e866682e7664ef9f3ac41e09da9c7817d23c8b91def7a43d729b1b30561281bd

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 23:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_c2cf6b5aceaa15f6e35ea945d999e36f_elex_karagany_rhadamanthys_stop.exe
Size 1.2MB
Sample261102-3g2mbsge63
SHA256 e866682e7664ef9f3ac41e09da9c7817d23c8b91def7a43d729b1b30561281bd
MD5 c2cf6b5aceaa15f6e35ea945d999e36f
SHA1 0a500d4af4640e4e28b836a8daff20526f2693e1
SHA512 060a0d783560542e8bebb7a21ad5c67608191a0f386640946221923fc6756b49bdd8bdf32d8cc57c0f3c6b5fa064592c3f52891bf2398b0bfe66f1d66ad89294
SSDEEP 12288:glJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:cdCN/j2GLl3iFSE33b9
TLSH
T15C552321BAE1E036E07B437406B8DB225715FEF0DA74844357C41ADF6A78BE49D362A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2632	elevation_service.exe
4472	elevation_service.exe
3856	maintenanceservice.exe
2912	OSE.EXE
3532	PerceptionSimulationService.exe
5916	perfhost.exe
4404	ReFsDedupSvc.exe
5844	SensorDataService.exe
5480	ssh-agent.exe
6108	AgentService.exe
3040	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-11-02_c2cf6b5aceaa15f6e35ea945d999e36f_elex_karagany_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-02_c2cf6b5aceaa15f6e35ea945d999e36f_elex_karagany_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-02_c2cf6b5aceaa15f6e35ea945d999e36f_elex_karagany_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-02_c2cf6b5aceaa15f6e35ea945d999e36f_elex_karagany_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7e35d500227843b8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-02_c2cf6b5aceaa15f6e35ea945d999e36f_elex_karagany_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-02_c2cf6b5aceaa15f6e35ea945d999e36f_elex_karagany_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105656\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-11-02_c2cf6b5aceaa15f6e35ea945d999e36f_elex_karagany_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-02_c2cf6b5aceaa15f6e35ea945d999e36f_elex_karagany_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5220	2416	WerFault.exe	87

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-02_c2cf6b5aceaa15f6e35ea945d999e36f_elex_karagany_rhadamanthys_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c3464c1c226bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000012217d1c226bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018723c1f226bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000097b0681c226bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba14a71c226bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe
2632	elevation_service.exe
4472	elevation_service.exe
4472	elevation_service.exe
4472	elevation_service.exe
4472	elevation_service.exe
4472	elevation_service.exe
4472	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2416	2026-11-02_c2cf6b5aceaa15f6e35ea945d999e36f_elex_karagany_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	2632	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	6108	AgentService.exe
Token: 33	3040	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3040	SearchIndexer.exe
Token: SeBackupPrivilege	4404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4404	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2632	elevation_service.exe
Token: SeDebugPrivilege	4472	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 5964	3040	SearchIndexer.exe	104
PID 3040 wrote to memory of 4176	3040	SearchIndexer.exe	105
PID 3040 wrote to memory of 3104	3040	SearchIndexer.exe	106
PID 3040 wrote to memory of 3704	3040	SearchIndexer.exe	107
PID 3040 wrote to memory of 1568	3040	SearchIndexer.exe	109
PID 3040 wrote to memory of 4976	3040	SearchIndexer.exe	110
PID 3040 wrote to memory of 1140	3040	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-11-02_c2cf6b5aceaa15f6e35ea945d999e36f_elex_karagany_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_c2cf6b5aceaa15f6e35ea945d999e36f_elex_karagany_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 600
  2⤵
  - Program crash
  PID:5220

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 2416 -ip 2416
1⤵
PID:2756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4472

