c8ac78708a86c0eb871470268f900136d46acd8e236839aaf75abae8755ddcc9

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 15:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Size 1.3MB
Sample261110-svsapsvwg1
SHA256 c8ac78708a86c0eb871470268f900136d46acd8e236839aaf75abae8755ddcc9
MD5 78f5c15b478a675c97cc63e46be6c6d0
SHA1 89f2f6aa2b50094ed1e6f256c776036c0a202140
SHA512 51a3e100889cffd0d351f13bfc393a2fc675a36cf9ed099d6fbfcf63a4b932bd67351815b563ffd3a90cb6589ee6c38fce4ea5c0ff223e57b46cdfe460bf7e13
SSDEEP 12288:WDq2lsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B7551222B6D4C072E4311D7586A9D6855A3BBC27EF3494C7B7912C9EAE711C08A3B363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
952	elevation_service.exe
5928	elevation_service.exe
3408	maintenanceservice.exe
4864	OSE.EXE
2748	PerceptionSimulationService.exe
3920	perfhost.exe
1956	ReFsDedupSvc.exe
4524	SensorDataService.exe
2720	ssh-agent.exe
4344	AgentService.exe
3356	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\93e05bb2227843b8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105656\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb9b3a022871dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006017c1432871dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f51fb9432871dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000280374012871dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c159cf012871dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e4cac8432871dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
952	elevation_service.exe
952	elevation_service.exe
952	elevation_service.exe
952	elevation_service.exe
952	elevation_service.exe
952	elevation_service.exe
952	elevation_service.exe
5928	elevation_service.exe
5928	elevation_service.exe
5928	elevation_service.exe
5928	elevation_service.exe
5928	elevation_service.exe
5928	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3520	2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
Token: SeBackupPrivilege	1956	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1956	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1956	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1956	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1956	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1956	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1956	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1956	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1956	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1956	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4344	AgentService.exe
Token: 33	3356	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3356	SearchIndexer.exe
Token: SeDebugPrivilege	952	elevation_service.exe
Token: SeDebugPrivilege	5928	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 5372	3356	SearchIndexer.exe	100
PID 3356 wrote to memory of 3192	3356	SearchIndexer.exe	101
PID 3356 wrote to memory of 2432	3356	SearchIndexer.exe	102
PID 3356 wrote to memory of 876	3356	SearchIndexer.exe	103
PID 3356 wrote to memory of 620	3356	SearchIndexer.exe	109
PID 3356 wrote to memory of 2364	3356	SearchIndexer.exe	110
PID 3356 wrote to memory of 5624	3356	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_78f5c15b478a675c97cc63e46be6c6d0_amadey_elex_manuscrypt_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3520

