Analysis
- max time kernel
44s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/11/2026, 04:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
31 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
29 signatures
150 seconds
General
- Target 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 3.1MB
- Sample261114-e2p72avw4j
- SHA256 f8f7e72d3084662f0a48b0718efd168de48faea33c4dea1ca80d80b724aad61c
- MD5 580a42224aeefc7fe53705abc06f155a
- SHA1 8827f07b6fac2a2e34797630e902286d868b7af5
- SHA512 6a83b11cdc6e59c6cea7d8d6eb71fedf695bbe4b1ab11f6cef2b53dda1919d882788ce74e582009e0865d26fd6095427b21773c5a048c424ccb0e784b1397a81
- SSDEEP 49152:LV4EDnhm2RssmofSmcEDnhm2RssmofS5nlvI77FWyl:J4EDnI2vmMSmcEDnI2vmMSPhW
- TLSH T162E523506988E0B3FA51D8F13D1A51B9CB6F6C625C67C623E500B4E76FBE8C2292D1C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe - UAC bypass 3 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" CacheMgr.exe - Custom signatureDetects Reflective DLL injection artifacts 4 IoCs
resource yara_rule behavioral2/memory/1832-31-0x0000000004680000-0x0000000004696000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral2/memory/1832-88-0x0000000004680000-0x0000000004696000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral2/memory/3056-84-0x00000000033A0000-0x00000000033B6000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader behavioral2/memory/3056-232-0x00000000033A0000-0x00000000033B6000-memory.dmp INDICATOR_SUSPICIOUS_ReflectiveLoader - Custom signatureDetects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 31 IoCs
resource yara_rule behavioral2/memory/1832-20-0x0000000002E10000-0x0000000003ECA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1832-26-0x0000000002E10000-0x0000000003ECA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1832-27-0x0000000002E10000-0x0000000003ECA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1832-23-0x0000000002E10000-0x0000000003ECA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1832-28-0x0000000002E10000-0x0000000003ECA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1832-21-0x0000000002E10000-0x0000000003ECA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1832-22-0x0000000002E10000-0x0000000003ECA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1832-25-0x0000000002E10000-0x0000000003ECA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1832-24-0x0000000002E10000-0x0000000003ECA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1832-29-0x0000000002E10000-0x0000000003ECA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1832-43-0x0000000002E10000-0x0000000003ECA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1832-44-0x0000000002E10000-0x0000000003ECA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1832-46-0x0000000002E10000-0x0000000003ECA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3056-300-0x00000000049D0000-0x0000000005A8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3056-298-0x00000000049D0000-0x0000000005A8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3056-302-0x00000000049D0000-0x0000000005A8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3056-303-0x00000000049D0000-0x0000000005A8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3056-305-0x00000000049D0000-0x0000000005A8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3056-307-0x00000000049D0000-0x0000000005A8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3056-309-0x00000000049D0000-0x0000000005A8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3056-310-0x00000000049D0000-0x0000000005A8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3056-311-0x00000000049D0000-0x0000000005A8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3056-314-0x00000000049D0000-0x0000000005A8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3056-335-0x00000000049D0000-0x0000000005A8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3056-338-0x00000000049D0000-0x0000000005A8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3056-362-0x00000000049D0000-0x0000000005A8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3056-373-0x00000000049D0000-0x0000000005A8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3056-380-0x00000000049D0000-0x0000000005A8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3056-381-0x00000000049D0000-0x0000000005A8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3056-398-0x00000000049D0000-0x0000000005A8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3056-400-0x00000000049D0000-0x0000000005A8A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - Custom signatureUPX dump on OEP (original entry point) 33 IoCs
