bc25e3d1b83a54904f13f2b495020fd33697dc7419294e05be97ffbed111f062

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 11:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 1.3MB
Sample261027-m545csz19p
SHA256 bc25e3d1b83a54904f13f2b495020fd33697dc7419294e05be97ffbed111f062
MD5 9a46ccc18ed7d86af61b88a5bcdfeb0d
SHA1 65ddfdb45a9cefbfe03f1d13d43c20fd8fcee837
SHA512 fc7ae1120c664a1f5a0a071b89d7a64e21e0157af9948275e45b6e652eaad413735cb35b1216c6b7fefab01b6a3d7b6466c6e183e5e965b5a1d6302d7e9e85d5
SSDEEP 24576:GwfLrvi4cRIyDe3SUNaXy+WypoGHFnAUz5DFs1jsLqmVNPEZ+OQw:l+i3DsX1WHGtDU42mLsZFQw
TLSH
T13A5512003195CC77E0EB35B78431C6746AB5BE816E0A286B7FC4776FE2770A2EA71215
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3580	elevation_service.exe
2708	elevation_service.exe
5172	maintenanceservice.exe
2868	OSE.EXE
4852	PerceptionSimulationService.exe
4260	perfhost.exe
5716	ReFsDedupSvc.exe
5132	SensorDataService.exe
3904	ssh-agent.exe
5920	AgentService.exe
4628	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWOW64\tmp6B65.tmp	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File created	C:\Windows\system32\wrap_oal.new	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWOW64\tmp6B64.tmp	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File created	C:\Windows\system32\OpenAL32.new	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\SysWOW64\tmp51B0.tmp	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File created	C:\Windows\SysWOW64\OpenAL32.new	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d91875dc31e6882f.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWOW64\tmp51B1.tmp	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File created	C:\Windows\SysWOW64\wrap_oal.new	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000033d52ce30266dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a99f3e60266dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b1507d250366dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060c04ee40266dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab960ae30266dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c22c8e30266dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b32458250366dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c1af0fe20266dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3580	elevation_service.exe
3580	elevation_service.exe
3580	elevation_service.exe
3580	elevation_service.exe
3580	elevation_service.exe
3580	elevation_service.exe
3580	elevation_service.exe
2708	elevation_service.exe
2708	elevation_service.exe
2708	elevation_service.exe
2708	elevation_service.exe
2708	elevation_service.exe
2708	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5112	2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeBackupPrivilege	5716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5716	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5920	AgentService.exe
Token: 33	4628	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4628	SearchIndexer.exe
Token: SeDebugPrivilege	3580	elevation_service.exe
Token: SeDebugPrivilege	2708	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 1560	4628	SearchIndexer.exe	102
PID 4628 wrote to memory of 3932	4628	SearchIndexer.exe	103
PID 4628 wrote to memory of 2132	4628	SearchIndexer.exe	104
PID 4628 wrote to memory of 4420	4628	SearchIndexer.exe	105
PID 4628 wrote to memory of 5292	4628	SearchIndexer.exe	107
PID 4628 wrote to memory of 5428	4628	SearchIndexer.exe	108
PID 4628 wrote to memory of 904	4628	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_9a46ccc18ed7d86af61b88a5bcdfeb0d_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5112

