb2
SSDEEP 12288:F1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:FVnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1905523697965F98BFA1706F14C8381829B3B0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 59a8f669b1c7ac5483f57c557206be54c2b9646963575cb2199abf8005998f24
MD5 bc8521498a0f413630682a8828c7431b
SHA1 1821315ee1e70d7caebe9565c4b0a28459bc5d1d
SHA512 2a33153e294effa48d0562806cf8a67483f6bcf66e236fb7d5d0ce6ae0f39bb61ea23812c76c4052fb4a064e534ac31c2c58dc2acf0d1b0bfe4ca95f928d6ba1
SSDEEP 12288:JmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:JGnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1845523697965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481119967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 9a8d2b56ceb19367a417194ce29958e8a40e6a2bea7617e6af524c25f46e956b
MD5 b1af49ebe110270a427217117061fd53
SHA1 667ec8588052e8f039fcd05eadc958b406b83dfc
SHA512 3e0666e6a0d5229f6672758f41ba81e4815a9fded6eb51bef3fae06bb658548b4efbec0032603dfd23077756d7d7b1f2ad8261afc2a0801c4033b74ed98accd9
SSDEEP 12288:GEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:GknQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1145523697965F98BFA1706F14C8381829B3B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 222b91b11b435288c4c4045b9261a734abc1d419e0d0572816597072ea6620a3
MD5 5d2122fa54fbedaec24ad3745d55fbee
SHA1 c859486fe5c7548e1801dd001b5ae4a274e83f7d
SHA512 3c8e54a66be3d31e8d6874b3710b5b89e2c5cf3c9efed94f8c8c6739431b1d51a633da201955974365059f5b0698f5422805fee753c33de0cf7385c0d9e37ad5
SSDEEP 24576:Sfwv/k9RX6wkyAICnQ/tbw/2Mkjy6Fr7g0oM:JMnYICQ/lFTjN4
TLSH
T1A385DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4392756aa97ac17f2e9ac807894cab9299fe04a4cc736d66fc828d606f996433
MD5 e2e3e714dccf2d43ab7e1d914b9a3909
SHA1 b67ad4294f74a1dbf4b6ad26f78f31c5ff91280e
SHA512 b1beb3de656dc88933d4f36d61a95ee131fd02ce7f02d1c2120ea20e19fdf5e6898385ddbf2b6bb635e9183ded63132a4b73338484833ae8cdab47eb1ab1444c
SSDEEP 49152:8YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0pQ/lFTjN4:iySzPmLm
TLSH
T198066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 193bf0ae2fe277b2d79440fca00766edfde41a6ea4da98703a8e86a3062681e6
MD5 2fe175d8a9f64bf0a4df618df7bfbf69
SHA1 93152e8eeeebfaeef1fb4d17dbe63f9fe510760d
SHA512 892438bad96d73d8c58394afeafb279b7427ee9c2a0bfaba2aa392653741845583847ad313a6d7e9f1d3fdc92b0f05402e279c9b1c51bd18295b9dcfb17aaac5
SSDEEP 24576:y47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYTnQ/tbw/2Mkjy6Fr7g0oe:y47JUQj1irIhCnDHUPfF/5Q/lFTjN4
TLSH
T13565AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 4cec0d4d8aa1b36740d7438304b9c4de2c21a80858ecdf7d2e48093bc8c5d0ea
MD5 eff678e7cdddd425930ffb5515b4a8d6
SHA1 c8683849970c5717b85c7e98b7363b9785955e21
SHA512 7794c57ef5e13239ddd51cb1c313fbaaede614aab28546b06c46edfb6461e8463294747328a0bd2163513bd135d76c9e5cd75fd986ee455f492c3c3e5f7dc7c7
SSDEEP 12288:RssfOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:5OnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T17665F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 7be28b064897c48378c8e43141cc1326409f71983f35e39a41d21daddc5e687e
MD5 0d3f8101e66ec1b50b8e848a860ec60a
SHA1 c3413e11b21d19063c0a8e8aeb155d771d274313
SHA512 a08f615b2424523ee938ff428be40e7c8ffdbb6825f31d6ccac9d836c666810c04620fab04a50f6c5e43fd158f54b104ebba6eac4f252cd2ff954f3f57e8fc96
SSDEEP 12288:qUbX5f44/YBmOMj2PAfM3SS/WTTI/wR6Gg:qM5Q4cMKIfRGM8/2xg
TLSH
T10D3528007666CB8FC6A940325E33D5CCAB707D11EE05AB0772C9873FD576659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 ed3584f532058aabbe44e104c1f979e17afb266e7e172f268401428d271dd0ba
MD5 cccaeaad3fe91e1001683790080c5238
SHA1 6e27c3af79b36eeb0959ff418365cc7f5a76b4d9
SHA512 4591dd4240480dd6c2c129a007a7b87d9678187bda1c7df982d90e86d2b1b36421e4b75838838d7a8f3873c2fed0e986ce71939e07832595eda71aaf7b2234ae