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3856

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2912

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3532

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5916

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4404

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5844

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5480

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6108

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5964
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4176
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1872 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3104
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3704
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1568
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1872 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4976
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d2a0964e1b05fcf70009e65c708415956e5548265df5a14d42a74b36882bc1a9
MD5 8f640858b82c176b5ded7085b93a408d
SHA1 da2ff8aed229c24cf66b6bd099c092ad281265ba
SHA512 1943f2a6ae30b950c74b90cf92305e5fe3c70b2520356ddecd0d23aa4aba8d1b9279a2ec79d4fa59a2bfd71e810421f21205b0cd745454b495424e72ba248a1d
SSDEEP 49152:xb+632BuPkFKRrdE6ohvstBhuXjfS4LWxneN/j2U4FH:33q6sjBLj2jF
TLSH
T125D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 a2b56f5ef9fa8addd7c675c3a6eedb6400799cbf3d1ee42303a3fe847346f726
MD5 1db2d5cd4f8ae2468272af0562c9e523
SHA1 1a9e9c944d8e74f1a2b3910c102a1a5ac563b761
SHA512 d8e6d2257716e2aa524ac0a19adf3235d55f4c7e770be1f8932bc6815fdd9a3c86a291220b499d1d57d213d1dbb7f3b65bccd39152160200b641b5a725ddd5c3
SSDEEP 12288:31XLsswWkxy2lRq2czAqJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:lXYfDtczAWdCN/j2GLl3iFSE33b9
TLSH
T1C165F128B7E049F9EC67827CC9A1C511E632B8948760E6CB03E49A761F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 d93d9cffbfa078a42377db7efb21b5ae51a8f0871f7a945760d3be7af07384b0
MD5 55aeb9bf607f158d43cc195be1106e74
SHA1 52552a317519bf29ea9c65311c4f524a71d8a48b
SHA512 432a22f17dc5c2a0a04cf4f378ac995a15d5502c03f2a6d54352000136539d61aea797ac0e404ed9afcd5144b42dc302630ba3124d4a07c247f5590a6e575267
SSDEEP 24576:l0Le5ji0hmxxrMqdCN/j2GLl3iFSE33b9:lPji0AjIN/j2U4FH
TLSH
T12285AE26F6748335D073C0B9C5D2A69AE97130855B308ACB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e3726eebbdcf7105df8848a8259c15c7676bc6a88e6b3ac046d5a04325d304ce
MD5 d3476c3ec770e93ad23ed9f9a95c9d06
SHA1 86e94ba22f255240399de1e4dcb0dd3c7ebb139f
SHA512 739983630d90521d5b7478ce7bf72ffaf6d2930d57ee1e0d57cd9314902e5515f9ed5a6f3ecec24d23b2c34f7c2215bbbcff616d3ca5d52733675ed80a97ef3e
SSDEEP 24576:ca7/ezSC6vUyD/aqgrvWn6q8wyuAdCN/j2GLl3iFSE33b9:7/ezSC6vUzPveHjycN/j2U4FH
TLSH
T15C755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0fe7581ea35313510f15e6d8548945160eb76f9e72a30bcb255f1c6485f6a2db
MD5 12536a2dfd44bb65da03846e80eafc1c
SHA1 09fdac96660733e795f6d5166326395c33c6d8c4
SHA512 2532b78c2bcd83ceab7f14601fed4407e0b7305ced828d472eecf12d863e88a97b0077f48bb6520efacbd785b7cdc18a524b334cf3dc1b2b5c8016c2270a70c2
SSDEEP 24576:nVbqPb88hv/l+Y9dCN/j2GLl3iFSE33b9:nVO88hXl+DN/j2U4FH
TLSH
T169559E66F5748331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 81e0d1ff9e4a87786edd8afe0c63d52532d8f8636c8599efc429e0a53859504b
MD5 1728e759431af7909935d9cf15ff385c
SHA1 272fc8d998b0ed8d3c10129c03620993bb0381be
SHA512 4547e77b05462ec3534b291cb68b524de2e0468d2bc2d817545827c8be97272812b398210dab651212c15b57d169967114106af0bd570baa1518946e5bca0ffc
SSDEEP 12288:wLqJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:wLWdCN/j2GLl3iFSE33b9
TLSH
T150452360DAA5F565F26F837903ADAE656200EEE8E525884781913BEF517CFECC032063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 32907cbba5f37d597c669e05c962a0342edf78eac9965f9a63f1b1b6be18fc56
MD5 0136381ac743c843e411073ebe883dca
SHA1 02a064f52d21a36d81b2ddb1769f41011138f2c6
SHA512 b5a7d66bd8a22c822ba5c660dd00ddbe294bd9bb0f2c09a4b43c5499247ac1ec204d0882626cdcab34b22a7cba5ae280a3b8e38557661c45539e06603f593f20
SSDEEP 12288:peBNUbTVO86UxJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:pJIUFdCN/j2GLl3iFSE33b9
TLSH
T14765CF3BEE28FCE2C27E8DB85791C600976278708B6293CBD165834EDE235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e8776717940d6d393ae9f93640f38d38866dc951d7899106a7cfdb631d6c3bf6
MD5 d606f0b10d793c921e5da5da78082081
SHA1 60f95ac32a5b1e76ba737d9b35f665e5e53013ad
SHA512 07bfebb67a0736562048694c3cfdc789317da81996579301070c971f8d10cb74fd5a815ed8058374f07f47df137f1d8550670de19e3f61de2b2b9958810d2fc8
SSDEEP 49152:6QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THr:6QvGAdlCEL8c/DRNw5C1j2jF
TLSH
T174266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 5af0baffd4af5c44440db8e38504fd5f96e570045b6cafc7037c130a992599b9
MD5 e41da5c9b9921a6284bc3070db465117
SHA1 1407c74f922f9f2dbe2423aaf501668cc43f8549
SHA512 c515a607644ae5faa06ef83e8dd534136e5d3300322d222a81a422d00b264573169685dbf6298ca59f54c23c19eef0ee8c06eead1f2376898d31ba7bc77e4095
SSDEEP 12288:dAwSfxL/2Dc3RDLLmt0LDQewsAjjJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9c:O0ewsAjbdCN/j2GLl3iFSE33b9
