cf483f8dc291fc03252547c8869cc71105b3ebd7bc757d652cb5d82012b4726d

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.5MB
Sample261102-wbbqdsby3z
SHA256 cf483f8dc291fc03252547c8869cc71105b3ebd7bc757d652cb5d82012b4726d
MD5 f91786dd1d34c5311a43a3b7407905f1
SHA1 dd6f714908d641a38b951a42b33be194e2162cd6
SHA512 0123fa7270550005ba34c22130a3eb588c99e8434a5f2a836b99851c2f9865c7930028464a0cd0fa9e835478e7cd15f987c4cbf0b4b7d3ec05d967b8f9986c7d
SSDEEP 24576:tDF66jeNqsBYsywPc8peO3r/UN95cS9l0Tp7:pFkBYcPe+m9SS9uTp7
TLSH
T1467501353AE5C073C2B3317449D6D775AAAABCB08F60878B3BC06B7D5E34691962C316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3332	elevation_service.exe
2028	elevation_service.exe
2432	maintenanceservice.exe
4164	OSE.EXE
596	PerceptionSimulationService.exe
4276	perfhost.exe
1260	ReFsDedupSvc.exe
2576	SensorDataService.exe
3700	ssh-agent.exe
424	AgentService.exe
4384	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f955335b67fac3b7.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\java.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\javaws.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2bf09d9f16add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000001db0fd9f16add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ad6aedaf16add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084c1d719f26add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e9d3e519f26add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000152784d9f16add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000e1a7b1af26add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006f7d1bdaf16add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe

Runs .reg file with regedit 1 IoCs

pid	Process
3868	regedit.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
3332	elevation_service.exe
3332	elevation_service.exe
3332	elevation_service.exe
3332	elevation_service.exe
3332	elevation_service.exe
3332	elevation_service.exe
3332	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeBackupPrivilege	1260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1260	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	424	AgentService.exe
Token: 33	4384	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4384	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4384	SearchIndexer.exe
Token: SeDebugPrivilege	5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	3332	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5436 wrote to memory of 3868	5436	2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	90
PID 4384 wrote to memory of 3984	4384	SearchIndexer.exe	102
PID 4384 wrote to memory of 5820	4384	SearchIndexer.exe	103
PID 4384 wrote to memory of 1444	4384	SearchIndexer.exe	104
PID 4384 wrote to memory of 3008	4384	SearchIndexer.exe	105
PID 4384 wrote to memory of 5568	4384	SearchIndexer.exe	107
PID 4384 wrote to memory of 4876	4384	SearchIndexer.exe	108
PID 4384 wrote to memory of 4652	4384	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_f91786dd1d34c5311a43a3b7407905f1_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5436
- C:\Windows\SysWOW64\regedit.exe
  C:\Windows\regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\config.reg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:3868