resource yara_rule behavioral2/memory/1832-20-0x0000000002E10000-0x0000000003ECA000-memory.dmp UPX behavioral2/memory/1832-26-0x0000000002E10000-0x0000000003ECA000-memory.dmp UPX behavioral2/memory/1832-27-0x0000000002E10000-0x0000000003ECA000-memory.dmp UPX behavioral2/memory/1832-23-0x0000000002E10000-0x0000000003ECA000-memory.dmp UPX behavioral2/memory/1832-28-0x0000000002E10000-0x0000000003ECA000-memory.dmp UPX behavioral2/memory/1832-21-0x0000000002E10000-0x0000000003ECA000-memory.dmp UPX behavioral2/memory/1832-22-0x0000000002E10000-0x0000000003ECA000-memory.dmp UPX behavioral2/memory/1832-25-0x0000000002E10000-0x0000000003ECA000-memory.dmp UPX behavioral2/memory/1832-24-0x0000000002E10000-0x0000000003ECA000-memory.dmp UPX behavioral2/memory/1832-29-0x0000000002E10000-0x0000000003ECA000-memory.dmp UPX behavioral2/memory/1832-43-0x0000000002E10000-0x0000000003ECA000-memory.dmp UPX behavioral2/memory/1832-44-0x0000000002E10000-0x0000000003ECA000-memory.dmp UPX behavioral2/memory/1832-87-0x0000000000400000-0x0000000000612000-memory.dmp UPX behavioral2/memory/1832-46-0x0000000002E10000-0x0000000003ECA000-memory.dmp UPX behavioral2/memory/3056-300-0x00000000049D0000-0x0000000005A8A000-memory.dmp UPX behavioral2/memory/3056-298-0x00000000049D0000-0x0000000005A8A000-memory.dmp UPX behavioral2/memory/3056-302-0x00000000049D0000-0x0000000005A8A000-memory.dmp UPX behavioral2/memory/3056-303-0x00000000049D0000-0x0000000005A8A000-memory.dmp UPX behavioral2/memory/3056-305-0x00000000049D0000-0x0000000005A8A000-memory.dmp UPX behavioral2/memory/3056-307-0x00000000049D0000-0x0000000005A8A000-memory.dmp UPX behavioral2/memory/3056-309-0x00000000049D0000-0x0000000005A8A000-memory.dmp UPX behavioral2/memory/3056-310-0x00000000049D0000-0x0000000005A8A000-memory.dmp UPX behavioral2/memory/3056-311-0x00000000049D0000-0x0000000005A8A000-memory.dmp UPX behavioral2/memory/3056-314-0x00000000049D0000-0x0000000005A8A000-memory.dmp UPX behavioral2/memory/3056-335-0x00000000049D0000-0x0000000005A8A000-memory.dmp UPX behavioral2/memory/3056-338-0x00000000049D0000-0x0000000005A8A000-memory.dmp UPX behavioral2/memory/3056-362-0x00000000049D0000-0x0000000005A8A000-memory.dmp UPX behavioral2/memory/3056-373-0x00000000049D0000-0x0000000005A8A000-memory.dmp UPX behavioral2/memory/3056-380-0x00000000049D0000-0x0000000005A8A000-memory.dmp UPX behavioral2/memory/3056-381-0x00000000049D0000-0x0000000005A8A000-memory.dmp UPX behavioral2/memory/3056-398-0x00000000049D0000-0x0000000005A8A000-memory.dmp UPX behavioral2/memory/3056-400-0x00000000049D0000-0x0000000005A8A000-memory.dmp UPX behavioral2/memory/3056-494-0x0000000000400000-0x0000000000612000-memory.dmp UPX - Executes dropped EXE 11 IoCs
pid Process 3056 CacheMgr.exe 3084 elevation_service.exe 2808 maintenanceservice.exe 6036 OSE.EXE 2204 PerceptionSimulationService.exe 5320 perfhost.exe 3392 ReFsDedupSvc.exe 4524 SensorDataService.exe 4412 ssh-agent.exe 824 AgentService.exe 2620 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security bypass 2 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe - Windows security modification 2 TTPs 14 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" CacheMgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc CacheMgr.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\StubPath = "\"C:\\ProgramData\\CacheMgr.exe\" -as" 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" CacheMgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe - Enumerates connected drives 3 TTPs 53 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\D: CacheMgr.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\I: CacheMgr.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\J: CacheMgr.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\H: CacheMgr.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\G: CacheMgr.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe - Drops file in System32 directory 28 IoCs
description ioc Process File opened for modification C:\Windows\System32\snmptrap.exe CacheMgr.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe CacheMgr.exe File opened for modification C:\Windows\system32\wbengine.exe CacheMgr.exe File opened for modification C:\Windows\system32\AppVClient.exe CacheMgr.exe File opened for modification C:\Windows\System32\msdtc.exe CacheMgr.exe File opened for modification C:\Windows\SysWow64\perfhost.exe CacheMgr.exe File opened for modification C:\Windows\system32\locator.exe CacheMgr.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe CacheMgr.exe File opened for modification C:\Windows\system32\AgentService.exe CacheMgr.exe File opened for modification C:\Windows\System32\vds.exe CacheMgr.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\alg.exe CacheMgr.exe File opened for modification C:\Windows\system32\dllhost.exe CacheMgr.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe CacheMgr.exe File opened for modification C:\Windows\System32\SensorDataService.exe CacheMgr.exe File opened for modification C:\Windows\system32\vssvc.exe CacheMgr.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\msiexec.exe CacheMgr.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe CacheMgr.exe File opened for modification C:\Windows\system32\TieringEngineService.exe CacheMgr.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe CacheMgr.exe File opened for modification C:\Windows\system32\SearchIndexer.exe CacheMgr.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\alg.exe 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\System32\GameInputSvc.exe CacheMgr.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\8d683135b68fd3f0.bin elevation_service.exe -
