8a21ad7f47c517fc4484651833b73e82bf8456e9dd99187be0774f4bae2a289d

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 08:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Size 1.3MB
Sample261110-klbbtseb48
SHA256 8a21ad7f47c517fc4484651833b73e82bf8456e9dd99187be0774f4bae2a289d
MD5 35e5fb3b57c632ccbc4065607bd91d26
SHA1 aa88dda5a4a4ccc4b6acd2a36281695be286d62a
SHA512 e284e22d00981324cab67673ac42a04ed8d0e4b1063805a2c37d02f3fc8bf8ac140c9a9f514cf921ec29990e9ca7c595e489d5dc98943efd2e70cdc510e83962
SSDEEP 12288:1YwbyPLlwVXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3b:1lbyposqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E551226B2C581B6D46314758AB8F569981FBF224F3504C37B993A7FAEB15C44F38223
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3196	elevation_service.exe
5008	elevation_service.exe
8	maintenanceservice.exe
4904	OSE.EXE
5768	PerceptionSimulationService.exe
4272	perfhost.exe
2636	ReFsDedupSvc.exe
3716	SensorDataService.exe
828	ssh-agent.exe
1340	AgentService.exe
5080	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\38b996ae31e6882f.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\javaw.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\java.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000acbb837def70dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082a88d3eef70dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
3196	elevation_service.exe
3196	elevation_service.exe
3196	elevation_service.exe
3196	elevation_service.exe
3196	elevation_service.exe
3196	elevation_service.exe
3196	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeBackupPrivilege	2636	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2636	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2636	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2636	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2636	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2636	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2636	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2636	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2636	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2636	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1340	AgentService.exe
Token: 33	5080	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5080	SearchIndexer.exe
Token: SeDebugPrivilege	1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	1644	2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeDebugPrivilege	3196	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 4480	5080	SearchIndexer.exe	101
PID 5080 wrote to memory of 5512	5080	SearchIndexer.exe	102
PID 5080 wrote to memory of 4220	5080	SearchIndexer.exe	103
PID 5080 wrote to memory of 1308	5080	SearchIndexer.exe	104
PID 5080 wrote to memory of 4604	5080	SearchIndexer.exe	106
PID 5080 wrote to memory of 2292	5080	SearchIndexer.exe	107
PID 5080 wrote to memory of 1468	5080	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-10_35e5fb3b57c632ccbc4065607bd91d26_amadey_elex_karagany_manuscrypt_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1644