TLSH
T10A75E031FE74E436C2BF0DB61B36C716142CBA608B6119C3E3E84E9E59346D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d0720daaa1799a79a40bb13183b9c2139d0f8ef36d434aeaa85d60dff443cb4f
MD5 a1da6b9006bbf11265ce2803a86c6bd4
SHA1 90049da63885108ecfde0fe75e4de814b29c41b3
SHA512 0a39e5270a44e2cb4d54853bb832d24a6ee07e96997446cb6e7d0eccea6f936f4311c964738de1d0a60aace82198ef17ce9e20362f43cf5854353504cbf455fb
SSDEEP 196608:IUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHM8F:IUEtQevvqc2W1cpV2tI32M
TLSH
T1EC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8df01b0230b48f64b48030eaf89e0a733e867c0cc7fc386be06765d03f5de93f
MD5 c535e2f2f0a4213943b26786f919759f
SHA1 a477388f6169744d8cc17cda8b6ed67aa9c8bd29
SHA512 29a32a9a8aa3e35db09c493133d6beb59325128eebaf8b4870b14d162d17a985872f72df8194f938d3029f73d9b77c34dcb8253c4234cecfd2d857adb651670d
SSDEEP 49152:yCbRquA/m2yL5zTfFiV+XenmE3/zYN/j2U4FH:XoquVjnmBj2jF
TLSH
T114D58D1976B8C2E4D1F6C37886A2C647F37178158B3197EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6becf38e0837aa61f2309228b1983c50c3af28407b3814c95e5b7f94ccae0098
MD5 45582997cf616a0c5ab91937fab27218
SHA1 6cfa6eb81fa3d2b19199e0fc21b1dff06201231d
SHA512 427bbc9b120030f29e44ee2033998f4d654a29afe9f0f3ea536a44c5dfd4e707a0b0af06a82f1515b1991eda7190c7130812d2661958036cfeea4f7bcffb283f
SSDEEP 24576:jAhGL3IFoiwtA5l7S530dCN/j2GLl3iFSE33b9:jAMUFoiq5vN/j2U4FH
TLSH
T18435AD80EBF955D4F5B3AAB899B69571EA72BCA95E31C20F1150D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 075feccd1d5ba7e558f17464f1f973d654c11983639938f6f7283e4f8db0fe88
MD5 570e674151870064a70d60c7b176c9c1
SHA1 fe3e3464ed756af350fa8e298d2e9537071b10e1
SHA512 95f6ea9b9d88ad9e9d47da9e59f6b66646f8b503d0d71d81eefb74b8f70d0fd63ef4236f745873f1fbc6f5bd4da7aa55993a9eb285c17877d07c4d8abd96094e
SSDEEP 12288:3mw5HEjsChNVBFgl0WDm+CDJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:Wwu4OWgdCN/j2GLl3iFSE33b9
TLSH
T1C265F14577E41CF9E56782398697C536F7B2BC512A21CB0F03A0C69B6F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ce5da88b81b42cf753b98c9f230c589850f9116651d00d006951400462e92ff3
MD5 5f08afb361b65d3871bbd69f9258fd97
SHA1 51d452637ca60579e5eb8b45556e146adf003221
SHA512 72311f6de2eb4b5a521b23a158e2a084145fa1070a556c259a69e47e2018113b484165681f79c2647fac44301a9207985bb21d59fe56d1664d5fd71d38f90bb8
SSDEEP 12288:VeZ1IyzJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:gZuSdCN/j2GLl3iFSE33b9
TLSH
T1D555125937E471F9E1A7823C8AE59A05E321B8A5A73243CF025047EA1F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7a81f3a3efd7fe6732495c42abcbb5d7d246c1953cb352aa49587c2650962d61
MD5 2514ec7f226c485478ea902f8271ba3c
SHA1 3a3bd82f0313e2889d359d267e9570b30e58d106
SHA512 3ef547e7aefdfa6bd89cfe3f9cea47f67709c0ecef2855e02874cb7b6cdab2690124965e7cd7df4fefb1a1a83d633a025c6badcc9e1aa104682eaf0eaf8a581b
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uf:8QRQyi36YOcPbLvw2gAf+PN3Gj2jF
TLSH
T1D4667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a06fc4c3a6d5478a5d14f9147f831f9a860972a82cb090747c808a46d1a4cec2
MD5 ae12277a396ef0e0c0debff02771354b
SHA1 886f0236a780592def01c7b0f4ae85d82c67ea82
SHA512 f472cb59d625d09fdd3742c48e143ff8e2df80524288bfb64a6f4345d0e308cfd073a45ea85ddf9c8e32b2c52415aa156b6acbd3b15631e74d19c3ab90b61e18
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uf:vQRQyi36YOcPbLvw2gAf+PN3Gj2jF
TLSH
T160667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b0e56cb760168a1934bf7524425da4611557143e2a718782b7b3ffe2c2f5bf73
MD5 3e6c1f164eedd23628ab252f06cf770b
SHA1 d96695a217b3bbe22109609236a716ff39926455
SHA512 fb2fd7cdbae89878d34d5ac91eaee6e48d50523f24f1f31f62b078be7d6c65e51819f54c5bd3f392cb8e99eef25912f6e46fc0067c6861ad9442cebfd83d839c
SSDEEP 24576:UwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0idCN/j2GLl3iFS+:a68Qg55nhceWu7PNU3/IN/j2U4FH
TLSH
T104B54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8541725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4eb619cecd7cd3e88fed16cf0765d03cec74c1f7a93aa239790000114a4806b9
MD5 798dad55b0292c1e1cd20b73c9f7bd84
SHA1 9ba8772455132d74262c72526446134e55f3435c
SHA512 2fb2df4e531ba7d5303ef5a784d404661cf0449ad32de8dc0174f8b9486eeacaacf9d8c45392a36d9a41cdad1a177dfc6584e72fd7a75b2056b4405ed810f5ad
SSDEEP 49152:i3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99Z:jy5112gYy5azzVvt69nLKnhZXj2jF
TLSH
T1E3168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 13191889da0a8dd8b60c6cd6ae288c18c7dcfbb34069277acd2d5cbe53aa9e17
MD5 e00bcc25a3e139dad8723fef3bf47e11
SHA1 5078fd4b1315f428b3400e19e0aa2c4379fbec08
SHA512 6d361845c0ef0242943dbe4ea599591ef7850d6b83365b029e521bcdb91ef929f683868f7d86136d6e119959097b72f1fd2b563b5dbcb7abd4980755124e38d1
SSDEEP 49152:HB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glJN/j2U4FH:Ju6Jmdxd2dHj2jF
TLSH
T105D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a0cc853b30be401f5c3b56e0e55b77c7a27cad0855bd12e11dfaff3b7cd3fcc3
MD5 a826a6468b3f57e3d128d5748a67aa42
SHA1 6183e0448405eda7db9fd88e62de4b29e00c05ec
SHA512 16e2ee103deb023ddedd73816664b00522cbe693c5fe0ce15cb864785002f7296cbb21a41433159c13895f4f413c3a079c67dc27c885663f5f6ddfed24a23043