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3332

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2028

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2432

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4164

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:596

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4276

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1260

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2576

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3700

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:424

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3984
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5820
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 916 2856 2880 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1444
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 916 2604 2600 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3008
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5568
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 916 2856 2880 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4876
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 916 2604 2600 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9394d96c193c60c2b245aef0964026c0af3c9db3627dc00c4f6d9ce3c02677b3
MD5 002ad2a9b36e928d8d21d2a9b26daf3c
SHA1 dad9460dfdb6cc1eaaa5bdc609e19c6d0b2ec8e2
SHA512 3835b3578acc1a6d083de513313e214090bbbb6a2d23789f56df162eeecba62caf1ee1473525dff5f147b3d95cb69f8b0c8155d830a6b500fd5c6fa4519568e9
SSDEEP 49152:4b+632BuPkFKRrdE6ohmstBhuXjfS4LWxncBYcPe+m9SS9uTp7:S3q6HjB3BZPe+m9ut
TLSH
T167D59D03F2D900E9E069D178D7469133E9A2BC890B34B6DF0790B6562E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 3e70912e5f7feb7f1b0169324a9a4da4d5f2cce165d728b3ec703a412b5ebd9d
MD5 73c6bd204338cc6d9ab36d72eefd8b41
SHA1 00b016be6f2b2788aefaaa97e965950d3baf415d
SHA512 5ed6688d52b03bbac184016ebcb34526602a226c463e28930d57adcfc37346520181c6e2fafa0885c1afe00b30e9b394b07bea7b5af5efaa2d4b0d507132ec03
SSDEEP 24576:wXYfDtczAHqsBYsywPc8peO3r/UN95cS9l0Tp7:Htc2BYcPe+m9SS9uTp7
TLSH
T16675F12877E508F9DDA7827CC9A28501E6337CA543A0E78B03A4E9295F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 3afdc1164cfcc2d41065e6701dfe58fa6080dcb3207a411d913d5035bb006393
MD5 894109b209f36524e982747298556049
SHA1 659ea3134a56fa6699bffac0d94e63ca927f919a
SHA512 84db6ce7e51f81332a85ab4990ba4f8534a557a3e0b9d896d74f6adb4e02a477dc4a6c0ee037258f715da8429ee3c2c9193131550f413b04ed33dc97c1584060
SSDEEP 24576:j0Le5ji0hmx1rMAqsBYsywPc8peO3r/UN95cS9l0Tp7:jPji0A7hBYcPe+m9SS9uTp7
TLSH
T14795AE25F6748371D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 aa74cf2ee99ed3b531965198060083b319445f5510c764517d5b39d4ee9adcc9
MD5 6dac7e318f7a6b44db930615490906cb
SHA1 8ff175767d6ee26f2fbfd6b0a19ba61699c1a409
SHA512 27724b107191a1598b08fd970fd94e3d33a3cb7e9772c5ef6d0f7a180547b02c2ac4dd2a7066013b8bce2f1f37217ef209d45b7baf3de0db20b27e586820881e
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWE6q8wyueqsBYsywPc8peO3r/UN95cS9l0Tp7:E/ezSC6vUzPvxHjyVBYcPe+m9SS9uTp7
TLSH
T195755C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 07c6e11ca0158736fff1f0fb5784b142101d49ffc3596a1441d8bab49d657b1b
MD5 87434138cce00c4b9eecfddaea348f03
SHA1 d9dce359c568ba518168b9c8fcf6f03b1ab1556d
SHA512 fdeb82ebbe713cfd35625c183838b8de6016666e5ee8708c4fcfca0e7b20b14aec470414a57288f38c92af27462b87706dd3038849abcc4a60d0396fa1cb1260
SSDEEP 24576:ZVbqPb88hv/l+6jqsBYsywPc8peO3r/UN95cS9l0Tp7:ZVO88hXl+4BYcPe+m9SS9uTp7
TLSH
T197559E66F5748331D073C0BAC5D3AA9AEE3234424B318ACB1246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 ee1d5df4b108406193a9a8b0229b27db3b740b64a82fa61c8af5b2849edc9f2d
MD5 61312beffa4a8fb2a41589e13c408d11
SHA1 041d71b36c0f3566e6050a09172a55e7d3c0847f
SHA512 0633592f3397fa5d24fc19ad1071560421e05195bd5836f35b97dadc3dab597c49737be46e3b84070c94ce1d964566c72dba2115c61a2bd4292846e3d770663b
SSDEEP 12288:TNMC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:TNMqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1216523246DAA45E6CFF423B4FAE31F05C0463DF88284DB471692F99DE4BCA58F49D920
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 c35d1793f5ab9034c7477dfb19ed7ee8e0ccdf50563d4498f6f27dd43b77228e
MD5 1b3804d3aa0f87c77a64a30e18e65e4c
SHA1 ab94da893ca2816beee59cc53d2727ec6979f5a7
SHA512 b39e06e6a808001f9539005762936fc1d7e524a0d2a696c4f9f6e4333a84561b14d6a3d5055fabbce5c1cfc6ee61de0a94f51a82072de09c58be9cfe086e82f2
SSDEEP 24576:8JIULqsBYsywPc8peO3r/UN95cS9l0Tp7:8JIUvBYcPe+m9SS9uTp7
TLSH
T19475CF3BEE28FCE2C27A9DB85B918700D76278704B51A3CBD165C20EDE235E45D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a14d4bb79dfd396e208ae9343129d363bdb9f9157076e9c29902b8f518dcbfc2
MD5 27a61a338776e5385a3d3e596897e230
SHA1 bc16b8afacc0e388963e7b880279ca53db97466d
SHA512 2374f36711f4c8e2d79d768e71f1e246c7f12374ace1d78db333684efea2795d6645371f2927f5b4e71209b00452e45c188a5bf101393a4bae8e4cc11258cb72