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5928

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3408

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4864

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2748

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3920

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4524

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2720

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4344

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5372
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3192
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2948 2952 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2432
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3000 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:876
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:620
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2948 2952 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2364
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3000 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9cbbe84988044cd955a38401e1679948314af0fe858289f8dc769eed74f358ca
MD5 a3571e64d1a70f6ac694da248a0e1aaf
SHA1 72a4927a863f657c238deb18feab215a31b78191
SHA512 8ee9cbfdc595f919fc2286b227fa8acf04cf3a5323881baa999c7309905bbe1b3ad7f3f7b4dad9be34706a91f5f84cd4191e3b7f7f2286c18ef329ad7feee6ea
SSDEEP 49152:zb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnIDmg27RnWGj:R3q6sjBvD527BWG
TLSH
T1E8D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 0e826c27cd4bed6ac65975986a708cfdaaaf33b90687e5547adece156bdc4328
MD5 99a7a2c36f0c93532b7285dc9924e17e
SHA1 fee01d164bce8ee3121c7eadee8cac4baa448e62
SHA512 f1c7965868aff1b28bb3edc4863e42df807ce6d096356b7c65deb03ba90a9e185567d76b1078a7abd1007f65c5ee256191a813128c1c9abca0c25a2baa488a70
SSDEEP 24576:7XYfDtczA/sqjnhMgeiCl7G0nehbGZpbD:etc+Dmg27RnWGj
TLSH
T1E565F129A3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 0398edd74d6eacc833f56554a2651080a0a5ec90002628cc78a8d112d6db456f
MD5 e36c682af56402d83532f6a0e51a64bd
SHA1 ebfed77437a8dce3f37bf7468a1b11956192c329
SHA512 f7d0882bd72f00272cf3dde6a8ffb81a3043f2022274942a9aad652d5472e31551070842ab97197cd5eb3ed2f3e5f0f3a6d24acec6b9dd2514a3a50b6ed33819
SSDEEP 24576:W0Le5ji0hmxxrMUsqjnhMgeiCl7G0nehbGZpbD:WPji0AjlDmg27RnWGj
TLSH
T1AC859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 44a1b7128d1e505ef4af179ea92b05b4dfc3ae7f1489c52cb4a190270d7b73f5
MD5 80e5ef61ec1d3267e5ae103bb7a2d85d
SHA1 ff510c896696fd9ff6009fd3d1ac6c757c2f7179
SHA512 d252a820e77824e38419460a63ea27e4cb74c969f72919e8bcce0859dcb0b26a73a4afd551df6dc1dcf2ad2841f1cfa153dec8e5a32806260828ea32a840c9cc
SSDEEP 24576:ua7/ezSC6vUyD/aqgrvWn6q8wyu6sqjnhMgeiCl7G0nehbGZpbD:p/ezSC6vUzPveHjy5Dmg27RnWGj
TLSH
T118755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 655069f5d6907e9d1322c9d67457bdb29122ea101b330491c798ae119c6229c5
MD5 dd72fee5608f8828f359ef2f4f6159e7
SHA1 63688d1046e815034f8874c8f08b6ce414f707ed
SHA512 f89e99404888247d265a37c339c999f15cec03a38377269888a4dd586b7b69fd53afd49a99d454da3a0d94487448524f51c264a419d5c54f0b728c1964938ffc
SSDEEP 24576:zVbqPb88hv/l+YLsqjnhMgeiCl7G0nehbGZpbD:zVO88hXl+GDmg27RnWGj
TLSH
T11F559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 b64f6cc7d86ce3a4c63902d971473e6aadaed91006c454acae33a40f15d4f0b0
MD5 0b2eae2ebcab1ed1425dd75e74369d4c
SHA1 9166b3ab81b2ce5717cc04277d535d621f1378de
SHA512 8a638e43488ae5323aee00d7d77c55e090c3ed7f6c03ef0e6ff82e84fc0327a57a8893f119e42c14b3358398f4e6facaaa49059a3bcf5d075659c7aabf9f0bf4
SSDEEP 12288:TLgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TLgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C44523BF864C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 88345956f7411b19d9ca2d1c8830d38916c19ccc1628e1328bb6e839cd15b8cb
MD5 f0fa6ce1bdd7b0fe2e7cb2438e73821e
SHA1 a267c85f362fd53333d05e8e5d6b56bfb18dcb5b
SHA512 88842edbcb6c115ebc49c6e1baec85fa1acb1aaf612eb2bde6632733f9fd09e065f172ad9d9e13efc25c1bb327d15ccee5fa00ae2af87be2589089fa730e7023
SSDEEP 12288:/eBNUbTVO86UDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:/JIUDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10865CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bbb7a295cc95e1973dbb1876d019cf1bd5dcb9ac54c59efbecf4d7970258a764
MD5 e91356de7c07a803bb72e88dc8dff640
SHA1 6043ab574db8a9a74f706d41cfc18940d9d0754d
SHA512 c5106ca217ea33bc7e1b5c93430db19c01f10a0b886415ca3cfe4f5a95c8de12bf0ce3efb0d4dd47097cea9276aa286f1fefbcf3de48709be76ca47a287144b5
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THe:SQvGAdlCEL8c/DRNw5CeD527BWG
TLSH
T141266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 9cce7d9bab8c0b5a3eb132f20b80ebec866971963a09cd44a7473deb1c9f5a8c
MD5 25b8db96c7415852974dfda1f05b042a
SHA1 9b034470e9d687999300efee0e4ffc84abe9b5e1
SHA512 f42e511bdd1156fcffb74772ae9434515ead70e3b3bedb6d555c8775530d2ee1c9ee8ba41d8b93c8c59af8fa4fa7d3c7c17278f7b4f6f965300abd3ab1ba90a4