SSDEEP 49152:S1hpsNoJpF1A63U44CwH7R4xaN/j2U4FH:SmifPWRBj2jF
TLSH
T1B8B5BD13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5b15e1df5fad718ea5de8482d448e10db266c7667fd3aa88b445bfa6a3b2bd3d
MD5 987f35278546a434d2aeffcbcd55f935
SHA1 80f6e8d1ac7dd044c07c7d00f9151489f632aae0
SHA512 a4e631bf219879b240efaf304609fe7b8ded045dbada4cacca60d09b98e5fb04f6fcd1a0fe2e0a1aa453c7421cfa3482de7c559276c47af2441e9fe57e1d724c
SSDEEP 49152:JSuZQIY0Be2KcRVtOnks6NMHqVN/j2U4FH:H5dKii617j2jF
TLSH
T105C5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3eb246d4ad10b14d2f5cf8be25251c3839f26e4a5192aa8e850b02b2ed1b2f47
MD5 8af12692dd9620da3d4d3701b1526cab
SHA1 1897325f3f178cf37ae85c0d5bdc2c30751d190e
SHA512 3638f1c74721f4da5e610d331ba163c14c9907de4c9c3b008d1ce95332782efa4e9b0d011bfc771d583a673c13f577a1c769d36be8bcfc7271a379ba325170bc
SSDEEP 49152:EhtSn8EApI0fig3giDn0AP5w2N/j2U4FH:FX2imph9j2jF
TLSH
T1BE95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 5e7e21f6c6543442f7b6e9f5db80226f2f573b112b8a162015d522769649d6a9
MD5 7a5fe3ceefb8258f6e7424ca5dd08078
SHA1 e5d69fcc629caa673b1b4adefbbec2265a33c89e
SHA512 51d3a30008dc6053e5c0309cc836e1069ba312a407f5acb61e3ddafde330f4b867db6cb20964ca5b7446a03008d8f10272ba680140170f7eea2d1ea2b8b566f8
SSDEEP 12288:PCJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:PedCN/j2GLl3iFSE33b9
TLSH
T126452364E9F6F669F15BC37D43A99B555200FEF8F6264487828116EB637CFEC8032062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 cd52bd02d8a5f78a87bd3fbde804cb686e7d89ee11fd173a59edd0e98dbd31c3
MD5 0a0d3f58408d8a850a0da26737b8d6ed
SHA1 369156af654029f099cad33f5b0e34a5045b8140
SHA512 8ac80550380c83d52f9ea4375515481201678e7c2604fcfc31a3051203fc5d2a8a9713ad7b88869ac57f70ef982955969d82d5396fabe4ea8fb6bb7e2e780b36
SSDEEP 12288:NHJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:NHdCN/j2GLl3iFSE33b9
TLSH
T1E2452364E9F6F669F15AC37D43A99B555200FEF8F622448786C156EB633CFEC8032062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 28ebdf1024775a94fdf6c1e7423367f5a40f975b9743a7bdb285e5ba2b5e942d
MD5 ed8cd20148b4c793f7603e86eb6994ee
SHA1 b841507a17a89af66e0b55f9224245eabf3c4947
SHA512 3d1dba68143fd9f8c7389190734019a7fca7ed999230055783de53482d9580e15aa77a45b25a272c75a1bcde3304b2da39ebfac719cf26e7bd8e03327f8bd3f7
SSDEEP 12288:WJJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:WNdCN/j2GLl3iFSE33b9
TLSH
T1DC452364E9F6F659F15AC37D43A99B555200FEE8F626444786C116EB633CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 f65312a04e8a8f594815c16c775a2668140ac9302d97ec0e94a962656375e9ce
MD5 90e1356be553048d423c898228fa9000
SHA1 9f8d40981a86ad72743c000d632b7f115b728d0e
SHA512 da6b057cd1794946c7c4fb7e77b5fe76df7c882e15e0ea8f1eed4020c4e011db72bc5cc8ea241964c237a9c9827288cbf8c108c0fc0864b04b5ac180715a3152
SSDEEP 12288:tVcJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:sdCN/j2GLl3iFSE33b9
TLSH
T131452360ABF5A1D5E06BC37D83B59A11E320FDE8E732458F87400AEF1B74BE89431562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 bb3aa86211d9e5cb5f43e0c130481d16d7c9d28b5f442a514c0ef889387b340c
MD5 30312f30c2514a21690723a3d0a0bd03
SHA1 5e3e21114d6a49bf1a7140d5fef95afaf05e44cc
SHA512 debc752d1d9afc6e518aae03a16d92d18ba8bf084e8a32fbd2a94a8222c779bde1ecae7533412fbecf15fcd6cec8e89bd46727a75ad749c7c95961173f8da473
SSDEEP 12288:9kJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:9MdCN/j2GLl3iFSE33b9
TLSH
T10B452364E9F6F669F15EC37D43A99B555200FEE8F626448786C116EB533CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 32702df0ec268788d13eaec3ae78a34fbcf22386581feb06aeda20930439ddd1
MD5 67ea026801667984d8bc7e3b78ac95cf
SHA1 c0e50866078134a1dbe5422a75f653b2409cc43b
SHA512 a89f184a3e1fc95e522803e407e95446b58a47ab05cb9958b25229ce365e8d28406f4ebaf296124312325c53686ef57bae380eacbe99cc093460050fc40cf48b
SSDEEP 12288:5bJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:5DdCN/j2GLl3iFSE33b9
TLSH
T181452364E9F6F669F16BC37943A99B555200FEF8F6224447868156EB633CFEC8032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f0f06be1af26c3e7481757bc9ffe50805db98f96226c1f6fa665cc67dc408fd1
MD5 ab5a86b43dddee8733b0ba73b0beb3e7
SHA1 61bd1e6ec38f40ebf49f32699db22d79e450bbab
SHA512 df3d7a4fead60c1e750d4b59a95fe4fd79fa2d3ddfeef85a1d53baa4a19740c7778647601f2c73afd8e61873cf798cd1a96ac5e86cfc871d397dcf98caab98e4
SSDEEP 12288:6vJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:6/dCN/j2GLl3iFSE33b9
TLSH
T157452364E9F6F669F12BC37D03A89B555200FEE8F6264447868156EB233CFEC8032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 6013090e0ff170f1a43ef58293408af8bbd0b638f1f50ee3790c36aa1c11b2bc
MD5 6c91415d8db7de195d59bba8332f501b
SHA1 ecf774be486b5adc7beddd6ca8e01543ec2d4501
SHA512 c713a01716d18c798c3c18503ce0e337686e0c99ddd1da4e654b0c62b15480adfac26737d4aa2bace5f513b492d973e9608e3b3f2b388a03ef3f95749504a6e9
SSDEEP 12288:tiZwbVzzFEoS2cPvynJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:wZMRzFVSOndCN/j2GLl3iFSE33b9
TLSH
T1BD6502A4B3A058F8EC67823EC9558906D2B1BC594770C60F03E4366B5F377A15C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 686201082d055d7a0d1d786ef140fb19327baa7030ac1fae40e12e94c5ff51b0