SSDEEP 49152:uQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THX:uQvGAdlCEL8c/yRNw5CWBZPe+m9ut
TLSH
T1ED266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 b680743d72790cef406f7a38098187b2bf30e36488e7880633325c659e4f4e36
MD5 dd6c04fbcd19685b165a99730c178e1e
SHA1 96c3677d05a4f5af33d80e66e5b7e6217b03e06f
SHA512 2a53c808c979cb0daaea2f0d6ceaf2131ac536515224650da467fca2cd396796da07f1ab7b01e00d6bb15cabfad5acd7a744cdaeafec142e671786f26efaad58
SSDEEP 24576:R6ewsAjpqsBYsywPc8peO3r/UN95cS9l0Tp7/:kljxBYcPe+m9SS9uTp7/
TLSH
T1E485E030FE75D036C7BB0DB21B36C706542D79604B911AC3E3A89E9D99342D2637AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 02044e87a4c59b0e627170320d5826d4d99b5ed75afc7c4c709e6430bb49f353
MD5 9a68e9f2f97297bc42004b7603e7682b
SHA1 54a41644518e91172c534c26bd0f729a378f2e39
SHA512 b1b662d538072694e22951d10b927a2946c9734a369ecc7333f9639bdabc2bcf70aa582fa53169e98b36ef806f29011376bf9555a48e3cb3f41a3bc72e140e4b
SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHpi+m9ut:VUEtQevvqc2W1cpV2EI32pSIt
TLSH
T118474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d0677400dff00bf46a0807c8dbcec000f3b0cb4b9329db0fe1d8de76f65af173
MD5 f2a150f4d2e4094ac98c608a6460c4c6
SHA1 379f759f2fc814d21080b7a2b4a1ca688bd7ef3a
SHA512 81d2407e97120040b6bf403a1512a85f7d0f2763271cfe40389cf56e5d5597fdcaac7dd4f00457844a2f3b3a94f7a97d08a52c7193dda59d91a09f7484c23039
SSDEEP 49152:yCbRquA/m2yL5zQfFiV+XenmE3/zRBYcPe+m9SS9uTp7:XoqtVjnm6BZPe+m9ut
TLSH
T1CDD58D1976B8C2E4D1F6C77886A2C647F37178154B3097EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d19ed71ead23600080c9390dac9101445ebd80f31ae1eca318f6787b5c6a10cb
MD5 db422da771614ae11ec604509f643c16
SHA1 0579b4167443add16e76b1ecf1c74594a8d88825
SHA512 44eabf55a9984f79b92e821d84fcf99432f9d280ce138923a54cea3ad017fd88aff710abfa5a3ae9d29edb08b6d7daa65fa81b24e7553ba81262e9e0f643f008
SSDEEP 24576:tAhGLJIFoiwtA5l7S53SqsBYsywPc8peO3r/UN95cS9l0Tp7:tAMyFoiq5KBYcPe+m9SS9uTp7
TLSH
T1F0359D80EBF945D4F5F3AAB899B69571EA76BCA95E30C20F2150D11F1E33E409D24B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 30353258199b1771d38aa900c1d41bd6d9e1cdd427ce2875ccc4975ad9cb1b8f
MD5 93056ae11d229a2c847ff415a59ffa92
SHA1 0323ca00b8c5b93f5990708eaa95085654a0245a
SHA512 dfc493b1145cc11376d025e2e0d13f63232287b1ad8acc55e46c3576f03f8ccfe53f1c7c7fb749ac17ac918b4c5b016b4a9d32d21823230be35123af1a6f48ce
SSDEEP 24576:TwuVOWtqsBYsywPc8peO3r/UN95cS9l0Tp7:TwaOuBYcPe+m9SS9uTp7
TLSH
T17675F14536A90CF9EAA65238C5978536E7F3BC552A20CB1F1360C65B6F37320BD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 e9db6ac42e9eaa5999f6b59e7abf4fc4bf41f37968f253acab42fab88ba3aa7c
MD5 a3b5175758637573849a052cd8ec3555
SHA1 bcdd37ec029dbfac14200bc12a660a5ea67398bc
SHA512 7848e73468f6ab6b0fc633f011f4a542d76df8492dde1077d2b3b103cb4605280945241b276fa12a174f98d928d8ff00cbe1d32a059f47be1e25d656becbe942
SSDEEP 24576:jZuIqsBYsywPc8peO3r/UN95cS9l0Tp7:tBYcPe+m9SS9uTp7
TLSH
T12965125936E810FAC6E2537CDDE20A05D3623CB6537083CF1261A6696F76AC4AD3DB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0672374fd55d818e5e735b4e9cdf301d94d957b03688fe250293a4b7a807471a
MD5 747af7c7facdcbf834631d54f0dc8ce8
SHA1 98b3e7e51c43af96ee887b9e9d0a8a6d0ade39d5
SHA512 70db1f5de2b64feb3a99c5bae06c8354fe0e668de1789504eabf5a0a6eb2c3e2ae9699e376eaf8632393741ecc0e30d3e3b850b5a94a9929f856f81a0d26c028
SSDEEP 98304:GQRQyi36YOcPQLvw2gAf+PN3zBZPe+m9ut:tQyiKayX+PNji+m9ut
TLSH
T13D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 db6ac2befdd79d5c116a7dd1a4eea4051470c10d578ca68381521a10bc5fce66
MD5 aad3f5ff3b05560d1722a848b9ce3c29
SHA1 fbd485fde7baa1febd7cbf0dcfe75f09a5dae3f9
SHA512 870f2c076ce54dd4073b3f0bc805d15c39ba7dc49a5c98a67a98901c93d2a9319485bd99856c55a6f866f0bdb0c34e8dd65c5ef2c0aeb28c69fe7bfa850e7beb
SSDEEP 98304:MQRQyi36YOcPQLvw2gAf+PN3zBZPe+m9ut:TQyiKayX+PNji+m9ut
TLSH
T16A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ff39c4a0936bee340e0e68caf5b6ae5e70d685746feb11b97700365302b7627a
MD5 8b5beb72410ad81f856bc3e79cc1ee9b
SHA1 8c9881c21e135f43400e5adf77e1a23f590c0005
SHA512 edbdab441f6acd29b5ff27f5f88f18b63a16d2298729c4048b7ddc90cc12996b03d0bec1d1a3a5d0a79999c16c848fa69750528278869c15c4660e42bffb03ba
SSDEEP 49152:c68Qg55nhheWu7PNU3/hBYcPe+m9SS9uTp7:WthWRc/hBZPe+m9ut
TLSH
T15CB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a1a92f509284104db94ffe99981d2ade35633be0cb3e3c9593d054d7eb8cfce4
MD5 10d88b822a88929cbcd4f79225adba6d
SHA1 8a8cd92a6d9d52fb65b352276a90f2914f23dab6
SHA512 5f36856257bca9e13832288ff7ad9d6397f5c8658608a278a557bfa6f52d0b59befe0591db005183cce6d6cd18d0574bfa4b19bb2f56bbdd79c8043a81854461
SSDEEP 98304:Cy5112gYy5azzVvL69nLKnhZwBZPe+m9ut:LLIHmWhSi+m9ut
TLSH
T1A5167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 96e6193d67775e915359a5c327fec2c2cfd23ee8330e6078c7253442c6d79da7
MD5 fa252a515e059a38f11e4fbb60cb1b99
SHA1 dbfebe35bf5b36ca48ceb5c0353d81530669b96a
SHA512 40de3f54629a4e86da1a59c61ab57e0417bf1768e111fc791b5b076abaad5a303d3b510f368c1da458fe29522011e7bc06af789276bc4793bbe5df9ab660f276