SSDEEP 12288:9AwSfxL/2Dc3RDLLmt0LDQewsAjhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:u0ewsAjhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BE75E031FA74E036C37B0DB60B76D71A582D7A204F6119C3E3E89D9E99702D12736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 064fc84398f20459d46d138377ebad3e53d9083e02a2438e03140f5c2b0452c4
MD5 56a3c10c40b538b664c70bbb34c9b733
SHA1 a304da6529bf4024734f56c1abf88a7d266f68ab
SHA512 b5a4a8938abd62e9eb0c2ff9fccd388de90bfc6c6d5c19c34697a5e3a7a11b9616d84cd195e11a38ce54966cc54178fafb379e10278d3c1e9108da0bfd7fc046
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHtVQBWG:uUEtQevvqc2W1cpV2tI324B
TLSH
T158474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4c5e9380577c9c5d5fcc82e2b6047c09f33ac454ec3052a276f71a623ff5ee55
MD5 6efda803fc39c720e10cede0cfa039c0
SHA1 cf14071b0bc022cacb58a21086b28293cc426f3c
SHA512 c4e3c1dbbe95f6c1fced716cdb4e6d860fe94b2d16b9dcd3b0aa909ffcd4e980fcfb947ee058509e7f227de9a5a69e44b87e5b7ab9d92f34a7cef5490338f960
SSDEEP 49152:yCbRquA/m2yL5zTfFiV+XenmE3/zVDmg27RnWGj:XoquVjnmSD527BWG
TLSH
T194D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 76026cfcbe25e19db261fba1903c5e873d6b98dc5ea7455cfe6c7b6b925bdb03
MD5 228a1d9bd22e0ef620c47358f3ac580b
SHA1 dca7e5d4dc2aefbdc939886262917fa67b4dad7c
SHA512 f63ac7f6e505717df63696cef3c0c6993b5fc14f37338bcc9c9f51701f8717e0e3bf1f67b3771fcc0743f578662e545c844cb3fab224a332a0ecdd9f50e396ef
SSDEEP 24576:sAhGL3IFoiwtA5l7S53esqjnhMgeiCl7G0nehbGZpbD:sAMUFoiq5iDmg27RnWGj
TLSH
T1FB359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 6a32a36ffa66d70448283ecf93559203c6d3b997a5d08ee91987ac378d971a84
MD5 302ca4a1168419a4c480706714bc6920
SHA1 27f54291c6699f97f2465ffae0be1fc360f6d6f9
SHA512 a9b557fcb70abc20981a9fd7bdbb828d0a1b5a23ffbf826d2f316b689c986a41feb6280eb3f4c579a21fb22b0225b90e554189189ca101b34c27b81df197066d
SSDEEP 12288:omw5HEjsChNVBFgl0WDm+CaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Fwu4OWlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13665F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 11b88eb1e692d31ccd6bde2418addd4793eb9016b907b14a0ac286914dd588d2
MD5 82a86b64b8cf9a787c4aa601ee4a49e9
SHA1 ade22b0fc48ea7d039d7a5e761f96ae0d15bd0ec
SHA512 5a4989f064a2c6c09851dab702d27d30eb14d8d6289c1bb2f6c19b97186e8b3290a664e8de3e573c5871ca14167d7564014ab339300cf901cb4df01f0ec9ff28
SSDEEP 12288:neZ1IyxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eZussqjnhMgeiCl7G0nehbGZpbD
TLSH
T18E5512AA239820FAE163417CC5E5D609E7337C62673003CF16625AAA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 212fce671a866f91751283a26ca277dfe857ff91f1fda56e1bf9ebcf06a04c38
MD5 c1915cba860c467027f8967b918daf07
SHA1 4559a54a406de699ef061dbf4f7922959f52c918
SHA512 d8b268945ab8042a931b0d8fd53c7d6f3b44eae0037537d645b942a7e5b2fe1885e10e888da39d8a30fc89e4b4b29a99b9aaf21c73b3e59bd359ffe77d9643fe
SSDEEP 98304:MQRQyi36YOcPbLvw2gAf+PN3LD527BWG:TQyiKa/X+PN7VQBWG
TLSH
T111667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 409882dfbac7b82cd025d1c001fd5e669e5b620bd03abe96db734cbdb4eaacf9
MD5 82b41014115ec0e42105987d6dd987a6
SHA1 1c80aae92da7b10f07a1a658048e942b3f00fe9e
SHA512 92b19d823f5f77a4b35365ec305213c802e124f143ab00414cdef3cb9d6d0237d0b281f1eae4afef2e54a88fded72eb4d721439dc17df1448b1e9c7d3c10368e
SSDEEP 98304:4QRQyi36YOcPbLvw2gAf+PN3LD527BWG:vQyiKa/X+PN7VQBWG
TLSH
T171667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c1dfa504306ce731aae29f96da88d789d71dac805600345fd6f39bac369a5009
MD5 f9a6424c957b7d7d329bd749792d60d6
SHA1 41a728ef6d13693d068bcaf6c016a9e1dbbd5af9
SHA512 61a9447996538c0d6740197302d719384921a8cc33dbf2e36193ef78db8b45aa09917ae1dc2d618bb592685f5e320448b05c085f7a7da58d9b9e74d1e71623cd
SSDEEP 24576:ZwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0csqjnhMgeiCl7Ge:F68Qg55nhceWu7PNU3/lDmg27RnWGj
TLSH
T188B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6044159fc0a43eb0ac61c7357c09358f0904bb1a1d9b649a7ccba8343c2b8431
MD5 c4b85721f1aadd43270e05d2c079b0a1
SHA1 e1dac7638576d14573e7da490d34492370367832
SHA512 7667f6e3ccce3f9695fecad34f3da2800cd34a5c421ed7ea079d3b877789928da63112ddc0e5cc63d25ce9cb89f4867cf96bf68f63547377aca6e4d60d9c1a51
SSDEEP 98304:Yy5112gYy5azzVvt69nLKnhZcD527BWG:xLIHEWhKVQBWG
TLSH
T180167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 efbdd17e4fee6fa1cc70da360ae72357a9f81da5312ec80646eb9bcac8ab280e
MD5 47de15af006f99977167dd45af6e035d
SHA1 0c88b7b90b36c6938d4747546afd3b63aafc71b4
SHA512 48c5c033805b4b3e483eee830bcf13965bd3413ca689103a1fb23d974a46ffbc521b7db5271b62a03478686385162a541d116b3cf20e93481bb664fc5043423e
SSDEEP 49152:6B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glTDmg27RnWGj:ou6Jmdxd2dTD527BWG
TLSH
T18AD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cf8b04a7071b5db5b51d314b45e9a64009c1d4af9814c9ef8a5fee9081e62a0b
MD5 484226a87c59f858f4c0a8f5e526061c
SHA1 5430b360387c3fce23dcaa5f849d6deda284bd78
SHA512 87df26486187ac081c4f106e2332b85c9eff016378a7e0341a2c8a82ae52be4d2daccc1db24d7b30f626223b42b4d6b82193022d224d3aa3cc07c2ed204286b7
SSDEEP 49152:91hpsNoJpF1A63U44CwH7R4xnDmg27RnWGj:9mifPWRSD527BWG
TLSH
T18DB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8005daf0e43f77a2c58f31193ab41965e880df3f7405578be13a0ed80fccaeb9
MD5 4398f047a2e1248f9b22803082ab2d91