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3196

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5008

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:8

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4904

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5768

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4272

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2636

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3716

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:828

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1340

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4480
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5512
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4220
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1308
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4604
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2292
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7456c9f1df118b7e7972f67f0aa2e06f430f6a730f986eb75a7076b4e4b44617
MD5 c4c89d1b3190379da0b02f9a780932f4
SHA1 286639942db8481f945708beec81452edfbf3dc7
SHA512 62181ed14e58435f4a4072e00c9c5808162f90bfa60a9ddc86e2d22dd063d4c3870b4122dee860530667692284dfd6b9a5cd093d26232af83fd93fe2fc910da2
SSDEEP 49152:1b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnKDmg27RnWGj:L3q6HjB5D527BWG
TLSH
T1CDD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 04cff08b9598ca2edf3142ab76ed2f3599ebcc12d70f62979b47498ae5928b77
MD5 4c77ec8c94c391eda4ae6e161b71a5bf
SHA1 f81c7ab39b654f62b76d959c8035678305cebffc
SHA512 4e7c987f183ab869bb6a758e00408da73bf73a5f075b8db792ee19d839f2908f97fcd62d5b3cac587a4a4afd6b6bba6c5536064e115ef57015e7455ed287885e
SSDEEP 24576:0XYfDtczA5sqjnhMgeiCl7G0nehbGZpbD:ztcoDmg27RnWGj
TLSH
T177650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 6538242d17a54d44cf62a1fa044568dfa46d9d9bedb452ae6d02bd9f80ef6b04
MD5 ff56a5cda244c8aae452f7ea2e2a6372
SHA1 dd2a09b0cd584b3cb92cf0c629746d6ddef2bd06
SHA512 a377ede6e11c245a77d8e1843e30f3842c354b8a464dc3b15885e401db17029bb659eef20e76628959bd7c31cadf0ed5037c28f0b0351b3e38c1e41cc6f23c64
SSDEEP 24576:G0Le5ji0hmxirMOsqjnhMgeiCl7G0nehbGZpbD:GPji0AcvDmg27RnWGj
TLSH
T1E4859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f5ad1219aa28d85af417cc2771e6bc0b106730c3a5d6fefb82c0dfa8717a4b62
MD5 95a09159631a0b3041fd23a7354b5466
SHA1 99ee60827d4de55931df8210de30f8a536a5e7a7
SHA512 07b005a1acbe953629e5a3c133caff5b0d01a00a024d62291b5ea458c5197fa1a26c66270be5e862701b1f8df44153fe47e3f16dea95745635323cb519db4c39
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWE6q8wyuMsqjnhMgeiCl7G0nehbGZpbD:U/ezSC6vUzPvxHjyjDmg27RnWGj
TLSH
T1E7755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d9f8e38a9ef6a0b4851ed562fc56877e65640398e4b26538b7b5ea0d245239f3
MD5 3a66b2b06f4307624b114cb178d72316
SHA1 c3846152b9f4905bf2160867e4ebc1a7cd89ceb2
SHA512 7ad3f0703fbcccbe29a6ed7bd2c544088768747d2648a7a78676ec7d5ee90bf7200e6e0589cf3a3396f978e705bd23739cc3046709d4454b31c76cfce6e9e812
SSDEEP 24576:QVbqPb88hv/l+6VsqjnhMgeiCl7G0nehbGZpbD:QVO88hXl+WDmg27RnWGj
TLSH
T171559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 85705f783f8a0425999b2a8919964bb6f030a6f561a3934b2a7ac9406d528af3
MD5 c3bc84fef606372cc017df66a7ddb3df
SHA1 ceb41a0fd571575064c5cb6b4fc3ff6242a6b5f9
SHA512 4aa099ea3f0e503df8eca91544e4e181c4d9c58280f83b04e0663cea6e839026187560f4c26193f2b88a971fd74c0e7b14979f6298bd0609c98b588110d1a579
SSDEEP 12288:QRKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QRKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ED4523BE824C11DAEB7608B5C3E9F51EAC133E56982008436A637DFEE6B5454CB3D423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 1af9d37926fc6752e41c2a12f61f87df5a3204a42e1c7ea05ee71d39f4e1e18e
MD5 3bd3842b71cb29af5b64837bcc09b2dc
SHA1 b9e5987bd1f81baa5d23969c02da31b3f8c9e04e
SHA512 2a54e874df91b559a50327201b2077c7fecf6ac8b965dcfc44c8970fb455868caa17fff13aefa0bc910554800a05860c0c41436ac041210149840e0fb9b2cfb2
SSDEEP 12288:VeBNUbTVO86UdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:VJIUdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11065CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 962fb5594e0f76fc5b7337750d006ef931edf39ad5c312c702bb81027c0ecc28
MD5 53bb46a95978a54ac3f9d9f66ad62f96
SHA1 ab61bc0d73f35372464336be094ce014c5fe7f2b
SHA512 51712328e5d861e537500be6b6b9874d9384d562b7ae3c0085501354935cb68d34608a6f9fc88c524c0132997c691fac2fc57504cfdaa60474261774833f0e4a
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH0:bQvGAdlCEL8c/yRNw5CID527BWG
TLSH
T14A266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 8a680b9f2ed3904c80b2efa1aed8bf011fd7f8997088fa3049f2e2acc97a4d8d
MD5 40a096594d77077e33afe75b38848983