resource yara_rule behavioral2/memory/1832-20-0x0000000002E10000-0x0000000003ECA000-memory.dmp upx behavioral2/memory/1832-26-0x0000000002E10000-0x0000000003ECA000-memory.dmp upx behavioral2/memory/1832-27-0x0000000002E10000-0x0000000003ECA000-memory.dmp upx behavioral2/memory/1832-23-0x0000000002E10000-0x0000000003ECA000-memory.dmp upx behavioral2/memory/1832-28-0x0000000002E10000-0x0000000003ECA000-memory.dmp upx behavioral2/memory/1832-21-0x0000000002E10000-0x0000000003ECA000-memory.dmp upx behavioral2/memory/1832-22-0x0000000002E10000-0x0000000003ECA000-memory.dmp upx behavioral2/memory/1832-25-0x0000000002E10000-0x0000000003ECA000-memory.dmp upx behavioral2/memory/1832-24-0x0000000002E10000-0x0000000003ECA000-memory.dmp upx behavioral2/memory/1832-29-0x0000000002E10000-0x0000000003ECA000-memory.dmp upx behavioral2/memory/1832-43-0x0000000002E10000-0x0000000003ECA000-memory.dmp upx behavioral2/memory/1832-44-0x0000000002E10000-0x0000000003ECA000-memory.dmp upx behavioral2/memory/1832-46-0x0000000002E10000-0x0000000003ECA000-memory.dmp upx behavioral2/memory/3056-300-0x00000000049D0000-0x0000000005A8A000-memory.dmp upx behavioral2/memory/3056-298-0x00000000049D0000-0x0000000005A8A000-memory.dmp upx behavioral2/memory/3056-302-0x00000000049D0000-0x0000000005A8A000-memory.dmp upx behavioral2/memory/3056-303-0x00000000049D0000-0x0000000005A8A000-memory.dmp upx behavioral2/memory/3056-305-0x00000000049D0000-0x0000000005A8A000-memory.dmp upx behavioral2/memory/3056-307-0x00000000049D0000-0x0000000005A8A000-memory.dmp upx behavioral2/memory/3056-309-0x00000000049D0000-0x0000000005A8A000-memory.dmp upx behavioral2/memory/3056-310-0x00000000049D0000-0x0000000005A8A000-memory.dmp upx behavioral2/memory/3056-311-0x00000000049D0000-0x0000000005A8A000-memory.dmp upx behavioral2/memory/3056-314-0x00000000049D0000-0x0000000005A8A000-memory.dmp upx behavioral2/memory/3056-335-0x00000000049D0000-0x0000000005A8A000-memory.dmp upx behavioral2/memory/3056-338-0x00000000049D0000-0x0000000005A8A000-memory.dmp upx behavioral2/memory/3056-362-0x00000000049D0000-0x0000000005A8A000-memory.dmp upx behavioral2/memory/3056-373-0x00000000049D0000-0x0000000005A8A000-memory.dmp upx behavioral2/memory/3056-380-0x00000000049D0000-0x0000000005A8A000-memory.dmp upx behavioral2/memory/3056-381-0x00000000049D0000-0x0000000005A8A000-memory.dmp upx behavioral2/memory/3056-398-0x00000000049D0000-0x0000000005A8A000-memory.dmp upx behavioral2/memory/3056-400-0x00000000049D0000-0x0000000005A8A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe CacheMgr.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe CacheMgr.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe CacheMgr.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe CacheMgr.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe CacheMgr.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe CacheMgr.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe CacheMgr.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe CacheMgr.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE CacheMgr.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe CacheMgr.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe CacheMgr.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe CacheMgr.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe CacheMgr.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe CacheMgr.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe CacheMgr.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe CacheMgr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe CacheMgr.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe CacheMgr.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe CacheMgr.exe File opened for modification C:\Program Files\dotnet\dotnet.exe CacheMgr.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe CacheMgr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe CacheMgr.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe CacheMgr.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe CacheMgr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe CacheMgr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe CacheMgr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe CacheMgr.