SHA1 4bd4a2dcf0b0ae7a3a5e6f823bab4838c3d283b3
SHA512 d0c32ea1db19f6a4c58c96ce63517e2fdc1b4dd1ee754acdfacec7d4f7ecd41ec9fdfe5c47cd9aaf9c6d0cf25a7111bc1f5fc0d60cb4e97c35f563708136d863
SSDEEP 49152:DSuZQIY0Be2KcRVtOnks6NMHqYDmg27RnWGj:h5dKii61YD527BWG
TLSH
T1E9C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 37a21bd9830453919b2adf8b766c30f28df39822a9de3acdb4d1cfd38d88396d
MD5 202b637d4721df9ef037fc9df5c76567
SHA1 eb0bec7c4c1d571585509a7d5c9b6aa91c6f24e9
SHA512 c479abbcf94f656af5c5cfb1bcb5414e5a9d87d3e568cfb05fc0412b2fc4e09360e885124fbb1e183d82b69f2026c51cc625d67e11d355a96d926d7eee8dd5f5
SSDEEP 49152:IhtSn8EApI0fig3giDn0AP5wjDmg27RnWGj:ZX2imphWD527BWG
TLSH
T1A695BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 97d21ecdc097cbe7f4df8bb174fbceba09b23c1088508e853c0701d3dd0bf5c0
MD5 d627573d278bff4a1bafb1ad84df688f
SHA1 b87284c7fb2b638aaa1dc999e3c46ec8afa2a445
SHA512 73708de59f99835e0718b64f62388409e51e994d42aafa06998d8c0090cea771a939127fddb459e797cd0d7df90b4c39419a26ade0170b8b056b6397e6f73ce4
SSDEEP 12288:tYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14F4523BF965C41CAE52648B5C3E5F10EAC073E5BE92004937A977CB9FBB14984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e32b4808f0257ceab0d67234dcefa9aca5bb72610fc19d1bc516b03fd1597624
MD5 8d07316b39fdc0485b70a58be628b773
SHA1 cd7bbf9d57818288e7d6d023bf34dd644223aca3
SHA512 d2e4c7be255c7811e24b47041b939e3cadb021c909a81b240ec79cc6a468434d45e6c9e0f73cbafe3e010a2e763dd5f446da4e8ba4657cf70d2840d8af101cdd
SSDEEP 12288:ttXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ttsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CA4523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A977CBAFBB14984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6e52c04b8c0daa2fd12d2e9e462c7e45ee2ef110bad679f6ba8160b173ed8e3a
MD5 0cbdf88aa6077d0cde6a3c6cf9d308c0
SHA1 b7ad50068c01cabd6f19343566bcbdfd525179d9
SHA512 dd618ec9270abaad25a4e66d99ae422845a1a63e4d0ad1dad19bbb23e96169cb240874cbde23a1db4fc6678ab823c464a7e741fc0e71b4a34c22002583e5a71d
SSDEEP 12288:j7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:j7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D04523BF965C41CBE52608B5C3E6F10DAC073E5BE9200493BA977CBDFAB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 78a667403c67718c2cd2decc2c48e911f810d89264b3004d2953b027220e1c88
MD5 827db630de353681a10b3e467ab35716
SHA1 d3fb39ea83fa1712f4455026658d1c2b2e1e7986
SHA512 9367c12b80414ec0b0086bd3bc36fb63f3bd91aebb2e453468979c41f21363850bb58f829826e1445d1063e9b89cbf7464bb6ed0b02b610b33f639015d50028b
SSDEEP 12288:bV+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D745237B635C00CAD83685B4C2F5E11DE8237D96EB3005DB6B532CAE5FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7f41b19b86a6b3b70b0c9108d6df274df30a39b5cfb94ef268b25f5688910fde
MD5 0912a285d93ddba4a5ce327f90b5ddcd
SHA1 b6b26162a1158f901e73dc8dd006d8809f0a041b
SHA512 093e22f3ae7586f3efcd47c34094fb87d8b28395a56c727f335852a33f9bf4ae2eb7977164fe7be395a028060916215451065583db2a197b971d366c950c0f3b
SSDEEP 12288:VmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1794523BF965C41CAE52608B5C3E6F14DAC073E5BE92004837A9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ac36e39473f7fb9bf9481460c27fd0df57e3666c40e4c82a44a8a3fd4c7dbf2c
MD5 176920922aeb964ff93b74f571f51849
SHA1 a632564ee153ee4dea829ebabb35cdd8951279ec
SHA512 3aa3d7b3ed1b20a50c014633e611e4285b0ccf919f2a329dbc0a5cd34d3229517a056f330e51ed380dd247382539411d4469dd9983d6c50552062598357af41b
SSDEEP 12288:e5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:e5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1914523BE965C41CBE52648B5C3E5F10DAC073E6BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c580e00dac097ad88408dd024b5851bf8c4dfc431a86a19fe781e22b41114cd0
MD5 8204dab3f21a896341173c7a25bbbbbf
SHA1 65d864488609510f5e765ec64f8e9b2bc5ed59c3
SHA512 6735abedd8c76c42c07677b2836023071be096c287a6ebc2245a14153cd114c9224ba0fc07398a2754997bb8e2a6451a61df4b05f01db866f30c312f69d6e085
SSDEEP 12288:2VXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2VsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BD4523BF965C41CAE52604B5C3E5F11DAC073E5BE92004937AA7BCB9FBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 d41628e8c3416e6ba102f67ccda9122c183b93f300979ae81081647c96aeb856
MD5 7fe70d296cca8932bae88943f2605df0
SHA1 75ca6acc6ba228c26c3873d4a0d075911bbc98f7
SHA512 8b3fd4a3f7f3ae470388ea2ad144fb91f6987109f15bf4ab9e775acfdac80c976d8f5f30bf20e9f8cf012ffa54589b6abc207515818f4a059598717fdf75e2db
SSDEEP 24576:IZMRzFVSONsqjnhMgeiCl7G0nehbGZpbD:IZMRzfNDmg27RnWGj
TLSH
T18E6501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 79854e33fe4fbd4fecd9fb8ce68bdf5a05270956d827c4da7e3530b1cbc4e83a
MD5 0828951d77b37b1134d39b8acc974b51
SHA1 d3cf8b1e4d047bb3c117633a352805765f47924a
SHA512 dcb4c73aafba9050e8cd132afe3d858083f239ad493ebb2ff2b7f08efb9838ebd0fe0a362249ee82e75353217aafeac98157e583ce2813ea862189bfcafd1299
SSDEEP 12288:58Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:58sqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B4523BF965C41CAE62608B5C3E5F11DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b0fc86139b8cdc3f4da6e994da2e3a8eae780a7cbf465eab109a4720de2131e2