MD5 40c92aa3e6d04898cd6a2a77b27b596b
SHA1 de2af2f956eb2b88b389d6b4d5f94dcf087e57f6
SHA512 6c7b29c6761847f95ca1eb8dfb11c2246cb9aaba56493cc7ce9f32cc96028d72bcac99969c4ac2c57fd97d0887a5bb9ab48d4fad34e706c1fb3eb14c367c8b73
SSDEEP 12288:LuJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:LCdCN/j2GLl3iFSE33b9
TLSH
T12D452364E9F5F669F15AC37D43A99B555200FEECF622448786815AEB633CFEC8032062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 cbace07608fd2ab0d6612d68a01d1e9a2da5c1ae44ca38aaa874438608425913
MD5 13c307680ea3f14b3051de19e7ac08fd
SHA1 4b38f10f828d26e9659ecd07521eb4b4d0320944
SHA512 13b625f36abe5dc053529d0dfd5949ab727ae8d23e0b3b4c41c7459d106667a720125106d1443eaea222bf5fdf8828f2ada29407cb5cfc12bb1f1f08505ae519
SSDEEP 12288:O6JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:OGdCN/j2GLl3iFSE33b9
TLSH
T1D0452364E9F5F669F11AC37D43A99B555200FFECF626448786815AEB633CFEC8032062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 a22ba4ac5305a87fbb17928b7799982d92a676a528884c8731c58aab41d4b293
MD5 992b4f93ba1d2246fc2ecf5141da7281
SHA1 266af922099a700665d92114451bee7e1eecc40d
SHA512 383256a81fab652eb1d0c29ec28b528c08dd6ac654fcfe20554fb57e37f183057fd9e5b857b74ed4d2cefd6b6950b301e23329e08264f60579ce9554a3a4e5b2
SSDEEP 12288:OyPz5L8zJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:TzyLdCN/j2GLl3iFSE33b9
TLSH
T1FD550217B7A131F9D177823889A65A01F331B87597208A9F439007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 cae8d8effe5091eaadebe8c149437702e464e2f17f61b5037cb8760a86a904a9
MD5 6d345b1fa243ed321e94d0617c6b178b
SHA1 dc475fea2959e391fc8eced997c533e810c41b1c
SHA512 52b203e806fcba93bc1b50a0ee8c556ec1b44aee9c839f76fb3ed9da4727c6dea33e59a37a31bc5dd9b6ced734cdf9431ec2bfa95f7805c08c35a688fe82532c
SSDEEP 12288:MuJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:MCdCN/j2GLl3iFSE33b9
TLSH
T117452364E9F5F669F15AC37D43A99B555200FEECF622448786815AEB633CFEC8032062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c5d0cede4fc40789bc7c5c31bfe57fe9cd054c6e84e7ef064fae6321c952902d
MD5 29c4df6ae103615d2ae06ae4ca22f9e3
SHA1 942ab24ec8027a10b82764358b7dec75aa943836
SHA512 16dd7cc279996034e9221af0c94ae6525cdb045a3007b382b92b196d1202e4c20b77ac90ed13a704d4384362e9ad338516f929591313c9a07a85bfc1cd0889e5
SSDEEP 12288:1uJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:1CdCN/j2GLl3iFSE33b9
TLSH
T151452364E9F5F669F16AC37D43A99B555200FEFCF6224487868156EB633CFEC8032062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 702820cfdbb6c3fd6b25c7f9baaa297f6aaeff5dc17d10fd6110efe0731cce7f
MD5 79b38530635b1a8713834c17158808f5
SHA1 75dbb9c853e702ed86a6d732225db02a6f10ce31
SHA512 233525376302b431be49a675dd57f70e509a74b074988c938abb2d4dd18f8fad59269a9fb84216bc3d7d36fb1fb763515ff873add4dc14c51a140c501bc3143b
SSDEEP 12288:3yPz5L8zJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:6zyLdCN/j2GLl3iFSE33b9
TLSH
T190550217B7A131F9D177823889A65A01F331B87597208A9F439007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 ccde0c41e65903be7036b7237071c94a3a8f7c095dd01e74a15682fd33384f3d
MD5 2b105947d56675a536638b5cbd3e4982
SHA1 4a7504250e40c0350ff9f52e83042a204a54a287
SHA512 027af0998aca86e3ea35d8dd32de89f5e9d9ca5a93f27da7f048cbfe58e4cf5e21f546c74bfeb28595eeaf92e05c5419c42fee78080cbdb6b5f318e764aebf6a
SSDEEP 12288:FCd9CWYoaLHF3z0z04PDvh5JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ATDaLl3z0zDddCN/j2GLl3iFSE33b9
TLSH
T1C96502A4B39058F8EC67823EC9558916D2B1BC694770C60F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 ab72e32322f057ee802bbbcd2724ce285c3378e179290f2179a3652f1356de99
MD5 587ec86f186a2c42e4c4152286305f01
SHA1 71588a58a6771b84a11f9fd123dd208cd49e3808
SHA512 a8e4b98d4e7e0586e9b579bb44da68897f7936c6786ee5bcff4ae20f70573e3e2ad48ca03b1c2be078c20230c2e005472086335af8cc1c6968cea45905d59042
SSDEEP 12288:li4e7KRdTfgwCHKy7GLbbdIv4JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:l3vd9CHKy7GZpdCN/j2GLl3iFSE33b9
TLSH
T1D375CF90F3E414E8F0B7CA3589769511DA767CA95B31CA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 b45c32b20898ba8ded8a6fc7203c50e96dc109feff1d02325dc55cd941f49782
MD5 0c61d1c185ff8adb33a75fb8ff0803d2
SHA1 400183c70b0d65486d9b9ef765abefd79f4a6729
SHA512 dec6ab08fc612f620f31afdc7933865724d910a616d2d16f113250fbdb86f3befdd64084d6c5bae7be27d9608ab9296ffc9690ddab436e4b8506763e593b9eee
SSDEEP 12288:5pJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:5tdCN/j2GLl3iFSE33b9
TLSH
T19C452364E9F6F669F15AC37D43A99B555200FEF8F622448786C116EB533CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 e3622b0708283ca1e5f5db4440875e502297e2dbe2a6b84fe37fb2874733988c
MD5 98ba5902d4def9cf45e39dddeb0aab8d
SHA1 d73556ca1910dd7f6a76c4379edc34c1144fc5db
SHA512 1add51a2760b9e293a219eb3a0f35d5ce03edbd46ff14bf564a0ecc36183bd9ac43fbbd690992dd0b170ce688bbbc5947fb88ec050b15de84b292319c4f97782
SSDEEP 12288:UTJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:UrdCN/j2GLl3iFSE33b9
TLSH
T1AF452364E9F5F669F16EC3BD03A99B515200FEE8F626444786C11AEB537CFEC8032062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 f1b72502e00d299a54069796380515ce7425192fc9169d43cecd5dc5498d74a4