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2708

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5172

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2868

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4852

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4260

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5716

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5132

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3904

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5920

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1560
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3932
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3056 2992 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2132
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3024 3008 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4420
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5292
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3056 2992 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3024 3008 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 930e4f3f4f459dabfcdf80f60df270bf77ea7f20e682f1ef6fe07bbc571c8de4
MD5 665b9666c62efb0e300edd678405355f
SHA1 dddc5ba81db04c0a0da1d87ba6431b3de74a32a3
SHA512 4f8a2d32fb56ef3350a34e121c04956ddb09aa11240d1c6ba6fcf39fca02157e1c2d8087bb51dc31e986bb1bbb1172846ec239fec739406f9211e41eefe60e10
SSDEEP 49152:Tb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnTtDU42mLsZFQw:x3q6sjBww7mLQuw
TLSH
T182D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 075865b3dd5e1b03eabf4c6a7c9d9c6ffe3b4295a778fdd7926479a6d6270544
MD5 030a40eea0fcad6933fce5c56505124a
SHA1 9150717bf10a39077f7bdc86058b54a347bc0261
SHA512 726f90552ce2f7bbdeea3f56e2cb2d488cf0b4d97d0ab470173ae2aea1314d8540313e4ee4704132a1d2e7d4fbec885afab2693c55449004d167608316b0a3cf
SSDEEP 24576:DXYfDtczAknAUz5DFs1jsLqmVNPEZ+OQw:GtcRtDU42mLsZFQw
TLSH
T17505F12873A004F9ED67817CC9A2D505E672BC854760E79B03E49A3A0F377D46E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 94e23625cc0793f278d21460b894a2fad09d9e3051a39bfde155c88d4d4ed263
MD5 703019870a918f4be39ef648081fc7a8
SHA1 ff424d0a57158e6a8ab4a45105af9f32e7e0a388
SHA512 52f97aa62e520da6cfccaf57b160de6b6f1d08f7dc6c85b83a577819fa8b060dee475c71f4d6ee51e71b78ee1d523f60393fedd48beaf9fa28c4eaab7a03ea7b
SSDEEP 24576:D0Le5ji0hmxxrMznAUz5DFs1jsLqmVNPEZ+OQw:DPji0AjwtDU42mLsZFQw
TLSH
T1DB359E16F6748335D073C0B9C5D2A68EE97130865B308ACB4296D77C2F6BBE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3290c297278a11e194ae385026ccd7058da74b2c7c0f2182eaa8136b9a764383
MD5 587f2fd448dac2cf3a22de536cb52525
SHA1 6c12de9103cbe878f412810e9fcab0a75d54537c
SHA512 5552ebe570bcd8e0a4b85ecc1cc31d285e0b0f0dd2d5899192dc39071b6f28ef5f838178a0ee3fc40af43274603cd957146535e33b82669fec6364cc13552100
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWn6q8wyuVnAUz5DFs1jsLqmVNPEZ+OQw:U/ezSC6vUzPveHjystDU42mLsZFQw
TLSH
T1A7755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f4e14e3b6e0884de92f0a249d5aeb54536e5bb61ecb8388d0056824a14215e32
MD5 8f3fb03033fe78177d2b2bf29112313b
SHA1 103ce76e49ba6d3f082fc7e8cd59cb5e39c7f640
SHA512 bd59bb8a9734fcfedcf34c86762cc843e93030f16b8ca3463f7dbd5e3493c7b8754ca9a5078002480af4134d9688ab6cef0cde58f5a9f03fc1e251c6b88b3546
SSDEEP 24576:MVbqPb88hv/l+YAnAUz5DFs1jsLqmVNPEZ+OQw:MVO88hXl+ZtDU42mLsZFQw
TLSH
T132559E66F6748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 1b42dfac76350bf701a4184383266ff0c4bdf7f110ce0c83cd9c2e28282d9503
MD5 a2498a74b419ce3022e74a5dada16388
SHA1 9e7ba4fd72954b0b3aa7d3c5882d6ebc6145861b
SHA512 a7b9cce963b047124a138c92b0f439d09a77e42c057629ccf5c2e5b9ecc5673370ec4c9b1959dd7d5c4cb859676bcd222192ba07c2be2c1dd28a919392a13e31
SSDEEP 12288:eL/jvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:eL/nAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T109C42386A330A056D3572D75EAB6F54930B0ED8D6921EA1B0DE2373F05BCAD2F456243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 d5f32129f7d9f342922a710f2155c68f8388f1232366954a9dee1d9d15f86db7
MD5 b52af5a4be962d2069d5c75bc32b9354
SHA1 6488bae7fbf74d0a601ab39d1f5bfa383b056f41
SHA512 815ded0c094e7b354598f7a0b0ceee59785fb04770b764c537597f8bc0f11950d7e52e4c1d08ac263f885b663d62af648f73ec8a065fe22f88429d89dc5fd034
SSDEEP 12288:NeBNUbTVO86UIjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGr:NJIUInAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T17D05CF3BEE28FCD2C27A4DB85A91C600A77278704F62A3CBD175830E9E275E15D7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 77a8ae622b854eff01bf8c62f3b7aff8146957088ffbc2311205e58441bd1434
MD5 3566694ebbbd6b97fc4c1764fd3dbe45
SHA1 d1d82d04bacb322a471e5ec0f39fc4383d3c5462
SHA512 cea2816934d7b170e9e1294467f1c34e4a5b899432f6ae720c830fca0d0de880eb571bdc32e7ca12623c89347dbd37f9f2c5405dc02f07c253ecf922082fe0d6
SSDEEP 49152:vQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THh:vQvGAdlCEL8c/DRNw5Cnw7mLQuw
TLSH
T157267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 a226a0cbe8aa48326be33229b7178345b21204f0c7c22e27bfe3172d62b5e5ac
MD5 a0cad5ad87af6837a4cc3ad5f0d357ec
SHA1 da3c920d843a3fae91e066663f616524b77cfaa1
SHA512 1ccea7428714c2ec5723007666bec8b4c4aa8b2b2438145223fb5332959a528c19f1737ab2860ac77730ef09af81f9f60af0bdd6c24e617acc717982e250a227
SSDEEP 12288:7AwSfxL/2Dc3RDLLmt0LDQewsAjajvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcL:k0ewsAjanAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T18115E031FB34E036C37B0DB21B36D716247CB9604B611AC3E3E85A9E49742D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bd21ae6b53bbce1f5886b6fb9c26fb68a829696b37b6765ce93d75aaa6e55b81
MD5 f1cce531dac11e089b637658fe767330
SHA1 fcab8cd46473ceba41a4f2b5eb3b37f83aa0815d
SHA512 91cd62839fa7c393eda864df7ea96f9ec1cd04e9acc84ed3958806e8704aea61a9a2ccb09fd3f366f196e6a7c95163a29c5cbf6b739a8c077fbe0a3fd1f2f89a
SSDEEP 196608:tUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHELQu:tUEtQevvqc2W1cpV2tI32Q
TLSH
T199474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 caad702329584b2267d4cce72f833b0a10ac091f3f66a4726ab9eaae4fe1dd4a
MD5 2081dde995e6cc90e27281a5155cd0a2
SHA1 35bb58e16f85c498c248cb5793d8d182cde9ced8
SHA512 64cbc977dadbe570b1044d4c6a1767f6f5958dd1f412d58709e039d58340b0e7e23b0fc81d60c9b7a38411041ee45f52b703d6b8c8003c97dbddbf2b3ea75596
SSDEEP 49152:fCbRquA/m2yL5zTfFiV+XenmE3/zgtDU42mLsZFQw:4oquVjnmDw7mLQuw
TLSH
T1ABD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a9e7f151214e5f01d2a0b75f3d9a5470e1188c59e22e5fc6121d3d3bd8497ba5
MD5 1b07a7354bf3cc5f28c5b93abb17b360
SHA1 3bc018106aaee72111ffda03e8e6fff54543220c
SHA512 fc34dc138bed855b7cbf46f87f800f584a74f2779bb1c26569e3c6f6f79165d981a8a598274c729e1126bfbaaa72c8f135c24b351ff1801aa475f22c50cf0d8f
SSDEEP 24576:LAhGL3IFoiwtA5l7S535nAUz5DFs1jsLqmVNPEZ+OQw:LAMUFoiq5ttDU42mLsZFQw
TLSH
T15235AE81E7F951D4F5B3AA7899B69170EA76BCAA5E31C20F2160D21F0E37E409D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 21c1d10b111a44a2582018798d2a6b82c8b0f6df410202e0e90da4388b4f0e7e
MD5 de8256d45cd7104c6a65fb826ff8404d
SHA1 4d332e4cabeaf41e31c7b84a5662bf60ead68e30
SHA512 f7d024b8800c6c0567e666d5656e7816d0f61845c29760a35747fd3e2ef331f2c7038ccefce648c0191e2b8a30df1343479f2306de486d19b4bfa9d30b535dd0
SSDEEP 12288:imw5HEjsChNVBFgl0WDm+C1jvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHn:7wu4OW+nAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1E905F04673A418F9E56745388697D136F7F2BC062A21DB1F07A0C72B5F3B261BD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 c253a6966d0d5349f35fac681d222e11ce2ffdf4f17f8d4d08c0e88bd1b7f74e
MD5 36a0587409a32654985b482caacd9189
SHA1 93b37e5000dba18f2ec7cb4d878c7e1c32cceed9
SHA512 14b5b544304aa4d0e3276519d3eaf59f0c9681446188e69037d83d2444f9afb1b5c2ce92fb8f41fdc9f3a66d153273655d093eea831e2385f19663015400e167
SSDEEP 12288:3eZ1IyKjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:OZu7nAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1BAE4128A33A470F9D263557CD9E5A605E3B1B846273283CF0665136B1F7BAC26D39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 93d1807e7db379cde45f9b4c94edc3e7c9bce5a70dd258779baf62d7336d9a61
MD5 88d6136c1574a914abcbef8e3549b32d
SHA1 0a5a170bd2f784bd616d992b0a6321ea4b1eef09
SHA512 4fe3e3b8388105f0620c4b58008c1b9e91412c7114e5a9aeb6d869075974dcbfb1c06253ef7516249573604ce473e29fa858c841ff1dd4b1edd8310d0ba767a4
SSDEEP 98304:nQRQyi36YOcPbLvw2gAf+PN3Uw7mLQuw:2QyiKa/X+PNKLQu
TLSH
T126667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ec9e7370906d83f9e2a705d9237d1c659abfc4edca65b340323babcd5503c94e
MD5 2d4e919ba5d54a8e1caf16c22bc7aefe
SHA1 579b3f197951a8f9073819f206157f1427983803
SHA512 5d9f616afbeb4be57f07f6ba1a129369c2a50e0c6722841ff127ea674a88ee488666ff2269a40c840e24048a4c094f8dbb658ad2f6ef5152ac95cd41bc5ae8c4
SSDEEP 98304:hQRQyi36YOcPbLvw2gAf+PN3Uw7mLQuw:4QyiKa/X+PNKLQu
TLSH
T195667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 80c843593c683ac38ffb459fae5d7be03692c892e2d7fcecd2faebbd5380a659
MD5 a1e6cd5cef939c36ac3e5142db590dce
SHA1 1ce0dddc30df5d1a3fe0d158dfd1b4492d30f975