SSDEEP 49152:/B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glbBYcPe+m9SS9uTp7:Bu6JmVxd2dbBZPe+m9ut
TLSH
T166D59D13F1DA01E8D06ED578974A9233E962BC490B34B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a41c565b3b5649a83fbeefe4eb32728c86cce12a90049dc990ef70cdca759834
MD5 071c64cd13667c382fc27df5baf784e7
SHA1 3bae464fa871bfd3d68597a32884bac5a3b09485
SHA512 2d67318a00bcf81e69b80a4d0b041a5b9b94a4c9090471fd9c6c3c796e10b8a23f47e1b1b5ae03f554850727e70c1269414fdf7cf0782e666a6e8605c543e7b1
SSDEEP 49152:01hpsNoJpF1A6UU44CwH7R4xPBYcPe+m9SS9uTp7:0mifPbR6BZPe+m9ut
TLSH
T144B5BE13F2D900E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8dcd10b5d96de28e76f2001779657d815f9102cd0d9b861fc5f2eae43dbc8e52
MD5 461d1c37a735c02008e31a7759c8a3c3
SHA1 6482a41198f6db8442d6be4a5b6419897d714213
SHA512 bbda57d47929c164c1f69a823e5bd2e0d38dec1734f72f74fa66e728df52ff952a080ddfb619c4760a058c55ebd9a385eb42f8bfc9234f1b13a8cddd213e9a54
SSDEEP 49152:zSuZQIY0Be2KRRVtOnks6NMHqsBYcPe+m9SS9uTp7:x5dKTi61sBZPe+m9ut
TLSH
T1D7C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3642abb4713db3db534c80838f10ac57b8061046114ef6da1c07ef401af5ced2
MD5 b4a7a47a9db9ab1c12c978c07aa98755
SHA1 1e27b78c755965af8d41d1d083e6233def7169f6
SHA512 3a3d3402a4c1b843d2b5f5721448e73f08d590dfe3f58074b80b2d642ec2689b81ef5f8f52137f1e998df802e1c8156a1baf09f301e20b3b4c74d78a45b2dc42
SSDEEP 49152:ahtSn8EApI0figngiDn0AP5wrBYcPe+m9SS9uTp7:bX2iyphOBZPe+m9ut
TLSH
T12995BE13F2D900E8D06ED178C7568632E962BC150B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 ebed0de9558c602b1dd57e6a2d5b4b286e6280f68ab72c9f269b23b6cc97ce09
MD5 45bb53bf7392cb8d91d82e6f5f1ff19d
SHA1 b699176d2e0671d751bc3ca04f696bd57abc5b2a
SHA512 3aa347d9ac5889b2effd0e7f248f40a11eab747756495560da617e8d5c6068bd5480d8eb33172233b894cec6a16c882ecf462bc0b5c52686423c3c83b07ac9c0
SSDEEP 12288:S0C1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:S0qsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1D56523247CAB46EBCBE463F4EAE31B05C04A3DFD928087472756F419E4BCA58B49DD60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 6f5cdae4121f91755e458c99c00af11847b2096262d227e1d3dae201a3811847
MD5 5ab32e884e844f982c567f74c7bd72b6
SHA1 b42c89b5ea335ccef85d21a58259e86804b8fec1
SHA512 4a8f6b0ad556826563e8ae8492a8d723b261edd42ee0978e35ce84b84a447cd86b329c4a1376271aacd27aeaae00290689b84cdb0956a7e9da8052a31999cf9e
SSDEEP 12288:0FC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:0FqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1776523247CAB46E7CBE463B4EAA31B05C04A3DFD928087872756F459E0BCA58F49DD70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 da173eb7ec6c969eb0607c9adf43321ddcbef2af0ec5836f37eafc7c8f53aabe
MD5 f15e3d92c99c933529b85ce46e1da33f
SHA1 89eff8237e03dbef756b490ba4c8570aab0c2f02
SHA512 42ce10707a3eb8edeafc3dbe8c9a45c3603933739a3d837149b3bf6e2a2ccda43181102b4e07797347e6480692ea4a8841ebe016d523f2fa3303d5e80889fda4
SSDEEP 12288:tTC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:tTqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1D86523247CAB46E7CBE423B4EAA31B05C4463DFD928097872786F419E4BCA58F49DD60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 53800910ecaa80c8b8f1930ae6a47df67c9d04aa8855532c20c0bf6abfd7f673
MD5 447b1bec5f5e92e6a859d952ced76f4c
SHA1 fa1d3bc41ae1fe74daa758d0911b2b608f005351
SHA512 4cd27d353074843c9219e8aa70bcc2844920b416ed1bb7ffcc8ede16388f60e4c173da212096a300199b04ce23d642b5b4cba65778d68239549c6ecde2319bae
SSDEEP 12288:AVyC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:bqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1FA6523143AAB01E6CAF0A3B4D9A34B05D1963CF89360978F5741F85D99B4758F87CE60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 95699e2d1db49341a492f05ef58a7c16ffeefa2ac4b285eda8ec23784489afca
MD5 f96af1cf1ef3b0d31c7c793fef7508f5
SHA1 2eb1d56b53c4692d0d3beb7658a24e6d214be0d0
SHA512 5fb20a1b69417aa88580acac5434a24b3b15b87572a63434eab4a635d2cad04920b101495d0c42d762b797447fbaeed65c56cf923dc9b37e818a53179761cebb
SSDEEP 12288:6KC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:6KqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1226523247CAB46E7CBE423B4EAA30B05C44A3DFD928097872646F419E4BCA58F49DD70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 2c83f6ed3e9e297b4a622297a7d123f637aceffcfacb551b99c5cfcf8148ee1a
MD5 06ed50cf201119da53f2d0df59d6dc74
SHA1 06347fcfdf95274d349556f983eb065fe77f530c
SHA512 15c76652d06e148908c35bccf353c73f0d7d562f0b99b9c87a3e129a8ee52214c9388bd0461416f1b8385c4c5b604f2538fdcfb7101dfd15e1db9ec768fe8cd6
SSDEEP 12288:fRC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:fRqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T18B6523247CAB46E7CBE463B4EAA31B05C04A3DFD928097872756F419E0BCA58F49DD70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 f503ebf311e264264155fe15a47a0e66cb0d685f59744fd19cd28f30f9b2a143
MD5 48fb8fe40d66b7cfeb6143d104fd1bc1
SHA1 5d4e47738508494f99dbd027ed98c5b1aedd2e9e