SHA1 38960caf2202a6f1f3fe81976a597e719fa9c0c9
SHA512 adc324f81659a548cfea6e203d27ed513b37187d1ebe4a76e15e307e70d393bcff770c9bb2ab8510d89ff7f3bec2607535820b4646dc634c8441778d2caac4c0
SSDEEP 12288:7AwSfxL/2Dc34DLLmt0LDQewsAjLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:kdewsAjLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19675E031FA74E036C37B0DB20B76D71A582D7A204F6119C3E3E89D9E99702D1277AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6ff7ce6e2ed1bcf839cb21999a5b87273d15add7b627049cd986048c1202c9bc
MD5 9d2225ba7bd5bcf169b2a507033807c4
SHA1 0371e9271e9f0e6cb822c0d6e783de8b9e60f23e
SHA512 e6d401a7cb219e9f8459cf5d54631d1451781a588e15c6c1aca18552074509ea84668b1b4f0517015e13fa0c87dc62e9169008c0af559d89039cfbe1050707e4
SSDEEP 196608:tUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHHVQBWG:tUEtQevvqc2W1cpV2EI32eB
TLSH
T177474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0c6be8c3fb54ad14e1bdd981d0e8be81fad63069a8f04bd1a93ff5728a84c5a2
MD5 b0c7d44a97fb0591605fbf6730612428
SHA1 2d28e1ab4871b133a24a66945235ba7097efb21b
SHA512 6437a9b9c906248dd10752daa167ae80cf5fc6e3b828c489b7b96f352f8772d430d5dd0c0fde7f0b019b780bf512a52d092cabd85ecbf5f27d478f2d71f247e1
SSDEEP 49152:iCbRquA/m2yL5zQfFiV+XenmE3/zfDmg27RnWGj:noqtVjnmcD527BWG
TLSH
T19ED58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5e5ed03da7b1ac9af87ac021190c37ff7b549d87142a4c920f924afdf7d52997
MD5 cf3d848c84ce76e81ea231c5388854e9
SHA1 fabef45456765e82708cc7d709322b4d035b5c45
SHA512 a6936082333be383c22b424675c5a34dc206bbeea3a66d01597e76a5c54b70238fce243e2f6cfe8452f685e1261af986d8db787858c7a239230508bd51ecaa05
SSDEEP 24576:gAhGLJIFoiwtA5l7S53AsqjnhMgeiCl7G0nehbGZpbD:gAMyFoiq5sDmg27RnWGj
TLSH
T16C359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 80f642915b6d0521b546707610fcc1598df0aa94bafa145d238dbf7ec0740697
MD5 194b9029573dfa404ed8173625a2dfb5
SHA1 850b25467fce1b7dc684ac40bc6458318b468971
SHA512 3b0cb0e5c2af458d2f254d845d42f9391d1444c7b5de8a441a7a7e87bc79171bfed1cb6ae63ca1a70a37c886c2870fb620988b2e85a265097130945343d3f522
SSDEEP 12288:Lmw5HEjsChNVBFgl0WDm+CsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:KwuoOWfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E565F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33250AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 71685199c3b98b0febc1d739b947e673ad18d6ab5d29a733bcfd8df29f63c1f6
MD5 26795fc0c33c2e421b6d6ab904dd4b90
SHA1 a3661bd307071530f08ee13ed29030b926a3aafc
SHA512 0982d7d0f2dd5870c67595483f7702fdace07e53fc3405e43d6f918ee9833d00d905d46277963085f8c0a894def762f26ac77c62f885c0f6f6bd928ca79ecb95
SSDEEP 12288:xBZ1IybXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fZuWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E25512AE239820FAE1674178C5E5D609EB337C62673003CF166655BA6F73AC44E3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 24d6fbbaa7df5892eaeaa48c75c0da3212a043304f479181fdabb41c57b04155
MD5 a15f9be6e0f212c49c2f60a24ed385fb
SHA1 db93f6abbf45e6a73678a8e40f097edfb58f733a
SHA512 1c3e95fa9bbacd1659e9c63f5c4006a5cea2618060394f3c8640459cca201010a0a3b84832da8043618286e6fc7fe75f7b6249df634bdbb16fb36fc8fb2f4c41
SSDEEP 98304:bQRQyi36YOcPQLvw2gAf+PN31D527BWG:qQyiKayX+PNlVQBWG
TLSH
T100667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 07364694bf99d5ef57df305c55e177d873890a1e5175fe50fda80e942bfe458a
MD5 efbb487d562ed646a770e9e57e03baca
SHA1 34b1fbc466bad900aaf2db1b78a859df7350aab7
SHA512 f98d203f077daa7398f8aa9844431c3e10f9fa831853b976ab00267341d67d9f74002a02b492775ed5619d0854d062d624beb884e75386f7c72e950ea258f01f
SSDEEP 98304:KQRQyi36YOcPQLvw2gAf+PN31D527BWG:hQyiKayX+PNlVQBWG
TLSH
T13C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 48561992ecaf99744d1de7970dc1baf630d85225cda6be04d72f8f475c7b645a
MD5 93f9625e70802394364d66794bc7a56e
SHA1 0732fd0889a3665245e36e1084d7029230a4a2f5
SHA512 f4a159a4074e574c822208cdb219b755223bba487bb54616520abf80e6f6bc43ba2ae4417288380b572f805f5acc9cbf5e242276755addc48fcf12f1470fa08e
SSDEEP 24576:HwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0GsqjnhMgeiCl7Ge:v68Qg55nhheWu7PNU3/vDmg27RnWGj
TLSH
T1C6B55933B2F60099C44DE1769F4A973196D27C718FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2c00493df27127ea00cc1e9c612bedb3d7e97b0f62e7841b93674b5fc1383e85
MD5 f1dc15500d84143e0e889f204d8078dd
SHA1 e86924a559ecd7b1cfaceaf5f39ee3a2d78a7674
SHA512 b35825cf455d49bb539d4ea5ee3cacec7986885d3351e3e1bd72e5f3fb821fc6092b986731263462a29e04c922cd57796a17da287442a7b24447d46dde1038f4
SSDEEP 98304:hy5112gYy5azzVvL69nLKnhZeD527BWG:8LIHmWhEVQBWG
TLSH
T175167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e951fa73ea3ef8b988395946364843c428c08a0f537dbb7e410cb4146b47e635
MD5 aaae7e1b0de8a6381fe7c4823cd97c20
SHA1 dd3819b4d80bc42eb01ab5538bc7e18c41ccc75c