SHA512 6e6a0076e388190c265735d3a4ca4784034eee993102b04cd7bd4eab399114c4ace67babc0bd7e04e49dfd076ef626a317e7b144f3fbe19751f007bcc61288fe
SSDEEP 49152:i68Qg55nhceWu7PNU3/wtDU42mLsZFQw:gthLRc/2w7mLQuw
TLSH
T184B55A33B2F20099C44DE1769F4A972196E17C758FE0E3DB8511721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6d48c4d4be02d224a93edb0e3f5b91cdda1d5762238bb246d08945017b69fd08
MD5 f0d673ad874cf2ac275fbc02a5052700
SHA1 34f164e063f3f767e550cd2c8060d5cf36dbd79c
SHA512 af5ea46ee012d2ab4998af37a72d275493a4fa1cf98425e5a94d9edaf3e6b4a698940dc51b6151362a82c902d246ea7a367ab72724cada2e3cdb693c17f30276
SSDEEP 98304:jy5112gYy5azzVvt69nLKnhZVw7mLQuw:+LIHEWhPLQu
TLSH
T189167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 76b67e5b2b94976a9e3a99abb24185528701890878f5128b6538c000f32e8cfa
MD5 ed1ac6f8002daf4c0cf630f883c86b8e
SHA1 b55c0eac2970ce045a15f559a61e5d458c6a0436
SHA512 caa88d68dd5c5f5de883f62eec579677f6a88d0905f2a69223751e21bfee310894d24478cf7afa711c62024d41e6aa2a1770df0dce34ed3321944d8c57168a31
SSDEEP 49152:9B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glOtDU42mLsZFQw:ju6Jmdxd2dMw7mLQuw
TLSH
T138D59D13F2DA01E8D06ED478974A9233E962BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a2a23f4a534390b3e13ba184713f610499103f98b8f9ee0ac03d2669a836d6ea
MD5 5fdb2bcb7224930d2e9468094800c84b
SHA1 6998c1d0a9b0dd4e90dad4b90290a629c723b4a8
SHA512 2831de6e9802d04834c9ccf2d80d5bc5ce6386bb321976ba5da56eacd7ebc6ef87cbddca495713661f1ee9129985704a86dafb3aa004a433fe644497fd6eb432
SSDEEP 49152:61hpsNoJpF1A63U44CwH7R4xatDU42mLsZFQw:6mifPWRDw7mLQuw
TLSH
T10EB5BE13F29900E8D05ED17887569232EA72BC460B34B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cc6089ed08b7ef470bf3e0c9293e3aa691825bb5ab26e21d6e54f3d4e3534f98
MD5 f7a4a3b1a256c32e0546425c52c6f428
SHA1 3d07141c51e5d74424ceba113418fc2f6ac0fd35
SHA512 3e0af894763a2a7accecd370b9158e1e4c02b950a074ee13487ea8f7e35f1c7af1f1eb1fcbd157169e4696331950bfcc33da2406085194cefb2bd5bff5a4e158
SSDEEP 49152:eSuZQIY0Be2KcRVtOnks6NMHqjtDU42mLsZFQw:w5dKii61Jw7mLQuw
TLSH
T17EC5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f2fb56b37c306c7b59c04b95e8c1a11efc75211df924a411210ef27143a070d1
MD5 c9afea2d81acb644f462cc1a7034796f
SHA1 40aab8bb34ff9993558e341ffb8e6c02a39e6de8
SHA512 82cf5d99c669b286940fea8e61d78988479883ea4cdab48ce7229fe67d21438a3f965029820842dc0f8aeee23dbbe504aa35fda720720e388dea3fc944d8f01f
SSDEEP 49152:HhtSn8EApI0fig3giDn0AP5wetDU42mLsZFQw:WX2imphvw7mLQuw
TLSH
T10295BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 c613a26600ed71daffccc2837f5820d74865a3de10f74bcd76cda07bf2fae652
MD5 1f67cdef149431e9e5655a96b1dc7662
SHA1 ac5ad753bc3ef9b7856997ccbcb1a49310487045
SHA512 1fb67892fc210f806fcd6a141840efc4c82d338e50d28df15d05a8347ca1687f76227d55a665e8604dcb8e628afdfa2acd7938e80d245903cdc396e2f32a53e2
SSDEEP 12288:/HjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:/HnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1AAC4238673319056C3061DB5DAA6F54930F4EDCEBA22952B1EE7333B07BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 38e125b35ffccf03402d9847088528839d526871c77a0acd1368f860c5d82415
MD5 60f0ac230bcc69d1f58548bed16a0a71
SHA1 7045a0e5d7a581565324d43649c0b9e1e4c66241
SHA512 57912a38b98bee273f12ad196e5ded5cea3b9793c362d05567a11f733488aa88d3518fcbfa0daf9b2e5f3337eb330245eeb229439b25b7fedfca3ff42b879398
SSDEEP 12288:WWjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:WWnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1EAC4238673315056C3061DB5DAA5F54970B0EE8FBA22D51B1EE7333B07BCAD2B856183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 521db894deda41483755e76981278be9b5d4cd06cecae4180e6b52f5d1eb136e
MD5 6c0e10a6d666fc0af56c81be47f2e9f2
SHA1 3dd9c7f16f65f2efab20f9a4fe95215f3ef2501c
SHA512 27cf80de0b40a2b9e78c7e38edc1675617190d64712f3dd5e7ad3977261ebdc7baceb63e395601962eb592dcdc062869a6e04ef692ee269ccef5b338d780ac85
SSDEEP 12288:fQjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:fQnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T182C4238673319056C3061DB5D6A6F54970F0EDCFBA22951B1EE7333B06BCAD2B856183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 31536ac038bdb29bb5e22482f834cf5a9e17a6a7524e034ebaac9f96bf228b16
MD5 beb107b673ff19a98c8d6bedc078de9f
SHA1 8a3bf41b9aed649a0a67c74ea9443e3b4e640356
SHA512 4348bda361147d69076a3bf7887ecab2399f6556b47f0150a3e72afcce69a86fc40370ccf5f98ef86e1fb598b2374d951e2a0053bc9a6275e44712a954d22ecc
SSDEEP 12288:sVZjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:0nAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T18ED4234673355096C1629975CAA2F109B1F0FD8EAB32A65F0E92272B0EBD7D1B835343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 250539076d985937c8e9cdd2679644656ed565b1650eece4eb4c7dc6ba0dd0d0
MD5 b2596abad2986e5f440b31059575671a
SHA1 a4da9386ba55e9d7ffd5847bfa565f63ead54d94
SHA512 65111812ecdec2683cbe3f6d562068eca85c2d099fdbab41b53f891d0597253b1c038b6846b50156be0c11523d7ba0cd3dfe52dbbec831e8de72d4c4244b6100
SSDEEP 12288:ARjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:ARnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T13CC4238673315056C3061DB5DAA6F54970F0EDCFBA22951B1ED7333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 c8a0bdeb520a1663b13dbb4c41e7e9e22b22fd52297b399d75aa39f886e21bcd
MD5 4859088d7a1dc7d2525cded5a5be6c86
SHA1 872b1f6f2651e733031efb37fdd94e311689a2e4
SHA512 231c3e6051e0be104c70ae55eeef0ae4fbd80aea57c12a40ea950db0c732bb887fabe54754735c39017af9b767e8435364c999cf0ff9f990fdf13cef2116eef7
SSDEEP 12288:FCjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:FCnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1ACC4238673315056C3061DB5DAA5F54930B0EE8FBA22D62B1EE7333B07BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 48288b8cdd96b5531bd5286f9a822d1aeec5cddcf34b809cfd4378750f68ff73
MD5 cd4d544e05d8d7030c542e4104705b09
SHA1 e68bc3a091f5b1a288f8a5a5a28efc9456111c03
SHA512 e15c0fa2dd35743d0b16e210e44dd5b31863e92b76c60b81d7a1174a57e4d343bfcc628a2a4cea8407dca4cb1cbee23ebda6cc89acbf8b6655fc8cc9cdc6bca9
SSDEEP 12288:nOjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:nOnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T17FC4238673315016C31619B5DAA5F54830B0EECFBA22D62B1EE7333B07BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 97b1fcae6be815a6377058a33d7fb4193d5ae136cc6119eb4816475ec8a0f3ca
MD5 c42bacab0dab29806631658642aa2289
SHA1 224964e7aa838775c8385be21c74ec8ba021cedf
SHA512 88bdaecddcc91dacc8ec9880acbc044eda8a876a2a191ff67125bf004eb3021f609db11c88c3c8bb86fc15ec7f92e550bf3d9e1fe25ea6a380a98707d00ffb83
SSDEEP 24576:jZMRzFVSO2nAUz5DFs1jsLqmVNPEZ+OQw:jZMRzfYtDU42mLsZFQw
TLSH
T18D050195B36018F8DD67813EC9659906E2B2BC5A0B70C61F07E4362B1F773A11C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 1e2dc0238d5f0e2634a1ae49c6c2f6ffff34cfc6659f88892cecde573331e1a8
MD5 103d68b68d5352f1b553962ce13ab927
SHA1 83e01d55f5c327dc755f2aee575b24b0be9e4d8f
SHA512 4d83e0f5b2b6296a4e5b6fe7b5b0badaedb785c525e97bd4176cc6499b218d9758cc4474598bf69bca3de52bdf0b4871b34a6f7e9ce559d4e95a0e9e87048e90
SSDEEP 12288:mrjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:mrnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1BBC4238673315056C3061DB5D6A6F54830B4EDCFBA22E61B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 a181df0bfdfb63e42bb7a411b9e133f43d62c6ab82ae419efa20edda43c5068f
MD5 f0e29d7b0792ae58caa23c8914b88037
SHA1 2d585313460b3cf36d87d888220d7e20c195acc9
SHA512 63f85215163b3b6b5e8303df0150893c876a628f97b87bcd81244c237012c82d208b464dec3845f7cd741336d27ba2ae84cb164acc0cbc9329897e1418b9fc61
SSDEEP 12288:IvjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:IvnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1F0C4238673315056C30619B5D6A5F54930B4EECFBA22E61B1EEB333B07BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 9df2862a86989359bb83b70ea5edfebc850920f9c5cbd880619453eec19e9ef9
MD5 999d8347458be430e72944543947e5d9
SHA1 a21c056497419cb1c9a62db70cff5a894789f81c
SHA512 d4cd8fedb8085d35c84a40546fe243b43414f7f5b0ae402adcce5037eae15c4a0ac1f7d37877a34b0fcf354d3d2a3718fba9b6d48efe75161828ed9d4acaf2d5
SSDEEP 12288:XyPz5L8KjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:azyKnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T134F41247736130F9D1275238C9A26A05F3B1BC765B208AAF17A4133B1F3B6D1AD3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 b197f256226208a7446083769683aa419ddba2ec7d62353258c48fd302cf7d71
MD5 5cbc07f524cc9014a45d4984f6ddf47a
SHA1 02339d2cfa2ab3313a2d9900534c6c6e2b116366
SHA512 d4a4e5cbe1dd91225679ec00cc3d572c523ffccbdc5ed326d2625029e1ba0933e7ba386612dbab300532cfb1850f6588332238ed8134b9b1f18c660e40f43e18
SSDEEP 12288:erjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:ernAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1BDC4238673315056C3061DB5D6A6F54870B4EDCFBA22E61B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 46428a31a19fd397a49c153c86f81382ec111f607dadc5d2c245883b7ca1ef77
MD5 75d084a62fdf364a6f9538225bf71e8d
SHA1 19487b3eb994c0f1c6eaec94bcbfe2f6f9e52c80
SHA512 c6fe39d6b12e6fab309fe3f0ae9d04a6721f17e36ad95a95a0a45317adb694fc769f770537654f4fbf40e1143d2895a908defb1d108696c525e7748c799d5a03