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe CacheMgr.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe CacheMgr.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE CacheMgr.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe CacheMgr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe CacheMgr.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe CacheMgr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe CacheMgr.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe CacheMgr.exe File created C:\Windows\e5987c4 CacheMgr.exe File created C:\Windows\e593157 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\SYSTEM.INI 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2928 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname CacheMgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain CacheMgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain elevation_service.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CacheMgr.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 17 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ee63536bf073dd01 SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 3056 CacheMgr.exe 3056 CacheMgr.exe 3056 CacheMgr.exe 3056 CacheMgr.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 812 Process not Found 812 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Token: SeDebugPrivilege 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1832 wrote to memory of 2928 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 89 PID 1832 wrote to memory of 1188 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 16 PID 1832 wrote to memory of 3012 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 44 PID 1832 wrote to memory of 716 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 45 PID 1832 wrote to memory of 3488 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 51 PID 1832 wrote to memory of 3388 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 58 PID 1832 wrote to memory of 4380 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 60 PID 1832 wrote to memory of 4440 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 61 PID 1832 wrote to memory of 4472 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 62 PID 1832 wrote to memory of 4724 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 64 PID 1832 wrote to memory of 4512 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 65 PID 1832 wrote to memory of 5168 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 66 PID 1832 wrote to memory of 5268 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 67 PID 1832 wrote to memory of 5308 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 68 PID 1832 wrote to memory of 5884 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 80 PID 1832 wrote to memory of 5932 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 81 PID 1832 wrote to memory of 6000 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 82 PID 1832 wrote to memory of 3448 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 83 PID 1832 wrote to memory of 1188 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 16 PID 1832 wrote to memory of 3012 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 44 PID 1832 wrote to memory of 716 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 45 PID 1832 wrote to memory of 3488 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 51 PID 1832 wrote to memory of 3388 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 58 PID 1832 wrote to memory of 4380 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 60 PID 1832 wrote to memory of 4440 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 61 PID 1832 wrote to memory of 4472 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 62 PID 1832 wrote to memory of 4724 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 64 PID 1832 wrote to memory of 4512 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 65 PID 1832 wrote to memory of 5168 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 66 PID 1832 wrote to memory of 5268 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 67 PID 1832 wrote to memory of 5308 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 68 PID 1832 wrote to memory of 5884 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 80 PID 1832 wrote to memory of 5932 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 81 PID 1832 wrote to memory of 6000 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 82 PID 1832 wrote to memory of 3448 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 83 PID 1832 wrote to memory of 3056 1832 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe 91 PID 2620 wrote to memory of 1284 2620 