SSDEEP 6144:6CiZNK4EnEPC5SCoSTlI1ry+cFc3ktMxANktMxAnlnLHn2u9lBaeF:JMg0y5G+u9lBFF
TLSH
T12E65E9415436A78FD5BB6032072A5B8CAB74EC06B7096F16B3C9443ADC2BB55B0F93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 2400855d84a900b5189ae04b82626ef92432c6d8233541b1be6a07eab54380bc
MD5 0d29428cd41cf3d0d9dc8a18e6ac497c
SHA1 2d05efe7e3c3f4fcc219b06e78b5733444785e03
SHA512 512d4aff44b823fb1e34ba6365ef28bf3291be2007a21c0d7a240f0c58c0cbae98b0a2598650930953370c83440094b0938e1e6818a2374994820903e63a6fa7
SSDEEP 12288:m67WGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:J2nQ/tbw/2Mkjy6Fr7g0oE
TLSH
T10B5523656668F94BFA3B06B048928111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 cae04856320c8f9bad6ed2040ef3ddf57c19aabba1372eb6769a46e672fdc2c4
MD5 018beaa6999be1a2e85f91c4fda907e8
SHA1 fab67296ec5cef16c5be639dffe69a6b543e109a
SHA512 8613e372e77c38f6e03ae35b7dfb25409ef55b8edfdb0f51678a184eee148284830f27959592286638d85a6e2a239039b52ee30c724ce58f7f92ce7853b2b9a6
SSDEEP 24576:Bgb6bmBIi49WNNFpg1rSvFv7bYInQ/tbw/2Mkjy6Fr7g0oF:Bgb4mBIBhGFTQ/lFTjN4
TLSH
T12A65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 c9b6364d1a4294454542fc3c2784e8fdee5ee3b1ce53655716921d31e37ffef6
MD5 a9006b6a3051954b4272d78c59f86513
SHA1 2f9b10eaf01d6c3bb43cbbcb505af694a81cd8fe
SHA512 8fdbf815a87601232e6437790182c1d6bab73df665f16da185adcf4153881b1e66234db3d9316474c542383949b269e47f5b83f4d12eaa5bb9df0fc499998f04
SSDEEP 24576:6G88u8FpJqH1Qzria7/mDnQ/tbw/2Mkjy6Fr7g0ob:B7ZFPqVva7/wQ/lFTjN4
TLSH
T19385F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 23cc70792a6a11250c3bf30c823c996429dab36b094dcf557e64d4c9b568b484
MD5 76939a9eb86c34c928992a9d1850cf1c
SHA1 f5dde4931af69a67ce998d3638d07d2d03878195
SHA512 4a6c8909114435a5f4ec1ae402dfb2b26bb8e994da27e0a658b8181411dd15a1b3d13e736db45c2d03d94b7ebaac34e7a7f3b500c12e35d4ddc16609c78c8a01
SSDEEP 49152:3BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjvQ/lFTjN4:oG05lO43blLm
TLSH
T1F9D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 14ba1b339d2ef9adda65254059d087f6e3c7f2da1c6e16c464555b0cdb17640a
MD5 5fb14918845360fc91b3053fe44b48ff
SHA1 73a4454e8555b579311d5a3fa55edd53493d1a89
SHA512 caf4c671074c70a14fd085c99a303776feb5307ff309985f547187c9f833d23f5bb88b297ae3154c51cf038554bd19335fd29c86e7945ce3f8ce08221107a886
SSDEEP 24576:0fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnpnQ/tbw/2Mkjy6Fr7g0oI:sa5POZ3+Jt2pasx2+mnQ/lFTjN4
TLSH
T11A65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6eb422c2025344a781b9a2bb2dab67f357362b0e85fd314355301bbefb136898
MD5 7997698a80f2875a28ac7619e47ff89c
SHA1 2cf815aaade6d8f0ba9d5e49bfd63175b3112c46
SHA512 bc11d9325dec43654e51a8ea29d99fb5756c268dc3680e571b2040b2ffb9bcb661f7d2d4de06d9ed0e5f26e160ba243d05ea4ac85cd502371b5207b6511f90ed
SSDEEP 24576:yNcwHdjbyQ4nLC18lb/EOjowL7Fk7nQ/tbw/2Mkjy6Fr7g0ov:yNc/zEOVHFQQ/lFTjN4
TLSH
T1E0858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7412df92435b07bd3b9898b316ed624665d1de1a91fedbd6ff4183f6285c4ec4
MD5 d4d0c9457fa9778d504e487065043610
SHA1 6d51d189d6704d33d8ef9b4f805084955cc06520
SHA512 6c598dfe27a1246277509a5f2d31663ae52b218dca42c576fac0e5e3feb2ad46be0ad57efceafc26ef0b020e1fd78857e89017974cdec6d3ee35e836bf835eb8
SSDEEP 24576:T8kNvNnaFeYhJNtmZBmNnQ/tbw/2Mkjy6Fr7g0ob:T8MwBtOmNQ/lFTjN4
TLSH
T14E55AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 42ac8f33a826a3eb4939e8d5f02f6ddf9869b94c8d38e5c733f6cdd21f3f179c
MD5 fc1054e20492798fffef2a55a644bf6a
SHA1 c6e3219401f942c1510e267f48de2cf3ea3ea9ae
SHA512 54f07c1a6d1a1747f2250eb41e714ad5a19c9198f7c81a52d15bda95ea206523437ef153ce87e6643f11ad5b43579d4f7ac309dd81e52c597f19cfcbbff865bb
SSDEEP 12288:4HvUrBFrEjwaQfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:4PUr+NQ/nQ/tbw/2Mkjy6Fr7g0os
TLSH