SSDEEP 12288:trjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:trnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T140C4238673315056C3061DB5D6A6F54930B4EDCFBA22E61B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 72f6c6e58db57d38e858e874770c55279746bc9933e002aad99f46f73c62f1ca
MD5 5865defabb90605a71964693df7c8cc2
SHA1 410e3e76aa9732d1ce54c6d570915f808148552e
SHA512 62e2186d686af8e24b13d16917249b59f290790ccdbaba78bef6fd26818c40160c41a1923f52dbefa73a45ba19af5b2a0c8b9b7ff22f1f52051606f7b068e4fc
SSDEEP 12288:ByPz5L8KjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:QzyKnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T17AF41247736130F9D1279138C9A26A05F3B1BC761B208AAF17A4133B1F3B6D1AD3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 c8fbc0081e36a37c6a2c77998c839079d2696b8d9c49daa67ac53bd9442b8eae
MD5 e098edf571e339ec66c4094fea1166d5
SHA1 83291eedb3b34c51a1b252a2b24b7bdf55a10ee6
SHA512 922eef1137960d086fb60036502f73cd061d07228b9f3c2fecbe9649cdee79e0503444de874c9259e7c091d5893cf3f7f0ccbe4d4ccee3dbe7963824853308d8
SSDEEP 24576:pTDaLl3z0zDgnAUz5DFs1jsLqmVNPEZ+OQw:pTuLljhtDU42mLsZFQw
TLSH
T1E2050195B36018F8DD67813EC9659906D2B2BC5A0B70C61F07E4372B1F373A16C2EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 2b1046dfcd22e50200297302612e5ced6c6cf7a34dc65094ffdb857fdd53dd90
MD5 6482d04d7bc6e72e1ff16da48e9d8099
SHA1 4ba670b9c5a0d3b3ea682eede268bb0a0b0b21f1
SHA512 2471910ace93c29c9a884ea5698796fb1248993127bda0cb8a24305010a5957f4733b82fa67eeee54e35564b3c57d79a0032952be6c26e95f24108ab408c1cdd
SSDEEP 24576:O3vd9CHKy7GZMnAUz5DFs1jsLqmVNPEZ+OQw:Qvd9CHKyaYtDU42mLsZFQw
TLSH
T1CB25CF90F3E410E8F1B79A35C9769501DAB67C5A1B31DA8F03A4261A1F33BD19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 16f3032351da60ecf16db72aae037b4da13060abd24a621af0999ba7227b0f8b
MD5 5a1394e1b73f25694c9623075a0eb7a7
SHA1 16844f9f225f566e4d8d1a2f321bf971ea231679
SHA512 627eddf663a67df9abfa2ff52776e1c71bd471b6a1afe381f03fa146ba6d664cca55e52a6ced3c458f103e9192f023e69f438ce98bcdd7fa147f885b80811ce6
SSDEEP 12288:/wjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:/wnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T12BC4238673319056C3061DB5D6A6F54970F0EDCFBA22952B1EE7333B06BCAD2B856183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 efc4a3cd377132fddd101dc6a4e3cf28abf8b3fffd0d5ea41e187b275b74d854
MD5 eb074e6dc839d4995c11f178ebfbb56f
SHA1 8ca373b0b251071524567645ad24e84c098834a3
SHA512 538282a10dc9fef33a949e41ccd0c6612ef2ab032694df6ea38e47124d16ffb30ded84cbca1c7a05ca2d69ddfabe5a249a1ab250f902f171d914f194e9c29529
SSDEEP 12288:pqjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:pqnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T162C4238673315056C3161DB5DAA6F54930F0EE8EBA22D61B1EE7333B07BCAD2B856143
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 0f2553cc6806ac121bd32d3c38018c917626b9d6306e303dd4159a792eaa466f
MD5 7f9297e355450d86aaf64c9155a934bb
SHA1 3c6dfb5f948eff9ea1e67ef222c521cb9a8a04c4
SHA512 333be92a432e4a4299da93d537923f3f19194a202eee1464a750cc4b8e275713533b2a19b1ea2bfddd5f1d14dc0c1b0ace0e2741a1ec2c7b7a0ffaf699569634
SSDEEP 12288:NNjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:NNnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1CCC4238673315056C3061DB5D6A6F54870B0EECFBA22E61B1EE7333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 8297353ec5923986d0eb92e37f39371554ddf20cc1a6f36d052fd0d542356d8a
MD5 ec68f71fcd06e3eb789796d0e7afcb9d
SHA1 a5fe5f07662d4a178ef75940f1ad9d168f44979e
SHA512 aa3e9023e2da41261938b7979a19c66405c02411a1d01b4d3b5758da5ac56eed5cf4ee669347cf00d5bea85235b8abd2b0de61b1ae2b43b2239e83836d1bcf61
SSDEEP 12288:rrjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:rrnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T188C4238673315056C3061DB5D6A5F54930B4EDCFBA22E61B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 c996349a174427bc26f320992e4f29a033066d2fdf3dde09a345134fdbb1f2ab
MD5 de584ee1f87c8c31fc5d8eeb42f15ec3
SHA1 d25c4c6b7d3f5bac032490e7723b1f5e69d057aa
SHA512 fbc010620b9b45e5f8c83f654792261371fa688582055d7a2ce26bc02a8469d2296f00d90ec215a67934d6950c273514abda5c7e09eb8acfd691bd8e755eb505
SSDEEP 12288:hwjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:hwnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1C7C4238673319056C3061DB5DAA6F54970F0EDCFBA22952B1EE7333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 51e39e29ce8a9d8a4c7c7c31e0b3dc1ba7dcc9f7cf54dbd00b5af685a91caa96
MD5 a1f92e4ad1b6e56433e2ddd5f56d00a0
SHA1 035c3d2ca3091f7346776989a3494855c8e06295
SHA512 e3ad4081220d9060fcc076a8cd6ec99e5c6b0ccc14e05bbb9a0ce58683c30042e07e32efcd050a2e6033c75eaf683a1f71f291fed5494147b317d933ab784ce1
SSDEEP 12288:FDjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:FDnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T155C4238673315056C30619B5DAA6F54930F4EECEBA22D61B1EE7333B07BCAD2B456143
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 ffcd61db812183ad9d9d49abde7b76f4828d7394a3c2d293d878f3c1142ca0d2
MD5 b5146881730752ca7458d9bb38dc5a5f
SHA1 fdc0efeaaaf106ec69b450b93df483bc28c59723
SHA512 ab4e3fb5c3342fa0237e3edb6e2b85b8a1dc904ddd2ab706fa74002f41dad85be9a94beb8a0d76ba76fd8a01147855e2914566584038f130b93c11641de4d9fe
SSDEEP 12288:XRjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:XRnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1CEC4238673319056C3061DB5DAA6F54970F0EDCFBA22952B1EE7333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 4f8db30239bae9a7adf28978b2e9fbd986bed4ba8410d47b669bdc8a2466eb62
MD5 af4ea6f8ca57cccd43e188e8d4f12a79
SHA1 790eeb7c01d39ed3b7f61ef5d4a53b0aeda1f8a4
SHA512 982cc8a30c3b28e1fd518bd7cd6cc1f7496fc1e304a75d1c3f2e379ec47527a00f47c4f3ee9108448941703ef991ce71bdc4e660b8261bd86cee12a7dde8cff1
SSDEEP 12288:H4jvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:H4nAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T193C4238673315056C3061DB5DAA5F54860B4EECEBA23E62B1EE7333B07BCAD2B456143
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 8c2c6826ab991250ec9f32df417c22438502174f692db682d2dd6c4b3992684d
MD5 b4a411439cbef3cc5fc6c4fcd4a28904
SHA1 d84a6a3e0dca07ecc0dbabb142c236069c2fcd34
SHA512 ed8766bee92aa44dbc996f72838667c335668d8cb043e645847f8ee27b255b1cbe226850bb8786470f7a04ed54a7968e2dc955de7b7d914d330599049770eede
SSDEEP 24576:XfwvUk9RX6wkyAIfnAUz5DFs1jsLqmVNPEZ+OQw:FMnYIftDU42mLsZFQw
TLSH
T12535D029EBDC44E5E177913C99B7860AF2B178591B31C2CF029A536E0E37ED0AD3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 269fb854c928a04f3af863bb4efc1be0adb17de7b2fd1b59bc60b9abe8f91539
MD5 f2419399e3de0d1a3201621c410f993e
SHA1 fc11da9e7eff10193aa96fce19d7f227478a63ef
SHA512 83463775534225ff458f5be1c183cd53a87871ee8a7ecfaf49b4ffe805a54151e01dc75d239943d943b846e67b55ffb404347d0619ef6854e7951ff5cd146375
SSDEEP 49152:8YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0+tDU42mLsZFQw:7ySzP0w7mLQuw
TLSH
T194066C56A16801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3952f5a3d87059ea01496449bd7d17bd89aa39a619bda237baa25a2575b5fa97
MD5 3255c2a9614cea6ec3abf222e0d57309
SHA1 68a19136b7c31c749995d3930739ae28c7a04f3c
SHA512 09f725e3980999f0f2c8cef3f82375a3e64667e4fe0a326869f09197c3151de2d55a4e159256211c7fb52cc4e8a2eb6ea8822b81aadc8293a8aeb94dc7a2c096
SSDEEP 24576:Q47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYmnAUz5DFs1jsLqmVNPEZ+OQw:Q47JUQjTirIhCnDHUPfF/OtDU42mLsZl
TLSH
T1B565BE1EA3EC01E5E1BA927885158A1AEA71782E1F31CACF1270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 f9444a202c3917f4bde6c042745a719f89fd3c15d64072a101228b6fded8528f
MD5 673f058af8a80a0a62ed3d706b10c7bf
SHA1 46d4af78f017fa6aaad627ae02efeb8a28870c1c
SHA512 40d53227d0a58db0e8eb7464e3875151a4c8f14c8144629f9d987b1449182681a1647b49a7976d22e76903789afe7182d3f39b9287d6294f8e9a9577130187a3
SSDEEP 12288:Mbsf7jvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:D7nAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T13AE4F00AE36401E8C06E6175C756AA41B3737C5997E1D3CB16D0F63E0F7A690ADEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 eff7e33ae51d4d5048a2dce4d7f2862265facdbf0f3e0a2446be09a158658892
MD5 37a17e8a84bfbc6fc881dd7053908f0b
SHA1 5baa182790a646a1db534a0f99d5461137670f36
SHA512 06a3bd6bda09a9fff10a9a92609744c7d5e4009158c7874fe5a2e49e4b994b0a6e77408f941b11e9fdf485dc49fc1942da45db3a7fb098b1e0e9c8ca8277c898
SSDEEP 12288:9IZfmU3fCS+LdsDwKumHRORysqB/H9G5QmJep68e+ycrRcm5Tg:9IZ+UPCb0wKu0B/duJJeY8e+ycym5M
TLSH
T1D8350740762ADB4FC6AD40321E36D2CCAB707C55EE446F0773C9873F9576658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 3c2edc24f36dea900be60984e42672413b29b20c25c4e97a3466f73157c391c8
MD5 24d4fe5fd4102b543dc13e3e57b621cf
SHA1 764fce138696bb179af95fc49428fbd8da31f536
SHA512 71c31a1798c0b12156aab2db88bd6dffe1495acc930a4a99eba0cea471fe88321e0246b2998cb0bdad165b0f532c9a6ad2535147e326314c640336fd129481d4
SSDEEP 12288:i+3uNHn38L10YHIPqHROva4rMHROGWi4LjVL:i+3uTOij9
TLSH
T12C65C8806537E78FD1B76032032A5B8C77A4AC1B77496F22B3C5453AD86BB15A0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenAL32.dll