MD5 e959ef23a2ba72e5e6ed46f49b9aa427
SHA1 6cb152c4bef7dbb10941e9ac9b5ef286436bb3e2
SHA512 f9b65e0a2d14d83fd2007df12e624c96f45ba01e7f081f94a62998c9f6c930800c811c8d3026d373e16b2278ce3264857fe27e6e8da6586377b4c449a75b16f5
SSDEEP 12288:o4JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:o4dCN/j2GLl3iFSE33b9
TLSH
T1D9452364E9F6F669F15AC37D43A99B555200FEECF626448786C116EB633CFEC8032062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 0cd726726cefcd559cf5f9aca8181c2891434cbe1857c0f16227625c8748d401
MD5 b489ffe7ba23a3e2517c42a6d8944a84
SHA1 82603acb6061c83d69524edb6a8f01a2242caed3
SHA512 7c246cd4244d856b9c1cd14226c579c7422ab96a6394ee91e7440b5450d7967f9a430c8de381fda6c128a890d1f3d36a9550c06edb904e5e00090a5d21268211
SSDEEP 12288:+uJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:+CdCN/j2GLl3iFSE33b9
TLSH
T140452364E9F6F669F15AC37D43A99B555200FEECF6224487868116EB623CFEC8032062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 da702acde5a43c9b76af5fd2cbab531932d82394d26654da0e7c62dad6c0af77
MD5 4e2d6fcc4259ecaa68d9ed706bff6a35
SHA1 5091014d4f1776fe921e07504cefdbac6d5ad3af
SHA512 2d30dd22122f36101d6ff321f573bd3bd366f4dcfc76bccb6d30f1dc72bd071d274b59bc9656622e5200438ec3c2349b871481f00182fd07ae1e0bcc09c7c3dc
SSDEEP 12288:CpJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:CtdCN/j2GLl3iFSE33b9
TLSH
T134452364E9F6F669F15AC37D43A99B555200FEF8F626444786C116EB633CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 84294526fc6514f30cf241f57f22ed0b95b433535d77342d6542efe0871b991a
MD5 244d831b1cf7b2c8c9c56702461c8ef5
SHA1 cd98189ecd640c49687c88cd92b8bbe186f002f3
SHA512 58ba8ccb2ac49d4510be40808a1f7fb61139a6eaa90959d69398c001d1f223948164093a597aeb10ab9e136400bf64c1c3f03282cff9b2dba356c3b848d8586a
SSDEEP 12288:x2JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:x6dCN/j2GLl3iFSE33b9
TLSH
T170452364E9F5F669F15AC3BD43A99F515200FEF8F6264487868156EB633CFEC8032062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 46a8fc6a41f0142bc39c423ea84fbaf5888bba82a96eed2e570be3f17acf4b1c
MD5 bf3cadd35cb806f90adef8efa4fab7a8
SHA1 5348c57dd03f8312b74a26ebceefaa5758da80b8
SHA512 408bb3932f9fb9ff91226efe9b6585420f1e8f52f522770e1798001bfbf4d0dfb5adb2c23cc9c1e9215791246d2a0b3b0158bd3edd411aebdf060b21c1d45f76
SSDEEP 12288:3kJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:3MdCN/j2GLl3iFSE33b9
TLSH
T13F452364E9F6F669F15AC37D43A99B555200FEF8F626444786C116EB633CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 58229030f392293d6151148a42f05ca885480f317981114ac3578a268cb08685
MD5 73596b10c9e18ce46f9e75ae5e79bed9
SHA1 e6325c523c5c2db6a2fc592d94bdf352668b2154
SHA512 39396169b3870e2d755b6c28c2b7d5f9699c9654d75fbe1eb7802be94bbcf6b513c64aa32361c8bbd82ee48d26be4ef3100f6948105a3c12dc401acbec1646f9
SSDEEP 24576:2fwvUk9RX6wkyAI2dCN/j2GLl3iFSE33b9:+MnYI5N/j2U4FH
TLSH
T1FF85D029EBDC44E5E177923C89B7460AF2B178685B31C6CF029A53AE0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f26461f123f26ae28edadf40875e06f1ff72b1499d1c938c28edaf9242d44802
MD5 d90337b8ded130080ffbe1fdaba0b189
SHA1 a5d6c5bb320058279b5a6c652b19f321f4285eb2
SHA512 1087ef7923406b2baa53feed433b6de72671bbeba0afb240150d1d06b53846a3c7bd433db4d0ee9c36dea863056dd477f6c4471cb1c5f44b163ffeb40fc60476
SSDEEP 49152:XYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0WN/j2U4FH:SySzPmj2jF
TLSH
T14B067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9228276df8fb727f5acd6d5ffdcec754d335520095f17f2ebc7e5cabd4ece258
MD5 3ade17061b82119b192fee281c1e43d0
SHA1 3a0298a7b52100a3035b6070cddc9a7c2d82875a
SHA512 00bb6db4574ee55abdce13ac16df67472ad0dc864d6f78eae29f96b7370dabaae1d8b11e76e1a4d7a9db101a8f2299e48720bd63e4b1fcb963c01b0e72798e8c
SSDEEP 24576:j47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYXdCN/j2GLl3iFSE33b9:j47JUQjTirIhCnDHUPfF/GN/j2U4FH
TLSH
T1C465AE1DA3EC01E5E1BA827885158A5AEA71782D5F31CACF1270437D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 fc26a4d6c39939f328c1f671425bec890839be1eba871e7f354bdb535848d710
MD5 b8466b455e1c6aa7ba52e33e8ce0a29d
SHA1 59786d5d0be325af2aef4fa13e1d485a789cf527
SHA512 0bd7da1be6aa306dce2cfb6fa186993c07538c61a0b296265e88f6b4ce27c5febe1da693a8231fb60dc712cfe7ebbea26f19b262d90001860328684991f9f611
SSDEEP 12288:WbsfeJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:9SdCN/j2GLl3iFSE33b9
TLSH
T19B550119D2A852E8D06E9279C7558A41B3237CA493E1C3CB43C0F5BE1F39AD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 c0efa483965367a33b2c420ccc9280d4fd42e229f3ad9006c5d79c622c0405ec
MD5 a7fd3aba50305d5648c9e1ee32879dc7
SHA1 7d16509852919e91e061a813f721bda8fb4b9407
SHA512 a19ab83af4c06e56b3aa90ea6e87c7206e1c309036fd880d189aef0f4d6c67c469e4ffcde67171bc5131217f48f8d2659402e91e071ca93a82d4d8bf296bcb4a
SSDEEP 24576:RS+1cUPnfQxvMmJfHnAWVmkj6WWIa3J1v:bcUPfQx0mJfgWVFj6WWIa3J1v
TLSH
T15B451841762ADB4FC66940325E36D6CCA7707D02EE046F0373C9873F947665ABAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 1794d4ca1d1436617eb353acd062af717f0f205808e6b52f9d13d3bfaaa23724
MD5 71c026ae9259d007c03368ad977fb9a5
SHA1 ed56b95a46231c865551d38e49f1ae1101142b79
SHA512 d8ff42dedaf32ee7daca607851fafcb053873dc64a80f2dd712ffe4825adf29deaec793868d9cc0525256b9a63fcc0df5cbe6f4191f831b1ebf57c428105b59a