SearchIndexer.exe 102 PID 3056 wrote to memory of 1188 3056 CacheMgr.exe 16 PID 3056 wrote to memory of 3012 3056 CacheMgr.exe 44 PID 3056 wrote to memory of 716 3056 CacheMgr.exe 45 PID 3056 wrote to memory of 3488 3056 CacheMgr.exe 51 PID 3056 wrote to memory of 3388 3056 CacheMgr.exe 58 PID 3056 wrote to memory of 4380 3056 CacheMgr.exe 60 PID 3056 wrote to memory of 4440 3056 CacheMgr.exe 61 PID 3056 wrote to memory of 4472 3056 CacheMgr.exe 62 PID 3056 wrote to memory of 4724 3056 CacheMgr.exe 64 PID 3056 wrote to memory of 4512 3056 CacheMgr.exe 65 PID 3056 wrote to memory of 5168 3056 CacheMgr.exe 66 PID 3056 wrote to memory of 5268 3056 CacheMgr.exe 67 PID 3056 wrote to memory of 5308 3056 CacheMgr.exe 68 PID 3056 wrote to memory of 5884 3056 CacheMgr.exe 80 PID 3056 wrote to memory of 5932 3056 CacheMgr.exe 81 PID 3056 wrote to memory of 6000 3056 CacheMgr.exe 82 PID 3056 wrote to memory of 3448 3056 CacheMgr.exe 83 PID 2620 wrote to memory of 4176 2620 SearchIndexer.exe 103 PID 3056 wrote to memory of 1188 3056 CacheMgr.exe 16 PID 3056 wrote to memory of 3012 3056 CacheMgr.exe 44 PID 3056 wrote to memory of 716 3056 CacheMgr.exe 45 PID 3056 wrote to memory of 3488 3056 CacheMgr.exe 51 PID 3056 wrote to memory of 3388 3056 CacheMgr.exe 58 PID 3056 wrote to memory of 4380 3056 CacheMgr.exe 60 PID 3056 wrote to memory of 4440 3056 CacheMgr.exe 61 PID 3056 wrote to memory of 4472 3056 CacheMgr.exe 62 PID 3056 wrote to memory of 4724 3056 CacheMgr.exe 64 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" CacheMgr.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1188
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3012
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵PID:716
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵PID:3488
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3388
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4380
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4440
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:4472
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4724
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000268;000000000000026C;1⤵PID:4512
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:5168
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵PID:5268
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵PID:5308
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:5884
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵PID:5932
-
C:\Users\Admin\AppData\Local\Temp\2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1832 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\2026-11-14_580a42224aeefc7fe53705abc06f155a_amadey_elex_rhadamanthys_smoke-loader_stealc_stop.exe" "C:\ProgramData\CacheMgr.exe"4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2928
-
-
C:\ProgramData\CacheMgr.exe"C:\ProgramData\CacheMgr.exe" -as4⤵
- Modifies firewall policy service
- UAC bypass
- Executes dropped EXE
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3056
-
-
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:6000
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:3448
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
PID:3084
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2808
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:6036
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2204
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:5320
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:3392
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4524
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4412
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
PID:824
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1284
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:4176
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2900 2896 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:4424
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2892 1772 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:1764
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\java.exe
- Size 1.6MB
- SHA256 9db1db3a57beb03e7aa6836af80ce4f67051b580d30e75c86eaebc801bf7e3e1
- MD5 8844cf182d6528427f4bf87a1ecfc9c7
- SHA1 530fc6be02cef1b36ba92e22169e59e361af6d12
- SHA512 4b699672e26f8753529dfdb380c779e8f99c121dbb91f3e5bd2546234bee5e07b4182f53c2695d8641f62c506ebc0088985cdc2770bb2eeb4300fac71f8179de
- SSDEEP 12288:liZwbpzzFEoS2cPvy1X1iAAJn/FplFxNmXkDCLhf/raaUjn9L4xL2Gej:oZMtzFVSO1liz9FhWk+l5Onl4xL2vj
- TLSH T1CE750295B3A008F8EC67827ECC128956D5B27C665BA0C61F03E4326B5F333A15D3DB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaw.exe
- Size 1.6MB
- SHA256 a218526d04b6b1fe4ab4f1be91a91c095bf49946197cd25e826f1c990b449eea
- MD5 a41bec6fb0f0f28590e18bd8398ee696
- SHA1 bdee71a3eeced660dfbc8777ee4115478970b9b6