Path C:\Windows\SysWOW64\OpenAL32.dll
Size 106KB
SHA256 1797d150a2e23af4f390f5c33eb598c6f58d0454011d74941f5316add900bbdd
MD5 235355a8dd26903e75d5e812ecf50e53
SHA1 8316319341a0f9054e19e4a7b21df3dc49386fee
SHA512 5beb9343028790f993d0acb1007fd112b7e2ef6f9fbedfdb62b0140d2bbadf3b6368417ea19edb0bc8674d19418e5784fef4430ce1c329de8e83c304706d39ac
SSDEEP 1536:xYf99QAGcIq+pNocP6YI60qlW+kNvsy/mSvIfttnuQm6A41NbApkh:Hq+pKcPdUqWsyRIfttnu/y1Zk+
TLSH
T1B4B36C51FF824032E0C58E3D81A5CB969BBF19137F9254CBDF7419C85AA03D80A7A7E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 7f71c3592846a3cf4e95ae149e70e2dee2b672ccb71d2a13fd8b9a802b5d423a
MD5 f4aa47e2cee748e75ad5bbc3ee44a5ac
SHA1 f66cd6212c9a176284d5cd3a48ecff6edb2d4058
SHA512 e95614d862f3b7f5b42916d865051081bb9defe6a219b358323c64299b82b93034affaabc4617b637526514820d0e012b28daad01ce6fbb5db0e04155ba01f44
SSDEEP 12288:707TjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:wTnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T135D42342B324A016D276297095AAF1183178FE8D6F21D5DB6D96333F06BCAC1FC76247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrap_oal.dll