SHA512 8915809008870036bd1bc9ecee1e1af50333725d9f0c2e278b28a8d0bff8c636383c31775d3e2574ff0ac80729b3705c2ec258a0ed2f87a9f6d8b8541e724d51
SSDEEP 49152:aB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gltDmg27RnWGj:Iu6JmVxd2dtD527BWG
TLSH
T155D59D13F1DA01E8D06ED478974A9233F962BC490B34B6EF0A9072562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3667f7e984428e086a51c493a72824afeb943f340a5ca6a6de465274d733c8ac
MD5 bd1c39f939d89fbb693d4a1b851bd5be
SHA1 77a0a09538b25a68254d5491c6278103a22fa465
SHA512 5b2e275942876f3d960827f7fc0eee9a38fa8da9c43eae5bf3b853080d0a9d959c02403c65f310a30ccf9d5fb3e82236691c6a847f146bacf8652e07788207a3
SSDEEP 49152:91hpsNoJpF1A6UU44CwH7R4xhDmg27RnWGj:9mifPbRcD527BWG
TLSH
T1F1B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 107156bd95149ee92e660c21431fbfd922e65d06045b17b45ce8f04370b1e6ad
MD5 89a3bbe64f5520ea1f5f3aaab4451f27
SHA1 72b19fa54055b903d6326e2eeaf799dc4d0c29be
SHA512 369f81ca0c0976f79698dfe2c3fa1790b052475f02a3104e7d27d38c7d4cd6b01b098f6b02883ba0ed1fddcbbd73903172cbf27fe5d22411074cd16f693e616b
SSDEEP 49152:BSuZQIY0Be2KRRVtOnks6NMHqaDmg27RnWGj:P5dKTi61aD527BWG
TLSH
T134C5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 90f299a97d31b6e9351b52bec6ec3f0b14c91587e9ea1f7b1fefbbc4bb820516
MD5 08a23042dc9e6c93cc16f7a98cc37e9c
SHA1 73f55cc36ad82706e02bf76ebd335f26b530eb37
SHA512 11d1de575c0f8059ffe18539292f5967114c201da9f2d3a629b9b41caf4039ba5a34aa9576ae64915a656f9b16bf1b965c6d2319fbabab0e12efa4628cc7dd0a
SSDEEP 49152:rhtSn8EApI0figngiDn0AP5w9Dmg27RnWGj:qX2iyphwD527BWG
TLSH
T1AA95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9813bc3a7eab2c2505db749b57d6f355f44d5386dbf3f3612fc268e04af027dd
MD5 e63f79bdd6ba45b5f54fa1ce0fc3c332
SHA1 4dc299a39aa34b305cec85df14c11be32957a805
SHA512 3b167f530ec9095923e467178ca1cceb65ececd44393176b7f12f88f50142317fc1335d2200149c51b85749bd883a4d8f45c369ae568c228bd026e216c480e56
SSDEEP 12288:WSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12D4523BE915C01CBE52648B5C3E5F10EAC173E57E92004937A5778BEEBB14584B3D826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 fbdb0947dba69098ce4ec6ab608fc4fd0c77cc24ba5663bee4d7af76b617c26b
MD5 6a62b6b3a1d5a4d6e4d74e3ca2d532c2
SHA1 47299f7d6e28319a980a1352ee23cb4cf3bc2d40
SHA512 47224a1cdc91db1f45db6f055c194072b53583025235a23d74c9d417d0826a40f082027c6600f5e8bd398071fc025e4823194c2be3d2314dd6c57eea43629508
SSDEEP 12288:GXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1934523BE915C01CBE52648B5C3E5F11EAC173E67E92004937A5778BEFBB14584B3D822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d83a13459fc5d07bb782ca3b6e2491a5424a29d5d9144cbc9c245d60945293e2
MD5 d4fbc6f0b185c54ddc43872dc16a6cb2
SHA1 ad506bdd7bf830fee43bf8e1eee3eecb2e7b7292
SHA512 b4cad934eb7105653c5510ad35a9792448f1b4ffbb51edf46a053d8d43d19aa04d6ae7975d7e07853691b48fa5baf78a9fed23990f8a7e7be2ebec893862ab32
SSDEEP 12288:6FXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6FsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1114523BE915C01CBE52648B5C3E6F15EAC173E57E9200493BA9778BDFBB14584B3C822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 435b7626a006bcb4aed1b8b6852bfa4bd31bc33adedb425947aac93a9e0158d1
MD5 771c908be094b324a128951f03a46350
SHA1 f0dd9d37e2a2e69a1b8f4c8d34a2569720e275a0
SHA512 c8fe4b5b642461f9341e057603f7dbae573d11473538b3926cf63290f88124ca2d1f965499104ac9bc4031a4e424675232997ec8eaa29668a8cd8663b5d007bb
SSDEEP 12288:9VgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:osqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AD45236E535C01CAD87285B4C2E6E11DF8237D56EB3005DB6B5328BE9FB16944F3CA22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 5d12fb7919cc3c7fa535925a2c1d3d81717b06da30473aefa4d850389a1bf728
MD5 7050d8a9863f0dd9db26f92377a62bc6
SHA1 99f79980ffc0acab7a4d8f384ec52be769f61f9e
SHA512 456e33d5aaf1cb583a0a7f88c7d4cfdbfc2b0894fc754c95d25235331957a4b05ecb1bccca4bb9bc48085dfb65e326d3ec0746e98e8605737212e8ab65839d43
SSDEEP 12288:E4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:E4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1544523BE914C01CBE52648B5C3E6F15EAC173E57E9200493BA9778BDFBB14584B3C862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 bc69c440bf6ee1eef478028ada9389404465d09bcc5a89e424cfedaaef4dec19
MD5 ecd5a8a5c4efa6b5d239eb4cc8fd9c5d
SHA1 85402b209f4fea46b495476dc32a065e37a0588b
SHA512 648a8895db85f640093d1c137ddb8884f56089c7a46cf6389bf9cb48c927fc27474939de2c8d736dd06d11e56cddd8494310417f4ec15cd45cb680cd3567d2c7
SSDEEP 12288:sTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1294523BE915C01CBE52648B5C3E5F15EAC173E67E92004937A9778BEFBB14584B3C822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 736e64d3b1843f5f5433eabae67a1c80c6ab34af43cf528d4a95e17bcaed8a95