MD5 0d0b8f5d1b9280b435c6e18066b438c8
SHA1 9f1f8c1cb753eab221d8bf25d1ccac40babe702a
SHA512 f597fd0ceeb0f272e948a8e7c58ce672d6e99ea90bf73975d9e7eb62b229998452c0a54d7fd769b8dd13c3cd79a3ae55dd4bb830810c9d58bb9cd4ad2d9ff4c5
SSDEEP 12288:2wXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2wsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EC4523BF965C41CAE62608B5C3E5F11DAC173E5BE92004837A9B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 bfa78dd4d8e246d0d2161c3ea48b3fa9130042be08d3f86fd4b1501f894cfdcd
MD5 ba89ec3f8914a43b9821345841434cc2
SHA1 708130c983b9f87115fa6745e303c66e17849822
SHA512 15533ecd2192d633ce78b6379254ecbe7114cb5156446cb4de1818288fe89f97a193b95056fa8aad9572268d0ad91e3ef3c6658e399d1fbf76b6af8c55caaa7a
SSDEEP 12288:KyPz5L8xXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XzyxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18155125B73A530F9D1368178C5A29A06F7327C3647204A9F17A116BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 86a90d0a518241ab0061563475b8fe222e90c7c9c4f0003e312bed9cdb20f29d
MD5 07b30fe562ecb3eb0e8329d5d064a2c5
SHA1 12f8ebcbb423f4895d1a5735dba40c1d1edb12cd
SHA512 806df21cc36c5695ae962705fd574f9c8c94f73ee8aaa0db1532c2e645affb63364f033021a46063f696fd9109a89f74c816da05d4f33c32008689ec344c628e
SSDEEP 12288:Q8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Q8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1304523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 5f7ab16c1c7b4fd1d1ac6b16fce35c2c972fef6ce6f715918bbd254ef3349e21
MD5 3036c318435326fef4797487e92157e3
SHA1 ffa64691238ff4d945fb673005cee4a373101eae
SHA512 112a257ceb258953440664d0462167513bf423f0fc579daf2b287d2088b50620434e112eb7072e8bab65d1a53e15454dd258b329c13acec666ddf05531ec1c3e
SSDEEP 12288:v8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:v8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10C4523BFA65C41CAE52608B5C3E5F15DAC073E5BE92004837A977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 ddf65fefa99daad938bc2f134944183e36dd728dc1a7c585fab1d34b83ba80e5
MD5 3c8880c974394f89a6d909dccda8f70b
SHA1 eecfb41ae6d95362d16ef6d224ddab91f523078e
SHA512 89eb3aeee735dbbe69c968670a48020a77c779f1a9a7b32ab952cc0fc2d4ce6f4b44e018cb2a76d97ae38d86bb007995c4841d5eccb6dc2d6a5c65850960b7b7
SSDEEP 12288:myPz5L8xXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bzyxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AC55125B73A530F9D1378178C5A29A06F7327C3647204A9F17A116BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 64573e1272448aaff0de6e2ca7cb32db2e277241fac3fee9014628e404598d5f
MD5 60f3cf45d94c97cd13c1ff1b34e5a96e
SHA1 cbd1add5f108369a03d2cba53dd75ed7468b3890
SHA512 5d9b7165a8c1541acdc2f99fe45ccb1112f819669edd95133027faa71ccafe424219a7704bef1813de1303ff8927ba8cd06d72d767c5ec491973a9610b99d010
SSDEEP 24576:PTDaLl3z0zDrsqjnhMgeiCl7G0nehbGZpbD:PTuLljODmg27RnWGj
TLSH
T1E16501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 b86cfa877eb4bb7984a85b4941b3b9e9971d8fd90ec21bce2bf41e87a5a6b044
MD5 1dba3df0121611ad3c40b385b8735174
SHA1 2fb7ec588556db24fb7693d158b5fd5ebf9e1998
SHA512 5bab71e1feab6fbe17becaab8f3b2300c3cdaa4eb44acbcdb7f5df0dd6de65a651df2e3af77fb694f39e233067ce992206774e64f0e7385104b0813060701d7f
SSDEEP 24576:i3vd9CHKy7GZXsqjnhMgeiCl7G0nehbGZpbD:Evd9CHKyaNDmg27RnWGj
TLSH
T19975CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 e65667792d39883c4537003e6dd8889f783bb4a07f59c016890d1ee38d5f7da7
MD5 5bf92d4d511f8afabc293d1fa2d81a2f
SHA1 6009e8444743f65a26bd21af0c10780f5b99f0ae
SHA512 7c9d5b2feb465505249019e1a6f955495ad32bb7b224acdb4f114382cd1a0594f2abafec5d4345bb4561bebd01b1258dd301337c79a0485978d307136e4a9fcc
SSDEEP 12288:XbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E14523BF965C41CAE52608B5C3E5F10EAC073E6BE92004937A977CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 15ea8e761dfd3fdd3729d5b29371e5bc797bbf4f2eeff761539011a68dd75cfd
MD5 5004de104faf24cea51b85201bd4bc1e
SHA1 29482f138dce4d9b209ec61587458d1e3f77fd14
SHA512 79c6bc26e6f7a4267edc6600a087cac70f0b5e9ee8074b98b7063b790d4aa5854f161d873601985f2d101ab8e61f51ef6d6df0ad5681551d5783e3bee7920ff1
SSDEEP 12288:QRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1444523BE965C41DBE52644F5C3E9E10DAC073E5BE92004837A977CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 028ba2f25f967ef3abbeb299c5de8d2df0b9e0089ee5dd448ec5439e734838a9
MD5 ca710b9fb2b1aabd97e0e2cbec44bd49
SHA1 c8dad66e3804e5d7dcd5e73f6c21069ccf5113cc
SHA512 cc9b1a602cee523d7f6e3266c9d59d8918a86c6997bef0c2f3673bf6377c63db95509570f43cb55a20506a49cda23a1bcf6ed12f723281f6a755b98123215ebd
SSDEEP 12288:uiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CC4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA977CBDFAB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 85b471eb8eca359d989f9fbd6fbb49acedf6c07115da89987d3b707bf0038c6e
MD5 818c1a7867d74c06a717827c6e10541b
SHA1 45c507819cdf639622789e082f9f0502820db873
SHA512 b39539f98045a8a07abe157b423b526ad073b1832347e3d71ad19af2b1b6bef81f471bafe77b6d0bebccb29df7f63ca59196733da1271cc3ecf4c11cb92bf32a