Path C:\Windows\SysWOW64\wrap_oal.dll
Size 434KB
SHA256 a4e46e6d09c4b0966824a2f6628ebf738e813672692a52a0d63d982e1030ef4f
MD5 d494267bc169604fac5e3679b9a97fed
SHA1 c093ce5a4f7dc40f7f604945bd1facfb2c805c4b
SHA512 7cfcfb570ecfa974054b5285c7d6ad3bccf502866ea70789750c3748394cb0991d1fa6dec9c50a506dbc697953663ec2605277a4451098bb8cd6699c4e506040
SSDEEP 6144:0AswvHbkHO2Qc7h3Ckr6A6u35n4boFnugPoHy5AObO5rvbykp:0A9qNyin35n4WugPoEc9ykp
TLSH
T116949E01E591C0F3C4AA48785873975A6B790F6113B9E9F3FFF03C9A9E602E4553624E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a091f2f3cfc49b853fef2defae569ca95106b324238473075881a6be0a3b0430
MD5 6ed6c58497b25eead62af2ff87f49b07
SHA1 4013b2a9ab056789139f80e9d91b54937d149207
SHA512 70d33e4796dbf20eb90b232712c3284f25686b0779d6bb40e3d5ff29bc38484127f12898760065982ae761297c4784d3362452259941d358a10adef676107671
SSDEEP 24576:0gb6bmBIi49WNNFpg1rSvFv7bYVnAUz5DFs1jsLqmVNPEZ+OQw:0gb4mBIBhGFUtDU42mLsZFQw
TLSH
T1EA65AE1E22E802F5E0FAD2B8DDAA4417D6B278161731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenAL32.dll