MD5 ac41bf5e305700dd8b7142a605aac443
SHA1 d75be0868393882518906c9618a9504a1724aa27
SHA512 21b67ca72ed69c4fcaf3e59fc14c8de1e4fe479c1ed314eab1054553c7a16a6517cc2974394b104856113aaff04feaac48ea8de9738c7ccfc5493392e01face4
SSDEEP 12288:0PXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0PsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10E4523BE955C01CBE52648B5C3E5F11DAC173E6BE9200493BA5778BEFBB14584B3C822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 bc391203be53c3f4d70fabb0d8c2da8c77af60087781b000fd2b4037d7bc2ed9
MD5 3126fcdb9df5a9d0ea83dc4a9bd6a0fe
SHA1 7cce6eb31dab6bd1c6a4dc760bbcdd077499a2c7
SHA512 68e4c9adf1ad65c15b4b05b1fc9118b7a0f9037d9d93fd8e6b81498dfb98cb2df65bb89585b581e24af12ed6da5657445ca863cb2d29bc05864a554a9187ec67
SSDEEP 24576:JZMSzFVSO3sqjnhMgeiCl7G0nehbGZpbD:JZMSzfnDmg27RnWGj
TLSH
T1226501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 bd62eb06ad35cdf031f66ce73c3e5a6133cb45ab60c3ddf5cedb0fa8a25d3a62
MD5 0eb5cee2c709ea5405a5ddd062887dba
SHA1 e3e6016531fc7dab0aaac996a2371fe8141db4e3
SHA512 810ddf7adb50f55d159624691c1a9b109a2e1b0e006800521832ea432410a0da874a852e8d52eba2f18e73678fc628c0ad76320d6867767b0268e0467d18583e
SSDEEP 12288:RmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ED4523BE915C01CBE52648B5C3E5F15EAC173E5BE9200493BA5B78BDFBB14584B3C822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ec6e6add69218cee78a1c35bc0dc3b64dec655e2029f7f68a0ad4898dda1f6d1
MD5 a0fc0904bf088ca7d112eb09dafc9a54
SHA1 d5de6de3fba6abd8ac97790e89554de2e0110135
SHA512 e46047bc6ad753f813b872533a8d9c187caded5b557c64a017c37423ebe637e050c86e5c572f91e9dbab37fd65e70a71691de985d00bb23a19d0b073365f27c3
SSDEEP 12288:laXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1254523BE915C01CAE52648B5C3E5F15EAC173E5BE9200493BA5B78BDFBB14584B3C823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 082815ab5f876be2605728861d9d6f42287e1f39dac386df675834ed99a76ac0
MD5 28ec880029462eb7e907715d9a5cb2ef
SHA1 3245eafa0d2058a0d96a079c908e231918d81e3e
SHA512 0136dd1b6cd43d124523e947f53731e2533ff07425d92a53e3d0e236908b6d40a0c6f40489b204d0317a1f0322c4999deeede93f9fcd22946481e4f3199f8fec
SSDEEP 12288:pyPz5L8bXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IzybsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11D55125B73A530F9D1378178C5A29A06F7327C364B204A9F17A516BA6F336904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 fa8a0e9659cbe1e971ff004645808db1006247a728d646479c3fe97b4e09fe2e
MD5 eb76b39c47c5b1bd5671c62ccb3de7b7
SHA1 1c9b7ed97d9d7a8c8d0ea16f52eb3c51a14c1471
SHA512 241072b159f094df37f51b5485c8b2109b30a315f6faafbd9e4880159242e41e62217d3f793da1a0dd6005f8809c565b52fc897537d58a5c0e96f83ad626d7b1
SSDEEP 12288:BmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CC4523BE915C01CBE52648B5C3E5F15EAC173E57E9200483BA5B78BDFBB14584B3D822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 bb2869d515da0d1d7a9333465bc3be379a3255db1900cdca7a2e9dc5f6e811c8
MD5 3fa5608d1575b8a95e1f9d9d8e59ef90
SHA1 72983609bcd9f89a21910c40a4d7898b3e251a3b
SHA512 0d72be13998e977f7d1f9e54440df124998908d4b2ee7024d9b8fa30c02c9e0beeb5914dc310495dc203fe77f462b753dfa325ed424a196f22326215a7e6946c
SSDEEP 12288:LmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1934523BE915C01CBE52648B5C3E5F15EAC173E5BE9200483BA5B78BDFBB14584B3D822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 a62df1dfa7a113c0f4bbbc605f8a7268a344ccd34eb2050d3b8fa547a9d96464
MD5 a28a37b85a878f8b92bb3430c16866c9
SHA1 b9a381e02b2db7bc23a286c1bc46be2dd8d5aadf
SHA512 72cdbc10827e64af2ff67da4211080a7ee1c33c7a6cdeedafa0ee58d60d90990b407ca8adc9bd37eed7271f71f2285b9f40efcbb2ef88fb453c7bc8bb9370348
SSDEEP 12288:/yPz5L8bXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yzybsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12755125B73A530F9D1378178C5A29606F7327C364B204A9F17A516BA6F336908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 5c4d02876a91ffda2368fdacc0f7cffdca9a9878997689334ac8fc8a476f3d23
MD5 77560f74bca235bb569276b9a51e2ad6
SHA1 371962ef75625672a66bdd2016b678a1c3925966
SHA512 85e30c29fd792eff58701ed3e2e810600f484626889758f2c0b3fb45dbea99a5f40b061feac6986a1c8d1e49e733da5a2e6d020987e401bb103ae8cb4313fcde
SSDEEP 24576:9THaLl3z0zD1sqjnhMgeiCl7G0nehbGZpbD:9T6Llj4Dmg27RnWGj
TLSH
T1636501A9B35018F8EC67813EC965D90AD5B27C5A0B70C65F13A4366B5F333A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 d931091dc9c5b6ae3015ccff471b10d4ef9bf95fe178f00d26f1528524af895f
MD5 f523efe3b42029ec1ca99c427ab9aecf
SHA1 414b046e6ab2c36b756a9857be34849d12332082
SHA512 3d15c72f58eaefc6f410e5630e4ac0438e5088933856cae752832c93a0732900ac37eb0f94410dd6fe734dd8d556be4e65d79b9f5978798416b0dfd352da3cc0
SSDEEP 24576:F37d9CHKy7GZBsqjnhMgeiCl7G0nehbGZpbD:l7d9CHKyanDmg27RnWGj
TLSH