SSDEEP 12288:i8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:i8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15B4523BF965C41CAE52608B5C3E5F15DAC073E5BE92004837A977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 4a51e8cbbfd86842c5048088ee5c158491f60aaedd44b94a6d84d490730be1a8
MD5 157f03a2ba3ef1ff6b29378a9f8c989b
SHA1 4504541039388354a4d16ae8771674dde3a0577b
SHA512 f8f0151bdc7c68fd9ce04162349b7708791a0c02989a2b02da0f08836c4e6f82535ab18cac816654f31cb7c9c9afef7450e3fb2a975a2258bfa8c35de91fcac5
SSDEEP 12288:ibXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ibsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11B4523BF965C41CAE52608B5C3E6F14EAC073E5BE92004837A977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 a5c1547ff06f8f5ee90208fc565f3e089abd8a671513d02a50c6785442b1c42c
MD5 0ca5ff0c3f7114f33caa608c0dad5dcc
SHA1 e39f9f31c25ce5917f22c8affe8997104ea05708
SHA512 cd3abc15c6d6487e4c56644a522decce9b3aae3ab3632cf1de6622589a884610a0438bf78f5ba0a457354873170697deee52dcefe79804ec28339d2d8abbd642
SSDEEP 12288:KEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17F4523BE965C41CAE52648F5C3E5F11EAC073E5BE92004837A977CBEEBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 e30407866c41308d1c59e085b0fd40dff02b01c4768c1dc9705ec7df3e8059c0
MD5 0b1ead714aff29797a3c332554e17178
SHA1 f56ad7be05312b4926a1288fc1760a5404ddc57b
SHA512 0ffb09eae67061286ab128fe94a953daaac969954cc91eb16664600a4ec1aed441a31e6e8b79599e3ab77f71ea5e4f5cf8deffb77d4ab53fd67da61fbebd5856
SSDEEP 12288:9mXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9msqjnhMgeiCl7G0nehbGZpbD
TLSH
T1604523BF965C41CAE52608B5C3E6F14DAC073E6BE92004837A977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 180f4aeff3ca78a6731d0435c9f28fc1bc3b578c9b7a1b730147ac5ab160acef
MD5 8035d5c38758c1714c57ad244511e76c
SHA1 99394fefd4259b03e6190c6e435ca5507aa4dc5a
SHA512 3a1124ac7a220b3280d58157ef7955122c35991606a69b05b7656ca3bc9c4ca0f8e75bacfa8bc7d8b8dd3c6c7f3ff835f5deef2765b59891292f946286500deb
SSDEEP 12288:mTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E34523BE965C41CAE62648F5C3E5F11DAC073E5BE92004837A977CBDEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 96e50d1014053936495c82d4ae913c1f217106213b4f93a704a909c1ae957664
MD5 91d1d054119bda4d4d96cd59f52ed4a1
SHA1 0a89564a90a8fc11ec84949f0bfc1c42cd9d57b1
SHA512 4155a74a6fe67c672fd9a8b886ac40197388263cef6274c189b8310b94a2ebe939d869a4b191d3671ac003892c36c230c2587fe6e52eed2ff945792edd9f59ce
SSDEEP 12288:6mXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6msqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A54523BFA65C41CAE52608B5C3E6F15DAC073E5BE92004837A977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 da406810c6f85468c04f9384ca17d66a73687b198532d67d5d6eb855b10edac6
MD5 a6827e413e2330873cf4cceec1850330
SHA1 b3b912ef13dce4d8bd04f2d20dbbcdc7ba42fa2f
SHA512 b8029ebb1b3acbb47883ab4e0340e51cd805198dc192c4e3b5ae8a8e5883837de6b9d9753763dadaaad654c2f1ed61f4c69ce776ca628e22a984f0868bddc1f4
SSDEEP 24576:KfwvUk9RX6wkyAIAsqjnhMgeiCl7G0nehbGZpbD:aMnYI8Dmg27RnWGj
TLSH
T10985D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 70b58c29d8b9a13084a4b030bcc8c609bde1536dffa46c891ddd95fc2bb95455
MD5 270e05c24f7a6082b92f4101a6069b1d
SHA1 f0d42835d2127bbd9e2c039bf137bb8285a70b59
SHA512 80d93862fa3f6b03a2a997794d15666b8f26314b32e70876a90afe97960b08b23dce9de5cbc738f967894bf61aee3f7711e461ea3b0529169c974757ec87c5ba
SSDEEP 49152:RYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0DDmg27RnWGj:8ySzPrD527BWG
TLSH
T1E7066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 afe18c51d890b0afc0a9db482ec6f3facff7620b6727025290385791f0911bf5
MD5 0b3c2e7f5a28dfe9924137d3305d290c
SHA1 ca3196c46acc14adfe2bb7bb0ed5504b28cfbe23
SHA512 7e8c6bf7c3f320552133be016f218096f692e1dff6c2a6a0542bcca1b0d47c5f50c89f9e5eb3d8ac78c69115bcb5f515c2971a33d3ae90cbfc58e580335bd397
SSDEEP 24576:c47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYdsqjnhMgeiCl7G0nehbGZpbD:c47JUQjTirIhCnDHUPfF/TDmg27RnWGj
TLSH
T15C65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 ffcffcaa8ab19bbf2552e9470bc665d0ce71365dc273381196024ed5e6d3a76f
MD5 244625eda4b09c0526afd57cdd86be54
SHA1 c6934eac317fcc9d9a1e05984ecac850b90a29c7
SHA512 7aea3054dcfa9f4295ccabe347be97d0cf6c1e5a8ed66758ee5265c73d9b92068fe29a808ef110e64b1f91db6af26dd414f7873dd0b24b2fb201e880c11aa8df
SSDEEP 12288:jbsfsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2ssqjnhMgeiCl7G0nehbGZpbD
TLSH
T13355015AD29802D8C06E5179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 a5da6251e0b6c45b3e6c6ab534ea5eb1756db22e370d2d386caeb2e0eccd475d
MD5 64066e6e23ace724c7211d32efc97a86
SHA1 0e402c6c51968b055d9c941b03b89db7926a30f3
SHA512 5bb5e8149b704aa23b3f00cd557c8d3fb666ec57b4a7922e70fd0ebdb3f13d5ba3a77a74e33f322456bd61f3133db57a258b2528c0437ddbcde0c456869941cb
SSDEEP 12288:udzaQvKU3fuv6uJ1Wyy8mc9JI3sZmAYWDXOpT0xGL/CvNp5Kp:udzabUPWJTe3ssroXQGGDCvTMp
TLSH
T19D4507417626DB4FC6A940325E36D6CCA7707D02EE089F0773C9473F947665ABAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 f513529c736256befeec0714bd79d3f09505d7a5259e2ab65c938f098d8cb673
MD5 8673a68ac1500b33ab5a91de5ab73d2a