SHA512 2d4bd69925c36bf87197cba0d93afbfd7c6c682909621aaf18d8d66525b986627515c022d601d2ab5e455c4dd3a0d761ff5c26a22e9e77cf1e677642ede6d3fc
SSDEEP 12288:ldC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:ldqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1F06523247CAB46EBCBE423B4EAA31B05C04A3DFD928087472756F459E1BCA18F45DD70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 1d7ecf9bfc71e2d4a151c51785144455de9d6de307b610b46f1dcdf906ed8b36
MD5 bbf0496c52fb87b4fcbeb88cbe965b6d
SHA1 356d2736d4791dde9d8d738c13f2582828c8d800
SHA512 d754508a4f062a6554bc53265f0a1c7bc9a3a6ffd268ff922a48243d618162e9b7a37f4cbb6d0fc915e15485db6375afe56c5f8448ee885eb637c5d8e2e8bca2
SSDEEP 24576:eZMdzFVSOlqsBYsywPc8peO3r/UN95cS9l0Tp7:eZMdzfJBYcPe+m9SS9uTp7
TLSH
T1D67501A4B39008F9DDA7823DCD628906D2B27C690760C70F13A4766A5F773A15C3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 2d1d03fad551f045394b9d330deac62b19e49ce11a16d38ff4281f1178ee8f17
MD5 11d2b0a2646434352745776f1b9478da
SHA1 1895b79b33c8fdd564fbdb10d950749a214bc6de
SHA512 884a7c397a9b4531a1ae4ae5ea445eac5b4e44dcdb2860322b4bb37eb4c0adc04a40000b6c54cabc08c9a5f9436e750ece9e715e64c8f6517aa7f7f39dfe1fb6
SSDEEP 12288:ZYC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:ZYqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1C96523247CAB46E6CBE413F4EAA30B05C44A3DFDA28097872656F419E4BCA58F45DD70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 0aaea5e6a79f8558ce3ac34a02a99033c47e2a2f0b905f75a194ed84817da032
MD5 d47a80aeef10ace8b743e420865709cc
SHA1 4b96aba14f5e72371e2e44a376c40d318ccc6c0b
SHA512 4649ab65985c26cfb200c155bcb0c2f28bbf39d6e8466a98aadfad50f1b4a3f9b7a906e3869839e5052753d28e7c9877378c14649458cd895b4aa9ac7d25ab0a
SSDEEP 12288:ZcC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:ZcqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1C86523247CAB46E7CBE413B4EAA31B05C44A3DFD928097872756F419E0BCA58F49DD70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 d381041274769294954e8e45653ee83d976eef739b8fcd98032db304dfbfea97
MD5 8673089a29746daab000985d77be644e
SHA1 41419804a207a275406946d6787042285135d245
SHA512 63f3b49158be2f7b8a07776916fab0871c9e90ed7fc1cfc3215351e7dcff41357725113318db230c9ae1585b2fc2e38085d8c26079e9108e99606106bed1c630
SSDEEP 24576:Zzy5qsBYsywPc8peO3r/UN95cS9l0Tp7:ZOBYcPe+m9SS9uTp7
TLSH
T1E175121776A620F9C5765378C9A30A02F3727C7547608B9F13A0667A6E37790AD3EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 b281f0aa474f4d11f4c146947c26afda5e3035e9d4ce582db0b849b6801d5b4d
MD5 f411aa771c2e5f621414cab79b912a5b
SHA1 ae7de3f763a4116e31bb3fb271da4b280bfb3f23
SHA512 5fd870207075ee22341e86f83ef71f0c0eec835e850e9caf28537a8eb7027dbf9824dd8283ba01c1d6f534075848870d6aff572b246f0f71942c65e2df4cc4a5
SSDEEP 12288:YYC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:YYqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1196523247CAB46EBCBF413B4EAA30B05C44A3DFD928097872686F419E5BCA58F45DD70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 a711fc120a5d04ef77c308c182337cac3fa420d6c58dcd25d3ff0e0e57985c86
MD5 e6518483a0d6489103a9408fdc662745
SHA1 0e404c2a208b8a7e00144d99a79a6ed7887f7d33
SHA512 747e7ec935a598aa6e17ee3884c6c4c396af3f1581bdba35a9615c73c96ecea30ac490fea5695b86a6d6467e362832f43fa1010787a18ce46c9393a72e1724ee
SSDEEP 12288:1YC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:1YqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T10C6523247CAB46EBCBF413B4EAA31B05C44A3DFD928097872646F419E4BCA58F45DD70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 2739db6557a1999b7bfbbbf2ef06d867e5b1f4b102d9f91ad83a08b23bd3507d
MD5 ec46529eaafd36f09763063184872af3
SHA1 a745d2ec0a2092848a62e9b3e1e40ee43ca305c3
SHA512 9cb8be7f341aa194a7e26b8728102d4716dbdc465d22b41e98d631c0f9aa13b1d253c0b9de3ef7a84fb5838cde4f77e3a203dc85d400a78289b169a0e8c0ffbe
SSDEEP 24576:ozy5qsBYsywPc8peO3r/UN95cS9l0Tp7:oOBYcPe+m9SS9uTp7
TLSH
T13575121776A620F9C5765378C9A30A02F3727C7547608B9F13A0667A6E37790AD3EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 f0d6357fbee30ff6bdcc2386f501452dcba4e44bb77cc141a801565450be2209
MD5 f87a53008593cceba1ba6872d2c74671
SHA1 ad9d00ac94e8cfbeaf6834849bc9e5b1af38282a
SHA512 b939e2f6503bf9471868474115aae0f317adfae82f59c05537af404d38b76ac520964f22e31ebe782525cfe26f7159c2bc034ed4f6047c4c70f40f68e1013e05
SSDEEP 24576:FTGaLl3z0zDDqsBYsywPc8peO3r/UN95cS9l0Tp7:FTFLljGBYcPe+m9SS9uTp7
TLSH
T1E97501A4B39008F9DDA7827DCD624906D2B27C6A0760C71F13A4366A5F773A05C3EF65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 73a429becf3a0f06304bf8a9dfb227caa87095ea4a5b34d0b0415ff0b39c568e
MD5 d0c203321b73fb6894f5a11143f2b15c
SHA1 33d829467ef6376bf3ba9067412047d37d6c6088
SHA512 a9bf17e16e76194d8773a1de7652cb53dbf5fc20ad7bce8a1282b58ca6f910c10b04117fad136e7056e9599d49d096d186a806049d8f724e010efc1832544caa
SSDEEP 24576:u3Xd9CHKy7GZvqsBYsywPc8peO3r/UN95cS9l0Tp7:wXd9CHKyaJBYcPe+m9SS9uTp7
TLSH