T11475CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 e7de2ea405db4ee7cdb9300eba62fff25e32e0d4383e8867deacfee2f5fd7597
MD5 1e42cae01d053577f9c05a4b66cd6615
SHA1 c857e97efc6bda0b6391804d96c827c1844c22a2
SHA512 e80c49cd8338d3240f21eef20a8225b879f4f7b31dcb24bdfae6c8d9d135f82b104f520c649f052bc5392a14fafb68dbe93a70c40f2476c184361a3d1743e1b2
SSDEEP 12288:MlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1504523BE915C01CBE52648B5C3E6F11EAC173E57E9200493BA9778BDFBB14584B3C822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 187d0d51a885f5b4b547a036e3faf81996a37b6cda8ca6a6551bdcbcb9055c4d
MD5 6fec4e98a3054eba43370193f7eb58e9
SHA1 0905740023d0204e106ec34d3b18b487b78c1a1d
SHA512 b9b8ef81b8fc696118cac79d96b326c1e26e7a850b783dd63f898811654d928a91c7c66b8f9341183681c21a7e490c8786e9a54cf60a3317fdf2ce5c8dff2453
SSDEEP 12288:J7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:J7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13E4523BE915C01DBE52644B5C3E6E11EAC073E57E9200493BB9778BDEBB14584B3C423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 c82a90707f44274acc939359198249788dac080a19f298c7a7088fb93f8e3817
MD5 1d53f3849e570b60432b35ca14636068
SHA1 66a20b37ddc79fb4ebffca18828879b42cb4665a
SHA512 b0507832b5a7625a7af00a22a30748fc39fe210a052af30bd4ebac0d1f67d7b0132d3224798907c69c199b7e04193c9a43f78fa7682f7bdc33257d7af56d9849
SSDEEP 12288:tkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1274523BE915C01CBE52648B5C3E5F15EAC173E5BE9200483BA5778BDFBB14584B3C826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 1d9e717dde46735c6100735432020e728e1a49a8ebc4944b0f7fc518631b5534
MD5 2686f871c619474ab6a1b74c213274b8
SHA1 f8d1e4c5223a37a8eb275e4a3f4af96925d226f5
SHA512 d4fdefc5222ae1c101409c8519779d5a2b2d1a637ef48eaea6e92056c459b05bb1997f08267e368e032e62056ce998aa4810eb21455253b7b7ca55cfe461ed45
SSDEEP 12288:omXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:omsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FC4523BE915C01CBE52648B5C3E5F15EAC173E5BE9200483BA5B78BDFBB14584B3D822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 41ba7724e30c42232b226f398b9f74047afc5ddbbb6028eee93bb9ea0550abb3
MD5 58b6170213a6593ac152b46f4f7cd930
SHA1 666193edecfd981164b89b851df5a5c66504d12e
SHA512 43a246fc0f0adaee40eb8595e3926f49b86909bab3aefcf239abc4d848bc504b4a09109d374b8409c53e050b431b7fa0588422fd615c91e8738f69d8d23373ad
SSDEEP 12288:hlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1084523BE915C01CBE52648B5C3E6F11EAC173E57E9200483BA9778BDFBB14584B3D822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 065257a638d984d46f7907e7dd4997b2e05004e80ff5243c15df27ae5a42b9b6
MD5 07d49eb95b4fcb28baa570b0549dd136
SHA1 b9bbe5f62b002f039e6f3630f58bc712e690ce0f
SHA512 e04b3a37effeba2fca5feb7732d23b9cc23674fdef1b3951d24015fb72115b6c0d52a22d449c98d9eebd997fe8c8ac8d77638146c99a9af557601a4300470481
SSDEEP 12288:N+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:N+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F04523BE955C01CAE52648F5C3E5F11EAC173E67E9200493BB5778BEEBB14584B3C822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 6eb1285f1809cf9ec4c4f3a4740e6b18488a672f2d390af4e1c507d3d70b5ff1
MD5 10313802277f3ee243894f31c1f0437a
SHA1 db2a1f2d20116d9073fddb46ad398a8a135e9c23
SHA512 50de97ee2c684f274bf1da97c2af2422c8653593920db588caa2d327c42e6e5886886178c9363317b3c07334fd1d4af8ef4ebd81a35831e51631661ece12dfb2
SSDEEP 12288:D4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:D4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F94523BE915C01CBE52648B5C3E6F15EAC173E57E9200493BA9778BDFBB14584B3C822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 0609e8fd3d3dc8a3fab02cd7f126640e2fdcae52602931e1b013d41f953ce068
MD5 dccccaaccd4e09751a784f64287901ba
SHA1 7ece1e082fb9a8ede39b2e566877a960ede46dba
SHA512 d34b5fb188433d52466995224f21d969080653abe6fbd2daf7739ee777c23615bdcef056989381086b40e2418690a39afd0c8e3159ed03e23f0631fb36b68be4
SSDEEP 24576:mfwvok9RX6wkyAIqsqjnhMgeiCl7G0nehbGZpbD:qMnYI+Dmg27RnWGj
TLSH
T14B85DF29EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 bb2204d550040af19b20a00dbff38d9ed91374e472883b44182dc10022ba7427
MD5 de6c7296fd74255aa6ae891d1426e397
SHA1 ff596b257e3fa5e03d362ece5ef35da8d75f3ded
SHA512 74a68e6ad5a7f0ebd5c4870f798860abcf9234dbeb16a4846a424bbf5272dfa9d3c82e4bdd243c30b30590411d853a3c675f4a6181df11f5d4b30b6275b9f348
SSDEEP 49152:qYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0dDmg27RnWGj:EySzPVD527BWG
TLSH
T1E5066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8e80790c0cc71ae062c9e23a0544eaab37e9af58578855082cb1fca175e5de7d
MD5 094fc0457aedf2a49adaeb24714e2b5b
SHA1 9f8e96696ada063d10f606340b12884385dc33fa
SHA512 f7071c460166fec37afbf6404e7c6a09bd76d620b8c4d851a2e9e3fbddf2c6052b3a972e2a0289f8706651d07363da38a3dd47a3293b822501c613c201cb3a3d