SHA1 0f0edfe2ac9d10b85c89df4d9cf81eff31e0f7ab
SHA512 6528a05095411a8aeb400d92835354fa20729272691ff72c231a101dba939df5fff5220e2983f267b7b992b2b3c500a73ccef01c6d94cd5e6a3484334f0337ea
SSDEEP 3:OlH/lnYl7/+gllgsl7/i5o/Rl3y8jK63mCllltGlslslslslslsl6z9b/:Kal7l/L7ieVKcmCtEEEEEEEKb/
TLSH
T1A081926C8B800722CB61A9B18A29236E0315D54371E8CBDB120A28A19D112940C11F29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 27daa27840397310fb0e852434c03bdbbf1f81bcfc7115eb7896a9990a115b08
MD5 e1b78ef1991c8d922b94e9c43eb51be5
SHA1 bd67b1a4e5555b266ea82dc3d580d3ad3449074c
SHA512 348cd083b809fb22b070e0f88f3aac5c778fa589ddd1c0708a53ab6c747f31b39680b6da0d24bd09b3e02840ebf1ae9f8798ec729d753f5c2713c024dac517ab
SSDEEP 12288:ND/r7p4528DSOdXCEa5vAOCLx1aqSLJRzyLobjmAmmEeZilago+NbLtIFv+3rlKR:ND/r4ZOkSb2F8zyLo+yEwiD383bIGju0
TLSH
T19F651800A5B7EB4FC97A9037423286CDAB786C07F7452F05734589389867A6FB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 eb77f161ac6fe9d010a03e38155fd6948b84d57c366c02a5fb5fde90e666f8ec
MD5 b355abfb7d7726198c689a4f41d22ec7
SHA1 d1ea2026c6b77d6e516f5030c6b455cfb6270ca9
SHA512 7adbdbd634962836ab84892e56d8372af9e0bdc8a6a35d28003bee52c71eb5bdb9a2b8796bda62f7d4463050184242e956fa0373dfcf22bcab8515a12d168a93
SSDEEP 12288:5070Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:q0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19945237B934C518AF93605B482EAE12DA81B7E669F1044C3B95378FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2436a094a51a7042c31df126da201e6e7ac4ee7e2ba586894167ac84d20b52e4
MD5 27d2c5b2cd1c1e014656574d43986cbd
SHA1 81647590df3031aee740e7d07353b6d6601b70e7
SHA512 99fff3f2420232375d8d3ca671681ebc5595716640162e427b8a8bfbc8bbe714ee8bc738bf368aed3835b79303fbe8e3f907e1064d3186846a0fada7d47a7f31
SSDEEP 24576:2gb6bmBIi49WNNFpg1rSvFv7bY6sqjnhMgeiCl7G0nehbGZpbD:2gb4mBIBhGFBDmg27RnWGj
TLSH
T108659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 ee7a3c7c8bfa6a0457064aa79740faca657dd2c0f405c590e48d017bb71f5ac4
MD5 0d302d36d3351603904781fc8adbcaf3
SHA1 94a77020e865bd1c7f324b5f3017a7459029d5d3
SHA512 ba8df04d273cf5fe049a7521c5348094895dd1380fb8821e7d521e7b8fa31e43b4eed64d022e1c71b84c954ec33cb8389690f69f11f44a56985b738cdd1727fa
SSDEEP 24576:qG88u8FpJqH1bzria7/mNsqjnhMgeiCl7G0nehbGZpbD:R7ZFPqVea7/GDmg27RnWGj
TLSH
T11885016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 64bd528659222926bf5a61b22eb849e297a324cf94db703271d42aede9fd0713
MD5 d22fc37148cd23eb645a2d500ed115de
SHA1 461a2a82209c8dbea70139d5ada798ce3463a771
SHA512 93cbbd7b2791156c1aef280bd25d90fc67b5df0b74035bce90a959f3c915d51f89fa7cfc65d9a7c9392c307f76bb7e4c87e093e03d83b4032a3dabce4e4e540f
SSDEEP 12288:MHvUrBFrEjwaQJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:MPUr+NQJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12065F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8c67d1f04374ae767363a68ce0152e5f0d23c0e66828375f338b7bacb4859dce
MD5 ace2f549aeed9382c6104ae4f6568abc
SHA1 80962f91211c86b2b7eab5798c22ce955613016d
SHA512 16f65f090558142878e7b1fde582a5e9bb2b578d4a54ff5b254bf300ae7b28e1f196b1145d1b8088d2c2ca737712e1f2d07f4292b617aa4ca75a115d10153a84
SSDEEP 49152:eBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj9Dmg27RnWGj:hG05lO43bUD527BWG
TLSH
T128D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d66036418296920507beb837cda4260b24b378072d0ca352ad9cce5e73157418
MD5 18c54ec868c0d9252fea492f681dc347
SHA1 2c92d07d6b19ec839237dc782cbf2d8987bb0069
SHA512 47d3698093a56f33a2228b972d83c132e31c995c674697a250780a0899cfae112ccf396093117400a49d21cefe37dabfc1e876e72b0decbdf79e7861415097f0
SSDEEP 24576:Rfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnfsqjnhMgeiCl7G0nehbGZpbD:xa5POZ3BJt2pasx2+mlDmg27RnWGj
TLSH
T1A665BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 52827391cce6244e95a9cabd92209f607046fabde222855de9d9584d6c3d6826
MD5 f0f0a8bb0e4ed2e9471b18342e9190b5
SHA1 f97e01a739d34e2bddb234c71a985b23ca7bc554
SHA512 22fded16f8644e2824f31e8079ef0a7ed4aa40d9764b31b11dab9d7a12a161a8342cd6092521e82186de2936159c5dc00b4f6859661b8bf46653d670024a28c1
SSDEEP 24576:XNcwHdjbyQ4nLC18lb/EOjowL7FkFsqjnhMgeiCl7G0nehbGZpbD:XNc/zEOVHFmDmg27RnWGj
TLSH
T125857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4b4c87ebe474686513bb7e10bb021c03a6726274bab784714c40c2fd0cf3ac5a
MD5 1f722ff3e483f7759e1a7e1b113b6aab
SHA1 6777227339a417b2a354fa940efbad01ba3d6dd4
SHA512 899786fa2aac343004c58adad1ecc19465515ca2c19b925537006c2f3667c09c2295d5108bc7f8b47059f794a8941be4d541c16bc48f9affe9c4b7c44dc93b8e
SSDEEP 24576:9TkNvNnaFeYhJNtmZBmTsqjnhMgeiCl7G0nehbGZpbD:9TMwBtOmXDmg27RnWGj
TLSH
T16855AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 26ac1d2d50d0bfeeda6df8e40630be3789b67781fb99298025d6fa8d7be6e9b3
MD5 8efb34a6653739c23bf54bbdf7549503
SHA1 3de2bb0fd9125cb8f0d76b1b6de0f21d36c4f83a
SHA512 aa21e261470447b270d4e8bbac7ad4b4d9b47ee40456c820e99aad0a2f2d4aadaa46c7e0579692a966bbb14ed9b398e87bd1de0f94899c0336c8c76a0b48da96
SSDEEP 24576:pD3FHshBIYQgA4sqjnhMgeiCl7G0nehbGZpbD:pDVHeBIAAkDmg27RnWGj
TLSH
T1A675E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/876-392-0x000001EC26A80000-0x000001EC27100000-memory.dmp