- SHA512 4f6ec73afc62750e017e2031ca7506db9ef689e9d2b2d5bdb23760e4ce968855d6f3567b86317c4c16fa4a08d404e2cf4c847194b7c67ee1b5e11616281d4367
- SSDEEP 24576:aTCaLl3z0zDjliz9FhWk+l5Onl4xL2yj:aTZLljylo93WX2l4
- TLSH T1B4750294B3A008F8EC67867ACC228956D1B27C665B64C61F03A4336B5F333A15D3DB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaws.exe
- Size 1.8MB
- SHA256 4c9c41d60edfcbbe0f9538e01cfc0deda152ac23c82e0e5e22e4dfecd6deaa62
- MD5 6bfcb1dd869b294829f36dcf8a798eba
- SHA1 ee6ddd663ec3db437b6d58b49b5123f430856aec
- SHA512 29adb4b490a9590a7f49d60621e3a36afdb919618d5e2989090e07484b5766f1000d0d0499de04e5d8555ad429b929d112bb61a8c21ae0872666d30c48126cea
- SSDEEP 24576:o3Fd9CHKy7GZnliz9FhWk+l5Onl4xL29j:yFd9CHKya5lo93WX2l4
- TLSH T14D85CF90F3E414E8F0B7DA3589724511DAB67C6A5B61DE8F03A4261A1F33BD18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 97d7ee51362da225412b1978c3fddda9935e318559f22dc598c770e34b3cac05
- MD5 f829f1f3ddc448b83c72c6d2b8031750
- SHA1 5524fe5d8c04c173c80d9077843edcb0876da61e
- SHA512 b8bf794727d9d010f5caf54342b6c929c5556fa389ed498a1674e746b7d75a07b54a2775bc4bf9a84c9c146481972b7fe43f978a6af10b2111fc3691d0193334
- SSDEEP 49152:Bb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn6EDnhm2RssmofS:H3q6sjBrEDnI2vmMS
- TLSH T13FD59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.6MB
- SHA256 b2445667fbd7c2cca65eec756f6ecaded9137249dd405ee85b0ef0ad7f20ce3c
- MD5 68ebad46905fcb2fa9a445e9ab1f2f02
- SHA1 192cf596004516de24d6d6c23cb87e13dbf04e11
- SHA512 ab94b9d84509d845f7a36282e2df2fb7ee75ac29518f42ad1cc89ad9f436ca3b6f4e2455c5e39241f901d78edf8039cbe63a5e1afc008b857d2ed37cb9c7b81a
- SSDEEP 12288:H1XLsswWkxy2lRq2czA/W/vGRiOODnh7dQry1H4zw5MzIogsswdRt3GA4mofSPWx:VXYfDtczA/AGADnhm4iIfpst3GmofS
- TLSH T14B75012867D448F9ED57817CCDA28516EB33789147A0E79B03A4D9361F336D81E3EB42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.9MB
- SHA256 42c2975bb7467073e74787a182b8a740d367ee4ca49b60e536c335c0e1017264
- MD5 68291d70a40b71dfaad90fb23f0762fb
- SHA1 4f7f9d2e6cc23623f317c20530b155b634d44fbd
- SHA512 1a5043e325e128832989e37906aff850578146d66c96a73f7523c99f17ddfbe54047af90bd52952b49c51d31782c8ec718b89def53f80719b30e7ae78514746d
- SSDEEP 24576:r0Le5ji0hmxsrMiAGADnhm4iIfpst3GmofS:rPji0AKpEDnhm2RssmofS
- TLSH T117959E15F6748371D073C0B9C5D2A69EE97230825B308ACB4286D77C7F67AE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 564d5f4c9c571dd940d79bc106d41a20da97ebaa9bc89118afaaaa0c8abe70a3
- MD5 8595e94c08ea1eb4e3e13cf025f46a93
- SHA1 7e690f1a0f054d1a727ad0a2b37d5061f5e988bc
- SHA512 13bddadde8cb3d5a871af24ae538630139884321d88f2721f6dc38dee75c073d4c8be08219043d6d061b547c105092ea8f8d8dbcaea2104e4232c0b531f41b34
- SSDEEP 24576:ga7/ezSC6vUyD/aqgrvWn6q8wyuQAGADnhm4iIfpst3GmofS:X/ezSC6vUzPveHjydEDnhm2RssmofS
- TLSH T1B9756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 f0eb41a4e50f370219375817274ac6a883a8d78fc8e24ae6369062e04eae653c
- MD5 1a02fa6761beea927e1cf2aaff4335fc
- SHA1 3d1bd2b51ccf36e1d7869a6ac9801716f3d3d2cb
- SHA512 c633f684e7f9c2c33998bcb723d6383b04da5b2922a320fdc522fe0c32e276262b6d9272fab4c4c43fbcb7ec65145c2607ccbf5648c8b9b0e96c6cc6030a6648
- SSDEEP 24576:yVbqPb88hv/l+YbAGADnhm4iIfpst3GmofS:yVO88hXl+IEDnhm2RssmofS
- TLSH T1A8559E65F5B48331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E67BD6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.6MB
- SHA256 9427512cddd41274c18b5c438c8d295cb42b1e9f5d8ea57807a321a75dbd4b36
- MD5 8197890df0ff5b43ce66ebe0e145a9a2
- SHA1 5df0f1315debc9b6de5a77278a92586e9f999ca9
- SHA512 02bf2e3351ced2a768dfd4a6f6592a2ba6f7f9356a40093a3425de624297ae5e0b82b62b20213f83d3741ea715e64260ba28a983f7d8226767569a12f4470b56
- SSDEEP 12288:leBNUbTVO86UDW/vGRiOODnh7dQry1H4zw5MzIogsswdRt3GA4mofSPWx:lJIUDAGADnhm4iIfpst3GmofS
- TLSH T1F875CF3BEE28FCE2C27A9CB85A518640D77278714F62A3CBD165C20EDE235E11E79C15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 ab715fba03d109e822a432aaf2e599de9bc8e02b72a7455814d727a75d36e95c
- MD5 412dcb4b22170ad2344c0e555523ee8a
- SHA1 ce7bf21dad52be910a83761591241bba8ff33e90
- SHA512 e67620d03bcf7056bff994d931055ab72ab07ee14dcb9368c68ba0f4183fbc51bca9f174edb1cb1fa4d21164656a869509185fa820d321043ea4535f1c058649
- SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THJ:gQvGAdlCEL8c/DRNw5CAEDnI2vmMS
- TLSH T115267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 77bfadd92dab6570f2a1a599ac2e9b9ea547e1c7459334949009bcb83af82bc7
- MD5 04f7ad9e55e22ce69a7e59b0d637de30
- SHA1 5ead37ab5b990ac889a0a5805e11c0897db6158a
- SHA512 d8b752f59dce021c3c6027a13540b391c9faec0cf0f8267642a26601778e2a336845fedbae6e888336e249eddf50339ff6a2b3e64adc9b54305172b4f6556d07
- SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHxEDIm:PUEtQevvqc2W1cpV2tI32xHm
- TLSH T178474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 80714302e68cec07371f27e777273198e90514195f8814a70c5c37ec5a7964ec