SSDEEP 24576:N47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYHsqjnhMgeiCl7G0nehbGZpbD:N47JUQj1irIhCnDHUPfF/tDmg27RnWGj
TLSH
T1A365AE1EA3EC01E5E1BA927885558A1AEA71782E1F31CACF1270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 4301b8b37509a3a62368b39b747b5dc0a2b4d7034ec88d5facfdd509ab32d4eb
MD5 6077d17d68f4cb42372be4d31ebe5aea
SHA1 0ba281ff672659a032c5abcfeab97e9fcc95c8df
SHA512 bb69ff567101c610cbcb2c1b31daafc11d21ddf01fe82214304100dedcd24e67038f572ccd50fabc44ce1e4730e88e4845d1dd99c518e580e138a68aff46984f
SSDEEP 12288:MNsfWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9WsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B555015AD29802D9C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 fe2d707d0918dddd2a4d979e7a648939eec5ed191de85fccf8baa29359c774bb
MD5 18ff1af437a942883bef95b2d54eb0c8
SHA1 7d77ab11ac76bcc79b8f40885721f60760ac6b6a
SHA512 0a0f3da5cd403180aab9b9d77006dd208b4c4887525582f6297a4ad97e66f46c5212e363927587f60087578edff12ec1a7db8c4dee38a68f9af0c8e9ede24d56
SSDEEP 12288:cmjfpU3f9mLORnjvR7PfPz57AqMEJCqNHh2jtuyyJqo2MT/RM:cmjhUP9z13r57H1kqNYhuD8xMrRM
TLSH
T1B03528107626DB4FC6A940321E37D2CCAB707D45EE45AF0773C9873FC576658BAA2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 1e260f69ea37db43666761125eb9039ca633b9397d5e6e0cd0ae7147219eb0fe
MD5 d6726f4af6d2965e6109a5513721bbc3
SHA1 5a9e2a94d714ed535d17e73d65d7cbf40f649d35
SHA512 858fb32f57605af3e69e950a14b94748670e5d74d4eb524dd2255f24b70fbfe504d46a64c2ed1315ddfe10f335c6d91f764e22b51eb431ed1ca067342b5b96a7
SSDEEP 12288:AR9wzpuJogrMUmYs14gDvM2N4jpVmQvmAA6j1qxtRdaYTzcf:AR9zf
TLSH
T18765D7409437E78FD1BB6032076A5B4C67A4EC0B77495F26B3C9493AD82BB11B5B83C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e65fcc089cb86de7458a9e917feaf2338e490c6160badf48aeb946394cd8fb42
MD5 c37c71037e5825df2605043b087a2924
SHA1 c704c6fb1636390cbdfede4311847b7fe7385094
SHA512 013d55cc415c3457e09678bec368d38ca874e1330bff69b7cb9eb0e7efa0f94df65e88296cce9c453230f52f688f88fdc2b982b485b362ec84a6782014f9f8b7
SSDEEP 12288:LM7uXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QusqjnhMgeiCl7G0nehbGZpbD
TLSH
T18745237A834C118AE53609B482EAE12D781B3E669F1044C3BA5379FDF6B18C48F3D917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b9dccd1f8c6b9cbc5bf714650d987ee55897b0519eb923e3d85e07f8f8429d81
MD5 0be597d4c6890179e006b00a86743c89
SHA1 61e797eb159f4506cbd9899d01bedfc8d9ce9a1c
SHA512 99738fa22d828c6c5558b7579ab7edbc0e36a23666cb87ad51a5a80e30e8a1c8f86b51df4b02bd3ee0ed70f9459fd976ee66593dd863930e2e2afdf2421d60a4
SSDEEP 24576:Fgb6bmBIi49WNNFpg1rSvFv7bYMsqjnhMgeiCl7G0nehbGZpbD:Fgb4mBIBhGFbDmg27RnWGj
TLSH
T1B9659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 458701a11c7a09799c88d2df550abe31bb97b579151bb6c21d57c3e816ff4a9b
MD5 f2edb6a068135895610053cb6c5dc4c2
SHA1 e86871be58466a12ec84f07f40dba89c8a9bf413
SHA512 4a3294980b17ea8ffedfa16625c1833c749a72143254ae74132c0431d8ca90415ed0572292927498d1935545def336824e0132d20cf607766fd84d77ade2bbbd
SSDEEP 24576:4G88u8FpJqH1bzria7/m3sqjnhMgeiCl7G0nehbGZpbD:77ZFPqVea7/gDmg27RnWGj
TLSH
T1C385F16577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 59c6176142039370be05299bfc6ca3dca2d3bf07a724616dc243996f0cf77b81
MD5 20918a5255e70c6d9b8da9e3dbf2a79e
SHA1 893dac7f4244e99a8dd39cc3e62e82132996a5ec
SHA512 406374a267bbc33a1baf0f25e493430736f9ac3924824c08cc9461a92e8e0c663da1c870dbcf516293a9b12858fca97f7c8059a5e872414bd38680b294bd4c2e
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjXDmg27RnWGj:5G05lO43bmD527BWG
TLSH
T184D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0a5b6730629a3959bb14ab54837341f3c9b4663ee46e6cf7532db483acbcea6e
MD5 64e05d1713c6bbe69cf26621a57e955e
SHA1 91fd38c66877a7093947da371117bb650a5c30e0
SHA512 8cf0a34a92d37da72403fdb080108a70a6c0601d9ab326df0d36bd7c5141823313adc5e1fa7eca64a889a79ce499c9d6178460fbd3f37a32fc75ee43510b5f90
SSDEEP 24576:afa5POZ3dpFWVM50JicR2hG0lasx2+47eidnZsqjnhMgeiCl7G0nehbGZpbD:ya5POZ3+Jt2pasx2+mvDmg27RnWGj
TLSH
T15765BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 dde610f72efbcc46fc76a6e145d108a6e3e279ba307e497c1e16a45d93a8ca97
MD5 2de7617b7e9f17f1444ae145c8f5fb54
SHA1 6afb0a409f128ab33a29cb7d35a1d0a2d4bcb70e
SHA512 7c03bb3be8b86fceb7f911a5921dfa5fd0158efad18b0a331606b437dcdd23deb856fa1d2e1ae3e34a86110ed254570d8241f7b331027127357630cc0f6772bf
SSDEEP 24576:WNcwHdjbyQ4nLC18lb/EOjowL7Fk/sqjnhMgeiCl7G0nehbGZpbD:WNc/zEOVHFADmg27RnWGj
TLSH
T1A7857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c29593137c3d53826ed43b3d4b48f90d70ba088448b63252631e82c86f2d5499
MD5 15034607c2a57c2e07ef77557c699134
SHA1 6983fa40b9089a18ef3e2cfe04f5f87818a2339a
SHA512 be7db132fcbd4dd413c91e948617ca9aea2be41a37972e0b139dbebc47cc2c13206505bd714cc1aa69079899f59db21c8821fad4805f58cb12c17c89bbe88240