SSDEEP 12288:GYUThy+YXXBgqT1ChxLqIGhCR89JZjD0H9qKUmEzPV4BCLcntE:GYUTaX1ChxLqIIcSL8ot4ALcntE
TLSH
T1C855060165B7EB0FC97A9037463286CEAB786C07F6452F017345893C986796FB6E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 7d4208d20f95ada9b8c509877a6db9b4b238c75f359ce597abf190ada96288c0
MD5 27499c84be0f984f0e0ec0d32083a672
SHA1 7ff0ddcd997e58c06cec44be13a9dba5bda4c925
SHA512 8c687118a1ca2654657fa0e0e45bd11fb3244e69d17e0f4ec1cf1687aa46a2b7007a5c09db8fd56870b14f5c9b61c81a090827761a60a544c66c0a880445b8bd
SSDEEP 3:OlH/lJZxGvel/4/hVH7y7///Bl3y8jK63mCllltGlslslslslslsl6kK:KqS4/Tuz/7VKcmCtEEEEEEE
TLSH
T1708192294B508750CBA2B63A4C6C038C0313D955B88097AF620A19519D007884C5BB18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 87377dca57e816b0e9096f02d5dba2e99d70205eaca05a0d307c219332cf3d65
MD5 8b5f293e83bf0cf8df1aa35184bd7c8a
SHA1 ba019611638895431c8886059792f7816ed3f2ba
SHA512 a15d109c114e1e469ab488a2032b32893c2fb28726d85387ded1bc61e91c2e3a17b71d322dfe69bab82fd51298072db75c107efd7c44eb954487b5be8146a937
SSDEEP 12288:b07mJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:QKdCN/j2GLl3iFSE33b9
TLSH
T1E8452360DBE9FA55F17E837802ADDA256200FEF8DB1184C7C54126EB6278FD8C932563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7d32dea4a3dd0145882922e9d0f60fc0b4821db8c796a9856a7b13d2c0eda924
MD5 9c7607b82f054fb0f8f986555b5bc6ff
SHA1 bd7cca1e3767b8b302f437a20451a1c8d45b6f03
SHA512 dff3217ea181bff6a92ad0bf5bb7fd003fa4555ed238df488ed2943b8924cb84b57eee736c1c71c6b27f4a9431fa7ffb58f829a69a79ba55254144e6cdea32e3
SSDEEP 24576:ugb6bmBIi49WNNFpg1rSvFv7bYAdCN/j2GLl3iFSE33b9:ugb4mBIBhGFEN/j2U4FH
TLSH
T1AA65AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 8fe20cb99e36e8acec78a15dad815710ee1bdafe53cfb117a51cecdd9350462c
MD5 9131efb26c1aff1d66d6971d397637b3
SHA1 09d406520e27d9e0a244bf885e6210f8032ee54c
SHA512 cde306ed18282131122f0bacd3910b91a648ae81097f25494ac484b63943de8a7a82a1665a4969a7c4ee56f3cf64136fdad5ae156409551bb5dc1581a6fd7d99
SSDEEP 24576:gG88u8FpJqH1bzria7/mndCN/j2GLl3iFSE33b9:z7ZFPqVea7/DN/j2U4FH
TLSH
T13585F16577E101F0D47BD1388A864663F671B8251364EBDF07A88B961F23BE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 a88654a8ab1e7454000cd1c23bf82fce44cb41029d5daca6692f343001777310
MD5 f6f9ddfa61d8c18af147ad984ae98c9f
SHA1 440f1891a26c21fbf01959a253aca455aa88852e
SHA512 4148ed5798f105dc92e6137069a71c39332db11c3fe72ce2345e139c0edeb44bf0248e20a02589a339a217631e632fb80da4b6c308e62c55362a0b864d4aa89d
SSDEEP 12288:ZHvUrBFrEjwaQrJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ZPUr+NQzdCN/j2GLl3iFSE33b9
TLSH
T14965F12E62EC18E5E67AD17D86868719F771B8615312D2CF02D0817E4F27EE8BC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 401a1d87b7cb0e2cb84c470e80bd54cdda772505ced2a3b2836d7433be0820dc
MD5 51f902576ff6a6a056f7fab064104f46
SHA1 104be799bb9755221f487482dcd0572ac5381bc6
SHA512 f411bcde5838ebd1178d345dd5917ebc94d2b2c7b1b026ccf71bddb7d68a1da9163d3617831b29c3275073112729f839d7c62a5aaee9afd074c1452d0a2f5098
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjAN/j2U4FH:YG05lO43b/j2jF
TLSH
T118D5C06A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 47689534c406dd65c5d9323823d02254308925f098a0d9d06de35ced1f4a3101
MD5 9f41fef05aac92e988796e5185ce78f2
SHA1 8cfa2717c2ebfc36ca320431549a9dbdc7a9aa58
SHA512 c9f04463040347d39146494e6fbeec767be3476de145866341b5b3c00f945db758d07c75753b48edeecc6813d1dd03d6832a09f4e1bcb3f65a1e8e632276989d
SSDEEP 24576:qfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnBdCN/j2GLl3iFSE33b9:ia5POZ3BJt2pasx2+mIN/j2U4FH
TLSH
T1FF65BF5EA6FC01D5D1B9D17DC583861AF5B1346153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c4a2f1cd40b7d56672210a059a77d1bfe20b0aa598596f52b8e2972a92aa7a8b
MD5 e57384e2b65dd9f6d61cc70b2f180ebb
SHA1 3a9090f5d1918e058d4956a2c0d1d80c560dec90
SHA512 9611f35d7f4fb71d3e8ebd663b38385c541a7f50ae625cc81f3dc4201c3662066190db2fb47cda84b563ee5c063972759e990aa1ff2cc21b01071dc14ad680ef
SSDEEP 24576:zNcwHdjbyQ4nLC18lb/EOjowL7FkPdCN/j2GLl3iFSE33b9:zNc/zEOVHFjN/j2U4FH
TLSH
T1EA857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8d2672626e3d6d4da77b788ef4cf8578ea03ef04fb61c9a8c202148970cfdebd
MD5 fc87a99c4d09e6f53aac667e3342a523
SHA1 34a1cdd2f33ef119fbdf91fe4e9740a2c1822146
SHA512 addee4c1f438888f014eb42bcbccddaf52e9e8577cdf0d97177049a4d57942b6de42cf55c820c71279ee91d5893f9fc65b05a781c037bcc25335d9ebdbe0325b
SSDEEP 24576:GTkNvNnaFeYhJNtmZBmadCN/j2GLl3iFSE33b9:GTMwBtOm9N/j2U4FH
TLSH
T15755AF6EBAF846E4D1FEC6B58E238512E6727461173293CB4290C13F0E679D89D36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 c84f16b0c61224b658c497c2a09136884e95c80eda081d5d283c195cfe3d0fd7
MD5 94af2b7360adf368c20ed2546610b575
SHA1 3774bb1650f59fe120b9887367e4b384471adc5e
SHA512 c9384b984ba605cfd4fefbf0caa5d24308d53feb0ecb9c21e956f3cd569156800d9981202e5b0df4785911984ea297d261f6056bdde0154107c711c2e314fc53
SSDEEP 24576:GD3FHshBIYQgA+dCN/j2GLl3iFSE33b9:GDVHeBIAABN/j2U4FH
TLSH
T1C675E17DE69C04E4E57BC2BCC6638A06E77178A8433255CB02D481BA1F6BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2416-0-0x0000000000400000-0x00000000005E1000-memory.dmp