T19F95CF90F3E414E8F1B79A35C9724501DAB67CA95B60CE8F03A4661A1F33BD19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 2987922f91026ab2a553f7538376981288c55fa7f14cf8169b0e931f527b377f
MD5 3bb3bd603f480fedf74633feacebc3d8
SHA1 781b6e3ab8d34cb4e5d5b08d4099c457c59300a3
SHA512 c080a0422e37c9266a0ee2153c97347ac18af3483bbf84c73b822ad37af2f2c0c3156507a23e2dded8c70017a671d1508e076f2f6df64e5f8845fc7629b13b1a
SSDEEP 12288:wzC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:wzqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1996523247CAB46E7CBE423B4EAA31B05C44A3DFD928097472746F419E4BCA58F49DD70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 3945eea9df8f30206bb5240a3d51e36d4596bab0dc9e78bdd46c90fdaf6642ca
MD5 a68edf28af3606fbf983b72d5b04e1c2
SHA1 692ec3c9d0f5ea709bcb0019d2555247567fcdcb
SHA512 aab46143f1d0937f6b0d2127a52c7d1653bc87b5500c5acbe61edfaae6435f2c03fc5c3eec39da5bf2e09aa51c2486516b7de2a8e19acf49331d383d7e0caa97
SSDEEP 12288:zZC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:zZqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T17D6523247CAB46FACBE413F4EAA30B05C44A3DFD928097472692F419E5BCA58F45DD70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 4d4a5f794a48d23748aac407ecbc1a9d553957011620473cee588cc84a3cb1fc
MD5 fe050c3f1ecf893793d490ad08c36498
SHA1 cffe7f41a86f565bf14649760775215720f26725
SHA512 f4182eb6e864b173b1214b0471f65d5ec0de0b4a48b22050dc99d9859d9478125f842f19bc797cb5b387b3112fa68e776bd9dad740a4b3419a723986a4a049f0
SSDEEP 12288:32C1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:32qsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1486523247CAB46E7CBE423B4EAA31B05C44A3DFD928097872786F419E4BCA58F45DD70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 3d6a07814f79962458666ad72675474ea7ed749464fb1a5df205a25eba0a38a6
MD5 b49857535fe8528b5f1026c0f9c0e715
SHA1 ea1bd6daf888a6932cace68e84549b3ea828eefa
SHA512 ee8d8f15921888f72beb4f1939b3e43fc188c8de8f2a3b1f98da5777d12d5bab9a25b36d9e12670003909a94fb042446262da5e7fda351e1434c7cd4e6d6bca6
SSDEEP 12288:bYC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:bYqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1006523247CAB46EACBE413B4EAA31F05C44A3DFD928097872786F419E4BCA58F45DD70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 02c591f593310d7f1e085fe229e1e8ed79c6f899c081f376b3a5839c8029285b
MD5 f0b82a419ea0c8cecaec84480e1393ad
SHA1 b314868609faf8eaee2429d060ec465ac9299468
SHA512 cd7c7c8627657ee12ab6c1903730ee8d1e64769fa8be44aed6682acba1be2cb0fbb2dffd846a85fe50d9c13ad862e35fec9e7ef7d79f25e1c5a99d270156bdd6
SSDEEP 12288:9zC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:9zqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1086523247CAB46E7CBE423B4EAA31B05C44A3DFD928097872786F419E4BCA58F45DD70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 576e460a5bb92701d8bd6c9e9a072a5d6a74bee2e740b042ebba1ec12d6a5ae5
MD5 280d142ffecaca3f9b2938a63745b807
SHA1 7c711df2f61a5a796638c8d0c50da6e9070da929
SHA512 65e1feb39121954744e9ab79d5c9e03ddd225862c52cf6baf22d4cd4a7a6d5e8241ac8246f88ab093de2b91eee7cf935856a692803fe5d31011cb9b45a2fc27d
SSDEEP 12288:cwC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:cwqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T16C6523247CAB46EACBE453F4EAE30B05C44A3DFD928097872642F519E5BCA58B49DD30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 fa6a22a0bf5e092d575492f5d3d6e8e8a87ed17006dc158119221ce69006f7cc
MD5 ce14f68c3785b28266baa0a0ef616d03
SHA1 6210390de7062b4e8e159111bf0d7e9606574800
SHA512 cec2f970f8db66a22643a37c7fb44665bff23b46cf1814be88928432b01bc83a6158a06bbf177d8cd37d0720fae50e810558319276ad4bc862f65fb36ffd98b3
SSDEEP 12288:EKC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:EKqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T1E66523247CAB46E7CBE413B4EAA30B05C4463DFD928097872746F419E4BCA58F49DD70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 280c533f97869922a4818001770a6fb17c7909bd1e928ac5a85c0ec6771f6294
MD5 7d44b13344860316a9b2fd79724861d3
SHA1 61a021da8b9643803d63d9367c7f365e6201a536
SHA512 283c7303c09d29524eee767020678db09f3e006dadb89b3e3faae2451975fff1d6208b0b11d090d12c3ccd69970d8902f3dc0af8e4a9c4ee4e2f4c0b9105dfd3
SSDEEP 24576:2fwvJk9RX6wkyAIsqsBYsywPc8peO3r/UN95cS9l0Tp7:zMnYIQBYcPe+m9SS9uTp7
TLSH
T10A95D029EBDC04E5E1B7923C99B3460AF2B178691B31C6CF125A536D0E37ED4AD39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 72e743e4d277add118eaea74dd682a8ccc1c6ef4c781c213c99f3e4bd3bb347c
MD5 e0149930028a0914af5caad74d0d05d6
SHA1 8be0ebf19f177f88953a286d2d04d90c21b8e6ec
SHA512 a05bbf78ff31860a46c30e7622145e49c6b6db76ff3a816d5fb150cff0d5425cd97bb744d24d13b26a27d69fb4ee4b0c486c822d186dd2f8c1ba1a9772176cc7
SSDEEP 49152:SYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0LBYcPe+m9SS9Q:MySzPTBZPe+m9ut
TLSH
T12B066C56A1A801D5C1B9C1B98F1BCC1BFA7134490335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 adee4383741c1a606cc8ee9568a40496fcb86dc364caf8098008ceb09c99df98
MD5 673a50f49058b3c0090b8b5f6b70c74a
SHA1 e3d5175b79bdc7cea8b938e3a739725b0e854849