SSDEEP 24576:v8kNvNnaFeYhJNtmZBmtsqjnhMgeiCl7G0nehbGZpbD:v8MwBtOmRDmg27RnWGj
TLSH
T14755AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 64baf31651b1e4b34cab88006a2e57b6ff34d96b7a2773bf8531927a36b9ab93
MD5 dbf0038eec5e3110562ebf8beb8c4567
SHA1 37e43cf74422430c18d5e62028c9c28981b5a2fe
SHA512 80f3a2222d907830339876248419a9068448c2a6727cc5b0277426152b8fcc6b5c7a83873e8ac53e60ead17ccca6ea8b63df8c1441d5b9def2d0a0147dc5345b
SSDEEP 12288:AHvUrBFrEjwaQjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:APUr+NQjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17865F12F62AC18E5E676A17CC682C70DF6727862071192CF02E1817E5F63DD8AD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 0da973b18dcad4887562ea4513c6995dd6d64dbd10c062c1325f86486640dd5d
MD5 c5a832380ea29b0de9069d49e91836b9
SHA1 d4edb17d0f8aaefe24015db99c8167307ace897d
SHA512 09a21ec97b10204081a71afea4c428c1a2501f794cf9dc696f6b35543217d490caa5f21f06da3f57073ac0784c726b7656717ec337f37d3259886e520707acb0
SSDEEP 24576:qD3FHshBIYQgAysqjnhMgeiCl7G0nehbGZpbD:qDVHeBIAA2Dmg27RnWGj
TLSH
T1EC75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-46-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/8-39-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/8-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/8-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/8-45-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/8-50-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/828-122-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/828-308-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/828-114-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/828-116-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/1340-134-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1340-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1340-136-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1340-128-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1340-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1644-77-0x0000000000400000-0x00000000005E7000-memory.dmp

Download

memory/1644-0-0x0000000000400000-0x00000000005E7000-memory.dmp

Download

memory/1644-7-0x0000000002340000-0x00000000023A7000-memory.dmp

Download

memory/1644-1-0x0000000002340000-0x00000000023A7000-memory.dmp

Download

memory/1644-6-0x0000000002340000-0x00000000023A7000-memory.dmp

Download

memory/2636-96-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2636-327-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2636-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2636-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2636-90-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2636-280-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3196-20-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3196-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3196-13-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3196-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3196-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3716-108-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3716-102-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3716-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3716-293-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3716-312-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3716-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4272-251-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4272-84-0x00000000009F0000-0x0000000000A57000-memory.dmp

Download

memory/4272-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4272-79-0x00000000009F0000-0x0000000000A57000-memory.dmp

Download

memory/4904-180-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4904-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4904-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4904-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5008-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5008-113-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5008-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5008-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5008-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5080-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5080-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5080-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5080-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5768-214-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5768-67-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5768-73-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5768-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download