Path C:\Windows\System32\OpenAL32.dll
Size 120KB
SHA256 87802322c8e63555c26fe473ce234ce7099745ccb28c02766c2224c726454039
MD5 2ad7b4f3c8d2bb686d231edff404b7a4
SHA1 f29676b96d04bd2765925a3834d9babfdce6a0b3
SHA512 51a6c8cfe30e34c37437e6c5f8c602aa0759b65559a82521e2dbcf8a9865b826077854acb6497df6085d67b4c66083ae5f0f192b743a4b6f77ce7b18f01bf528
SSDEEP 3072:mQG3kfDcDKLIjVUl4ZjxNP7ZOqCA48gstZLsFusbdLakZ:ejsxlUVZ7ZOPstm1YkZ
TLSH
T1C9C36BE2715510F9D4EFA378C9A20682D37278249B21A3CF676081562F63BD8BFBD714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 c6a131348627ccf5d45dca26f52d8bda8d84714f201c4663c2135aaa97155e43
MD5 c18e98f457420a30bfd8c038dfa2fec7
SHA1 e29d38f93e5dd86e94ae22fdfbe5a94729050cf9
SHA512 ee4de6dbe8f179bd0c5ea98b08ce389cf09dd1469094f3b70b5e7727b08a4a4539ab37b855a4fc00ed84b30178f867fe570883eef98706cd7332c0646d535572
SSDEEP 24576:TG88u8FpJqH1bzria7/m2nAUz5DFs1jsLqmVNPEZ+OQw:i7ZFPqVea7/ZtDU42mLsZFQw
TLSH
T1DB35F16577E101F1D47BD1388A828663F6B1B8151320EFDF0BA88B561F23AE14B7EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 5d14a09786d80a4ed14cac46d8a14700a5e4e253620a44951168431d527789ba
MD5 a0839a74f8dc83b17abf0bd2b42d2c7c
SHA1 01dc91d8e281c707485ba04039e30fa671e68271
SHA512 51abf90c1dc966fb38c6615c035643cf0e06d41fc3128b43e9197139bbdb689b11b06695a748f134e79cb507d29e619ace5519c99e9264898322ea2b60fba114
SSDEEP 12288:KHvUrBFrEjwaQyjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhg:KPUr+NQynAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T10D05E11F23A818E5E676A17D89829609F771B8561712D2CF02E1817F0F67EE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 45094f465ff17751b490b7f962710a7f7c6185a335505ca8c6eaef108b9bbb27
MD5 123f56853568f98e007c3572833875c7
SHA1 51657f66c86d30e75473bcda733682e095ef380f
SHA512 a5d2819cac9143dfeda50a49db30bd4fc0971d54ae65892dafffccf39686b2bca6a5b9cb82337d528d9db9cb3cca19203b46f38889dc297525c5473a69057c8a
SSDEEP 49152:KBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjItDU42mLsZFQw:1G05lO43bdw7mLQuw
TLSH
T1E7D5C06A62EC11F9D1BBD07CD9C6860BEBB23815033556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2df34cd06fb2da980a5ae02c77bff71c8cffa03e8659ad5cb3d9337e88cdf87e
MD5 b5a8670047202cf68d8cceeb5470646b
SHA1 3c8f7108cc917e7e21352dbe6e447501303c3f0e
SHA512 071ce25d36037a2f1b5ec55e8bf24e1de7c9ba2b05e08d3231ce4601c75d85524926680c7e5daa4779290b674622bd45d2465904a96bd153418ed311922d69a8
SSDEEP 24576:tfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnEnAUz5DFs1jsLqmVNPEZ+OQw:da5POZ3BJt2pasx2+mwtDU42mLsZFQw
TLSH
T1BB65AF5EA7F801D5D179D17DC583861AF5B1342653329BCB022182BE3F2BEE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d44345d3ae41d826aa4eb6ee92ab217021ac31924a937a86604a07aca116cd61
MD5 892ec724ee200a450c20da373284a9fc
SHA1 82b161ac6e4f38ad46c4b81863f628d900d6eb00
SHA512 54b9b2f91e1bae7e2d1f81ffd2299b07ec11a0b6233b9fc609fc51b7425b394ff5540b0103dae2a13400310862475d9881b4c377788b2edd89a27a3d304b544f
SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7FkenAUz5DFs1jsLqmVNPEZ+OQw:pNc/zEOVHF5tDU42mLsZFQw
TLSH
T1C4857C1623E901E4E1BBE1BE89779546FA717869573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrap_oal.dll