SHA512 7d68e75da6de62ce4ea325febe3b36ef111527f99222553ca24d9e8b20efea4a1c0fd02bc026a25c3808844a76c773ac1ece5aa43f0a3c1b9e59e8341c51d6ea
SSDEEP 24576:s47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY1qsBYsywPc8peO3r/UN95cS9l0Tp7:s47JUQj1irIhCnDHUPfF/bBYcPe+m9Sn
TLSH
T18065AE1DA3EC01E5E1BA927885154A1AEA71782D1B31CACF1270937D6F23ED49F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 975912bc9dde00b097bd2cd06448849ffcd31d95c572024c4c7f898ef69727f8
MD5 ed27c50ce312641b039a7c0cedb7d9d6
SHA1 7f1ecd40496bfbb1cd707ad2926cbb81739490fb
SHA512 3757c9d67223e5eae8316cc7af258e81ecabc38c818d790708c08599f060f03474730daf336a8a1badcdff7886d6ead9a8d8446e77faffff520a59bfc4f77c63
SSDEEP 12288:D+sfIC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:RIqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T19275F119D29902E9C5AD6278CB524A01F3273CA583E0D3CB53D0F53E1F79694ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 bb2fd61521cb974ca71025174efe43f9b9ac4ee47ae4fcd6cc0163163b65e034
MD5 6826242596ebd39f074d14bf117a3fbe
SHA1 2aac1217562ea4d63a163a501550d4ea59ebd7d6
SHA512 9164ce30d50ea434c55a94c6f98814951a81bf1ea3a64f802c6a35d696da1c66761c5234e3d74bd4b0034643487d454da6b97871c4731b6a4db8ef7476f35b1d
SSDEEP 12288:9+pJU3fqSd+eRqdoCgyCHKS7LvZlmKJA:9+rUPLdqd6qS79l
TLSH
T11C2517107666DB5FC5A940325E33D2CCAB707D06EE45AB0372C9873FC576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 ce35057d4538668e916223d22240d4d7ea938603ef0aef33512d81976db3f954
MD5 c3964430d260fb08deef6642b6283f8a
SHA1 d7e1d2fd82c827fef6df9f1481aca17f1301ca1d
SHA512 8cdb6333ef7fba253c0e627463a11a87be0c37571151542463cd1a13af94bd4919d0db6ec7f693d948ac4895245986c2f22d4d01387aaef61206292d8b21f1ca
SSDEEP 6144:tYesCCttKu/kwkxkIGFd2FprgvEtMxlzx0fZjgKxQ7ZLmPR1y49vEtMx88:uKucFyIk2/PgKxQ7ZLmPR1l
TLSH
T10945B8805437A78FD1F62032072A5B8CAB74EC1777496F27B3D9453AD82AA15B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 fa4dbbe1faa3a4a196ec4fb4be042e77424b3a58e557a5daba18ae777889f6f8
MD5 45dc1cf4011852bef1df35f6c9f97ad2
SHA1 7cb72e722f09fb9a85cf5f68aabdb0fc4260ab8f
SHA512 785873425cd8ba9a1b674cd8d688f0596319aae39066e74f93a5aa45788e11330401dff691301e604885067281c600570ce294cb907a73463322b6a558a4d99a
SSDEEP 12288:r47gC1KY+BYssKIwAccePpeM5b3r/SXHkilB9LFcSVbl0TRpxM7WX9a:kgqsBYsywPc8peO3r/UN95cS9l0Tp7
TLSH
T10E65232069AE49E6DAF423B4E9A74B15D00B3DFC8740C6C77641F559E4B8AC8EC7DE20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b19628b68cb72737653911ddeedeb5480bd1466156cc2d84bae4cd874685162a
MD5 923e13863e531283a9adaaf9874265d8
SHA1 9628da5dc57a006cb1266e2c1e6018bdedf35626
SHA512 d8810f9452ba4d84283997f2b2aed82e27c252fdafc434eeaab7d9cf4d70534f742e75b41457b8353a8ad6043983b7afaad6ccc37e8dd10ad18c6344585d73ae
SSDEEP 24576:Hgb6bmBIi49WNNFpg1rSvFv7bYeqsBYsywPc8peO3r/UN95cS9l0Tp7:Hgb4mBIBhGFdBYcPe+m9SS9uTp7
TLSH
T13665AE1E22EC02F5E1F9E2B8DDA64417D6B278160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 89266d707752a3dec901c777f5a0b0e42b828e8e5f7918b2c35885a6177c683d
MD5 6fbb3a5e1e7a404a029f4828ffa2c396
SHA1 372db66023dc39849bdbb76f172b45eafac265ca
SHA512 0ee0ec219a44862888a70a0bb3970801063fbaef6bbf2ef00031eafa1dce167351129b0d0f863526d7389c9a007cffcd4a82fcd2fac517c4b6d3a878e94e1e9e
SSDEEP 24576:gG88u8FpJqH1azria7/mlqsBYsywPc8peO3r/UN95cS9l0Tp7:z7ZFPqVla7/+BYcPe+m9SS9uTp7
TLSH
T1D195F16576E101F1D4B7D138CA824663F6B2B8250364EFDF07A88A551F23AE44B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a000ef322e086b1aecae47118833fd63a7323b98ea8b192c4955b8714944765f
MD5 a6dc8be3818be96b638d90eda418507c
SHA1 cb38cc4743956d9eac8c980b6b0199dd9d59d8e1
SHA512 67326806240adfa6e2d7fe81384bbd6a781db60a13e386ed3186bce7d19f97eb61967bb533885a86ca2de9c4d99a5905ec9f446283addd041523821371d38694
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj5BYcPe+m9SS9uTp7:5G05lO43bIBZPe+m9ut
TLSH
T190D5C06E62EC11F9D1BBD17CD9C64A0BEBB23825032456CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 93b417799e5e938cfecb07167bec18adf57f8733c4ce3674be8c01294d8a7607
MD5 42b1e5082b78e79f52596fd7bf9bf3ff
SHA1 2fca0afab5f9a3d020ac5c6269f9cb2ddb472150
SHA512 5ff2fbfec19cd3a68cb8227a81af863b8aca451a86197ee08b8c6739ec7c9dedf1676dce2c04ac3c43ec07bdab879495ddb8077b3de75601ebc75fd8be8ec57f
SSDEEP 24576:Sfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnnqsBYsywPc8peO3r/UN95cS9l0TB:6a5POZ3+Jt2pasx2+mhBYcPe+m9SS9ul
TLSH
T12365BF5EA6FC01D5D5B9D17CC5834A0AF5B1346653319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b55683995a85b8fd36ba18b6e262e585b3012ad7487db93d65f4b7a2d3444079
MD5 27f1f7be73414208238d0adba29a3c3c
SHA1 0b6a75d5647e4c305d7dfc5c1ad1e1c7bafecce1
SHA512 79d05d7768235282cd6f2803a46bcb8916b042d6c8ffc9a31b5eb2b2c4fbcdf013cb0b3799e4ce25688b02817d1b024121d6b25a2fe9c9829b482ae27f38094a
SSDEEP 24576:KNcwHdjbyQ4nLC18lb/EOjowL7FkNqsBYsywPc8peO3r/UN95cS9l0Tp7:KNc/zEOVHFeBYcPe+m9SS9uTp7
TLSH
T145858C2623E901E4E5BBE1BE89779546FA71786913308ACF0291851F1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f76b547128a3798499ceda3fed6984616d1f778ac2b3067847b721d587efaa21