T12C65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 a46d95b492c349bafaad2824bdf1938056b9ee6638072380b511635b29f40225
MD5 1b50fc0901dc16c04a19acbaf49bc1f2
SHA1 c51fb2b7e0b43ae33ed852ee12032be9b436978e
SHA512 fc4f65c37895cf555e859c9f0791b1dd262b546977507a67a0e4163236375816d2a3609e66da7be517b8d4b01eb7327962d7a73b3f076d01a0676047523d14ac
SSDEEP 24576:8D3FHshBIYQgA6nQ/tbw/2Mkjy6Fr7g0oW:8DVHeBIAA6Q/lFTjN4
TLSH
T1A675E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-307-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/236-66-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/236-72-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/236-64-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/708-77-0x0000000000750000-0x00000000007B6000-memory.dmp

Download

memory/708-76-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/708-82-0x0000000000750000-0x00000000007B6000-memory.dmp

Download

memory/708-308-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1496-113-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1496-311-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1496-120-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3652-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3652-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3652-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3652-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4388-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4388-51-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4388-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4388-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4388-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4516-312-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4516-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4516-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4516-107-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4516-101-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4516-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4836-132-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4836-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4836-137-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4836-126-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4836-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4988-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4988-22-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4988-13-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4988-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5080-86-0x0000000000400000-0x000000000056E000-memory.dmp

Download

memory/5080-1-0x0000000002580000-0x00000000025E6000-memory.dmp

Download

memory/5080-0-0x0000000000400000-0x000000000056E000-memory.dmp

Download

memory/5080-8-0x0000000002580000-0x00000000025E6000-memory.dmp

Download

memory/5368-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5368-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5368-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5368-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5368-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5640-53-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5640-54-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5640-60-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5640-292-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/6092-94-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/6092-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6092-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6092-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6092-326-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/6092-88-0x0000000000400000-0x0000000000460000-memory.dmp

Download