- MD5 65dd7ac46b98e1d00725a16a52f5a33a
- SHA1 0284f6309faaee1f563eb6f322bf30cdf7c8c0c5
- SHA512 0435d2eb3df73403997bae50248922ed7bc80d9562a493efd245b24e26fe57350dbc7378203e4d8f1169ceafd141daf5699289d765c2fa4345d44bb9941fca72
- SSDEEP 49152:+CbRquA/m2yL5zTfFiV+XenmE3/z5EDnhm2RssmofS:zoquVjnm0EDnI2vmMS
- TLSH T18BD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.6MB
- SHA256 e0374a26aa17f7aa447561c5e1e73448f2e8b92848fa6c9dc9f8bc939f3ba709
- MD5 dc8607af30fc6baa0993d8770d81a6a6
- SHA1 b4f63ede62ee7b5ac6791bdcdf3baaa06e02e35a
- SHA512 a431e7c2500d6ad6a8336c5d26d5e71205b3586f3a9c12db7e7974160bbaf60a7969e334502eebe43714cae821d76dc71913c5cccdc02f1563844275d7f99dc5
- SSDEEP 12288:zmw5HEjsChN5BFgl0WDm+CwW/vGRiOODnh7dQry1H4zw5MzIogsswdRt3GA4mofj:SwucOW9AGADnhm4iIfpst3GmofS
- TLSH T1D975F14567E81CF9E9A791388A57C136E7F3BC122A22C72F4360C65B5F372616D2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 7aeeeb38ba43530790b205ba06cd44f2a8ae914e21ad7079c2699a91fae26d6a
- MD5 1abf2c636dd613c2b429902bea5f6ca7
- SHA1 cba87ceb197ea49a451eb0f0e069f1e81262e705
- SHA512 64d73a0d8d90a7283601e44e0033a3eb64e9b446942f6bd6dc7eafb51e46b7b333c9ee28d14e90c268086dcde5bb1330b2b6206cf47f9852949309aec927ff34
- SSDEEP 49152:gB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glZEDnhm2RssmofS:6u6Jmdxd2dZEDnI2vmMS
- TLSH T1AFD59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.8MB
- SHA256 80c98dfdb30becd9970e5bf5d1cd5c0f0bbc6d01a142122ebedfcc7623b9c1f9
- MD5 e39978a428406cc3f3ae45d5ad400345
- SHA1 037f72c3a0187bd2cd5ce55c757f0d5553770309
- SHA512 91c2dffacdc8b1871ccba2de609ec7e2332c0624217a93b27f3fa6040946ea9ac27caa5e7c3cedad9a6ecbaa176db079cd2066ff55de92a10d4dc219c81436ed
- SSDEEP 24576:Ifwvxk9RX6wkyAIOAGADnhm4iIfpst3GmofS:ZMnYIOEDnhm2RssmofS
- TLSH T10395CF29EBCC44E6E1B7913C9DB7460AF6B278691B31C2CF025A526E0E37ED45E39710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 75b5443b9e14a0b80dc44c048e4603a18e53be4608a106793de4458026cd86d4
- MD5 72815a11cab3c75c25fd489d38d6aa3a
- SHA1 0eac07dfba51ef826251e0877bb16058329c8de1
- SHA512 cd1b7cc89aa31737a6bf0889075ba129d365aaee319690c6da0c8bfb1eae4bcb0a4702b7d21a452ac01a0e066833b8d933e2aae4602d377f43dc331fad61771b
- SSDEEP 49152:ZYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0fEDnhm2Rssmoa:0ySzPHEDnI2vmMS
- TLSH T188066C56A1A841D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 db006971ddc956c83082610b062d51b7a21d724d4ab6a942ae833b66c66cfd6a
- MD5 72fac6a066eb146cfb852b23e025d70d
- SHA1 955841802f27ca174f5b39a8997b1704e66761c3
- SHA512 806c7226b0c8b66493c67da23c73fab9ad091d8c39377dfa46cd478220053999856ff937565ad1ea02863282e1f25392d80fd4cf2a960629563042d098c8a457
- SSDEEP 24576:A47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYFAGADnhm4iIfpst3GmofS:A47JUQjTirIhCnDHUPfF/PEDnhm2RssW
- TLSH T18065AE1DA3EC01E5E1BAD27889154A5AEA71742E1F32CACF1270827D6F23ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\CacheMgr.exe
- Size 3.1MB
- SHA256 f8f7e72d3084662f0a48b0718efd168de48faea33c4dea1ca80d80b724aad61c
- MD5 580a42224aeefc7fe53705abc06f155a
- SHA1 8827f07b6fac2a2e34797630e902286d868b7af5
- SHA512 6a83b11cdc6e59c6cea7d8d6eb71fedf695bbe4b1ab11f6cef2b53dda1919d882788ce74e582009e0865d26fd6095427b21773c5a048c424ccb0e784b1397a81
- SSDEEP 49152:LV4EDnhm2RssmofSmcEDnhm2RssmofS5nlvI77FWyl:J4EDnI2vmMSmcEDnI2vmMSPhW
- TLSH T162E523506988E0B3FA51D8F13D1A51B9CB6F6C625C67C623E500B4E76FBE8C2292D1C7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\winwwnswn.exe
- Size 65KB
- SHA256 7a11ea468f946c4770ff389d314ccf4af1f1440a1a8dc275cfd712b77e3a446d
- MD5 fe93161469bc4978af21a0bdc92d32c6
- SHA1 b64f84f6fa8b6e52085c4ef94dccf70655e01787
- SHA512 ef095e4ab3381c3442ade430db3c212b60055f9e346f09ae7a1e0ef0cf41889b21e41b0342f45fbae8bc4c9b0f7f9cc1e60ea5608fbd6b7fdd310b52627ea421
- SSDEEP 1536:42d1GcO8ALlGFHDjSENbpyH1F/VEg0SeiFHK9rpwddhFACJ6UVe:42dFQlGF5yH1aSekHuHVUVe
- TLSH T1FC5302497C0E4348E2FF08773BE7F99672EBD80525B2836480927B6E5B480B975BC917
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\8d683135b68fd3f0.bin
- Size 12KB
- SHA256 43beb66fdb74619c7b6f331fd1ee4d19cd38eb1de5c4a33bb92510c7241fa375
- MD5 7b6246db1aa27343d8874691a3a4edf6
- SHA1 58a79aba07df1edd34c53cca72d7c19cd92ad8f9
- SHA512 fc8f2a6a3725948dc87c3e1f825e29987095f4b9cd00644101531575365e752c56a0e4f87b2fd60b3cc04d85b5a80ddfc5fafb5934ebe94f203631a53379bd7f
- SSDEEP 384:3sn9cvACMEQiD898KGpRax6aWZMG5uHcWV4:8nOvUEmxPcWS
- TLSH T1C742BF9EEC16C8DAF10CCFF42A1F44D69C17AC7284BFA457085B0EC21222C911A7FD6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SYSTEM.INI
- Size 255B
- SHA256 68eadffbfa2d39dcd09b895d79e4824e38a3d3799570990d7916598caaca7c9f
- MD5 55cebda1df59755f2efbaa895820b750
- SHA1 891dcc2e3b3c4f3b685ad34437a1aace8fa2afbc
- SHA512 ec4bb7369cde24b395711dd722e7cb0dd3ec7ed0ca3e57779c27f5434d5592fc752b886416f3d346dc5bed5ad8dbe1d6542c3803c7c8c849bc2b9feea9ba7721