Download

memory/2416-56-0x0000000000400000-0x00000000005E1000-memory.dmp

Download

memory/2416-8-0x0000000000C20000-0x0000000000C87000-memory.dmp

Download

memory/2416-1-0x0000000000C20000-0x0000000000C87000-memory.dmp

Download

memory/2632-96-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2632-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2632-14-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2632-21-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2632-20-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2912-265-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2912-66-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/2912-58-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/2912-57-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3040-138-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3040-139-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3040-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3040-312-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3532-69-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3532-291-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3532-71-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3532-77-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3856-44-0x00000000022A0000-0x0000000002300000-memory.dmp

Download

memory/3856-49-0x00000000022A0000-0x0000000002300000-memory.dmp

Download

memory/3856-38-0x00000000022A0000-0x0000000002300000-memory.dmp

Download

memory/3856-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3856-37-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3856-45-0x00000000022A0000-0x0000000002300000-memory.dmp

Download

memory/4404-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4404-91-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4404-326-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4404-306-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4404-85-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4404-325-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4472-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4472-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4472-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4472-121-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5480-117-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5480-308-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5480-111-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5480-110-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5844-104-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5844-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5844-98-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5844-97-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5844-309-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5844-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5916-81-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5916-305-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6108-129-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/6108-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6108-131-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/6108-123-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/6108-122-0x0000000140000000-0x0000000140168000-memory.dmp

Download