Download

memory/876-373-0x000001EC26A80000-0x000001EC27100000-memory.dmp

Download

memory/952-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/952-14-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/952-20-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/952-21-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/952-81-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1956-89-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1956-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1956-355-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1956-376-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1956-82-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1956-375-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2720-361-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2720-107-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2720-114-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2720-113-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2748-267-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2748-73-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2748-67-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2748-66-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3356-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3356-137-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3356-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3356-362-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3408-52-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/3408-54-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3408-38-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/3408-46-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3408-47-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/3520-266-0x0000000000400000-0x00000000005EF000-memory.dmp

Download

memory/3520-77-0x0000000000400000-0x00000000005EF000-memory.dmp

Download

memory/3520-0-0x0000000000400000-0x00000000005EF000-memory.dmp

Download

memory/3520-1-0x0000000000CB0000-0x0000000000D17000-memory.dmp

Download

memory/3520-6-0x0000000000CB0000-0x0000000000D17000-memory.dmp

Download

memory/3520-8-0x0000000000CB0000-0x0000000000D17000-memory.dmp

Download

memory/3920-342-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3920-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4344-127-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4344-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4344-131-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4344-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4344-121-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4524-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4524-359-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4524-94-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4524-101-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4524-357-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4524-360-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4864-50-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4864-227-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4864-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4864-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5928-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5928-119-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5928-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5928-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5928-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download