- TLSH T194D05E0E4BDD11AD9046003E31B8D0C272399F61E8320F4C90396B81682C6D9BF7E2AE
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.3MB
- SHA256 af10ecca9df5e512b02b49bec21318565cbf2cb83c1b52c16c2460fa77c30282
- MD5 00ccc7564b09ee440d19b907ee906d85
- SHA1 d98b3d31fed3634e677ea124ea3d1953fabdb820
- SHA512 8b91b476aca0b45bc6fefe707d7f754ce75a53602f299711ba1eb34e6996953339b6680a902bdada6b2cbfc54a967accb199874ae6706c44910b68c0cf603a8c
- SSDEEP 12288:e47CW/vGRiOODnh7dQry1H4zw5MzIogsswdRt3GA4mofSPWx:zCAGADnhm4iIfpst3GmofS
- TLSH T13B55230087CDE0D7F959E4B07D2DA139D72F69764F62C2F3E400E4625ABADC61E2860B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 4488b124be9338f693cb41c896144062173c147a6ccb19c10c48e43cd780bde8
- MD5 da0db66473bb2b71d743153721cd0d28
- SHA1 433acf0f5f453d6b3be0514cdf55fbbe5fbda4ed
- SHA512 5577181f2dd91ab853e1819e6fd62c3141f56b7a05331aadf8055dec6115cd40e35bf87f3e4f13cda1f821fb90be8ca4e2da021baf0e4b6d7cca4f960b194cf0
- SSDEEP 24576:ygb6bmBIi49WNNFpg1rSvFv7bYQAGADnhm4iIfpst3GmofS:ygb4mBIBhGFFEDnhm2RssmofS
- TLSH T11E659E1E22EC02F5E0F5E2B89DAA4417D6B378160732D2DF1151426D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.9MB
- SHA256 b2c89ee01dcd60195a1cbfe87a5816d58fbeaa61fb7d2ea06f0df261b3e13447
- MD5 a8bb5d6a43cae9cfd053f2f907d0d5bf
- SHA1 995aa08b7d9136344d87b4bf1fb9016043f51ce7
- SHA512 4eb81b8dfd82bd159021d9743eb00b61d72a2f59b172139a2fb2200a70df9d87582394ea38384ac7867fdad0934c2cd8703d7287ebd61b7d111f1afd3cc2e8e3
- SSDEEP 24576:0G88u8FpJqH1Hzria7/mVAGADnhm4iIfpst3GmofS:H7ZFPqVaa7/IEDnhm2RssmofS
- TLSH T1C695016567E501F1D47BD0388E464667F6B2B8250374EFEF07A88A511F23AE50B3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.6MB
- SHA256 51a4eb1129a2f5898870534b5a7f58a393159b5aca884781858e7b65004c804c
- MD5 9875a41f7ae290af003b18337c6c1e38
- SHA1 46b4763b45e3ec52cac780a314de0303466455ba
- SHA512 6ffd8ed78dbd90e412ee309a63df6e9582e3cff46154412ad74071520e34600640445c4be9359647652a818c19e94fd2981cb611e0614eacfcb3a50d1d5ac35c
- SSDEEP 12288:GHvUrBFrEjwaQRW/vGRiOODnh7dQry1H4zw5MzIogsswdRt3GA4mofSPWx:GPUr+NQRAGADnhm4iIfpst3GmofS
- TLSH T1B475F11E22EC18E5E67AE17C8946871DE772B8620712D2DF0290817E4F67EE87D3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 fecb8fae2bc05128f48a1073d22f4d274b9d51127f7251a96945b00429975d4d
- MD5 3cd91a49628d5bfc8fefb01afe3bbbe5
- SHA1 5308f6f479ea7a9955ce9b8da4630bbe9c8d70ca
- SHA512 8b5c035ea2cc366632d0f633e35dd32f2a6bca2ef66ef63cb0709c47bcc1174767e9e89042ee67f2a920a848aba9b15e4924be5f082a57817f9d4952a1819e8f
- SSDEEP 49152:mBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjhEDnhm2RssmofS:JG05lO43bGEDnI2vmMS
- TLSH T1C3D5CF6E62EC11F9D1BBD07CDAC6460BEBB23425033556CB02A486A91F27FF4597E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 65e1d95eb75be0599721deeb9a14c35a0b1b87cf049d22a3cf44ea07b4e62e88
- MD5 28506d987f6aff36cfb077d6fbccc0f4
- SHA1 0eff1d00b030e7f61a5cbd321ec4fe22193422a6
- SHA512 34467425483d456b2f44aa383c268e7aa757cee75eb9b8a6625b8c44285b9d8ef0b9703381e267d121cefcd28c293627a790a6c8cf4be9319e856c1c0ba1ca2e
- SSDEEP 24576:4fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnfAGADnhm4iIfpst3GmofS:Aa5POZ3BJt2pasx2+mpEDnhm2RssmofS
- TLSH T1CF65BF5DA7FC01D5D5B9D17DC583861AE5B2342253329BCB022182BE3F27EE85E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 c85fec09a8969d493fe5f6aa685a2561257cc901aa9f1ca645b94fdc9882671c
- MD5 d12d08ebaffabbc3d1b783bc0b90f6d2
- SHA1 f6cca887b93630a7cf8f8834720968f7afffd88a
- SHA512 f570bd31ca7bab56821486ae8c3ccf5758d7d14b4722f88c0b273da0dc28b15b17ca825eefe8b47de6c270e3f33565cb035d2a9dad5a8812d559fc0541e758fa
- SSDEEP 24576:hNcwHdjbyQ4nLC18lb/EOjowL7FkdAGADnhm4iIfpst3GmofS:hNc/zEOVHFoEDnhm2RssmofS
- TLSH T190858B1623E901E4F5BBE1BE89779546FAB1786517308ACF0291811B1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Sgrm\SgrmBroker.exe
- Size 1.7MB
- SHA256 69aceeffedc3147d6b37117d12b140625b6ad36e4a32f3045dbe3ecc36195d7f
- MD5 072738eb1d7d95e97e22827bf6a70918
- SHA1 463f86412dfcd89aaf94bd3fc993e9343f149dc7
- SHA512 9e3a2ef6485e17ad0c69c5007f6c609a5a95a78761f4375b413ea8cd8dbf7431b5ee7c0222bf57c16fcded52c68628740da8dc9649dfa57eae789b5b82fbbd2f
- SSDEEP 24576:yD3FHshBIYQgA2AGADnhm4iIfpst3GmofS:yDVHeBIAA2EDnhm2RssmofS
- TLSH T1AE85E17DEA9C00E5E57AD1BCDA638606E77238A9032256DB1190C1B65F6BEE43D3DF00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 bcfae85674284898fbf5f161965736e3b0d7317552dfd51834d14cca9312f54a
- MD5 eb07caf9a34c49a7983b3cb6db5bef2d
- SHA1 cd99792129a98fdc5b41a424d65a229a249c35a3
- SHA512 32d184b4325ab5902f3430847dfefbf4a38e37d7ccb8e468f1ed37267ac8d7013ab92fde1667efcbf94c36096afdce3709f579f82cc83754c5c020eb3276278c
- SSDEEP 24576:MTkNvNnaFeYhJNtmZBm1AGADnhm4iIfpst3GmofS:MTMwBtOm1EDnhm2RssmofS
- TLSH T1AB55AF6EAAF846E4D1FEC6B4DD238512E6727461073293CB9290C13F0E679D89D39F21
- MD5 SHA1 SHA512 SSDEEP TLSH