Path C:\Windows\System32\wrap_oal.dll
Size 455KB
SHA256 5379373cf3eff41cdd8c912c65e27e1bd492bd84238d19a093aa846c9b1ce909
MD5 549347bcd4aacd63243d78e8f869dbb1
SHA1 efc00d2a7c5acfe17b8a58023826e6840aef39a6
SHA512 c6789376d05deb8c5050225c37c023055c107a72b49afddfd3f91e7e7429d38db9346e2e5d38986c2000c3828389cfbe5d74d80423a79eebd0367bcc81137cd5
SSDEEP 6144:ING0FBd3thlYIhSJyYvb3ahwNDx/+IJcaxjCz0G5suFrtxZO+jTyWQqlMfhGy6We:ILVkoWTNV/Qz0vWtxRHQqlM/kb
TLSH
T153A47C91E19184FAD1ABE1349A52AA17F7397C440B3847CB43B0A8711BE3BE469FF354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9502189d7e1bb98daad4f4b467b91efbd386ffb91eeeae13f5fc3980258c8835
MD5 4af5cf92a10765aa689e509890bc4316
SHA1 5e926d2d1dbaed8766bf92a9bebbce98a0dac198
SHA512 16f28193ace69da4113b9c5286599d47833a366706b24d40edb0f2342b15523fa99cbe3faa1b0585779b92e0a7ee350e8173923eeaaeda7c1037a71ad8e19f7b
SSDEEP 24576:9TkNvNnaFeYhJNtmZBm4nAUz5DFs1jsLqmVNPEZ+OQw:9TMwBtOmKtDU42mLsZFQw
TLSH
T15C55AF6EB7B846E4D1FAC6B4CD238512E6727861173293CB5290C13F0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 8aa193e11b8400bf026df87d1dd140738b9182163ef6880f0c0e5cbdacda70e6
MD5 371a1b69c83181789aa3541c99e1f1b7
SHA1 a2a10a27fd44c2b464f0f342f3783b190415f0a0
SHA512 8892994a2a217c01befd4d0e0ef5ecc578bb72c9706adec7db4a500cff51d4caf7f6ee4d5cacffa9e50beb6493a3a4bd11aec9ec48da0006998bd8b559f410a4
SSDEEP 24576:OD3FHshBIYQgAnnAUz5DFs1jsLqmVNPEZ+OQw:ODVHeBIAAntDU42mLsZFQw
TLSH
T1F925E17EE75C00E4D57BD1BCDA639606E67138AD032266CB06D481BA1F6BEE47D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1560-360-0x00000263AC150000-0x00000263AC1FE000-memory.dmp

Download

memory/1560-454-0x00000263AC150000-0x00000263AC1FE000-memory.dmp

Download

memory/2708-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2708-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2708-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2708-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2708-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2868-65-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2868-59-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2868-53-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3580-22-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3580-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3580-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3580-14-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3904-106-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3904-114-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3904-108-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3904-324-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4260-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4260-321-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4420-414-0x00000259381A0000-0x00000259383E8000-memory.dmp

Download

memory/4628-328-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4628-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4628-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4628-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4852-73-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4852-67-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4852-278-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4852-66-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5112-77-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/5112-0-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/5112-1-0x0000000002480000-0x00000000024E7000-memory.dmp

Download

memory/5112-8-0x0000000002480000-0x00000000024E7000-memory.dmp

Download

memory/5112-6-0x0000000002480000-0x00000000024E7000-memory.dmp

Download

memory/5112-363-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/5132-95-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5132-327-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5132-326-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5132-323-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5132-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5132-101-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5172-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5172-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5172-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5172-51-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5172-64-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5172-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5292-464-0x000001928B540000-0x000001928B5EE000-memory.dmp

Download

memory/5716-82-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5716-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5716-88-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5716-426-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5716-428-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5716-322-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5920-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5920-126-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5920-120-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5920-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5920-131-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download