MD5 c97d7601b4e3ca100f373f4f2c4dfce6
SHA1 a3bfd45047373837af9ca5fd4d66c808da52cc86
SHA512 6a5abb72b1f18ab3cb58dbefa34bbb3fb6b323b43bbeb739ade461dba4def97ba6645cc7f825efc11fc29b990be7ed3338f068b4c349206fc3758be2fc243b18
SSDEEP 24576:18kNvNnaFeYhJNtmZBmbqsBYsywPc8peO3r/UN95cS9l0Tp7:18MwBtOm/BYcPe+m9SS9uTp7
TLSH
T17755AF2EBAB806E4D1FEC6B4CD238512E6727861073293CB5390C13E5E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 dfba4df5fbe1fd53dd0a39e0f86f442bcd2e5754fff9c52d52705651e473d8c3
MD5 2720f6f5c662151efda57b3242d3e89b
SHA1 530e49fc3a1e095fbde37a318c7b35165d72ee25
SHA512 8ccb0e28e0db3b4530f4d37ce776c4ee28230d73ca97525f1c1ad083d95b9d790c48c3197d6f6b2aacda096db9ad9a109a474f6305c5ab924913e51e1591481c
SSDEEP 24576:4PUr+NQhqsBYsywPc8peO3r/UN95cS9l0Tp7:4JQJBYcPe+m9SS9uTp7
TLSH
T14F75E12E26ED18E5E676A17CC9824709E77278A60311D2CF02D1917E5E77ED8BC3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 3453be5aa3cb224ac01473d9e5b0223a896ebc55f7b384da07fbeab177367004
MD5 656f2e65e099542573eeea9f410c4876
SHA1 3c5b11e65bc9cdc3114b75d7e6b594f26a61d2f0
SHA512 41d3727bdf02efc4ccabe51d4c0faf0118ad92efa2663df2b64147cd7df38064abb28db3c10f52c52af80831809efeb5fd9e14560a6d1431912d0a60fdc4e110
SSDEEP 24576:0D3FHshBIYQgAUqsBYsywPc8peO3r/UN95cS9l0Tp7:0DVHeBIAAYBYcPe+m9SS9uTp7
TLSH
T10885E13DEA9D04E4D57AD2BCDA638A06E27138A9032156CB02D0D1B95F6BEE47D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/424-125-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/424-136-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/424-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/424-131-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/424-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/596-293-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/596-60-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/596-68-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/596-62-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1260-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1260-326-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1260-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1260-87-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1260-94-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1260-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2028-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2028-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2028-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2028-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2432-45-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2432-71-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2432-39-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2432-44-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2432-73-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2576-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2576-101-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2576-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2576-107-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2576-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2576-312-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3332-13-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/3332-20-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/3332-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3332-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3332-21-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Download

memory/3700-114-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3700-311-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/3700-113-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/3700-120-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4164-56-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4164-50-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4164-49-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/4164-278-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/4276-76-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4276-77-0x0000000000960000-0x00000000009C6000-memory.dmp

Download

memory/4276-82-0x0000000000960000-0x00000000009C6000-memory.dmp

Download

memory/4276-308-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4384-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4384-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4384-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4384-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5436-86-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/5436-0-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/5436-7-0x0000000002430000-0x0000000002496000-memory.dmp

Download

memory/5436-6-0x0000000002430000-0x0000000002496000-memory.dmp

Download

memory/5436-1-0x0000000002430000-0x0000000002496000-memory.dmp

Download