e84b80cfd58db8472e0a3f97251beca5385d0457bd2cbebed438c36b641d8d77

Analysis

max time kernel
149s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 03:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_b698d2fb17fe381dbab1eaa1ff24e47d_elex_redline-stealer_rhadamanthys_stop.exe
Size 1.3MB
Sample260701-dp72mse19v
SHA256 e84b80cfd58db8472e0a3f97251beca5385d0457bd2cbebed438c36b641d8d77
MD5 b698d2fb17fe381dbab1eaa1ff24e47d
SHA1 1729aef276a27b9b6b3e68e2d049b18643c84842
SHA512 8d01781cb40fce0459aa316fdb6eb061b7d68fb457b0fb2d9587b8c237dddc4167c49cdb923d57702c6951497d0b2d0c77622afb550498dc48c819ffe6efee5d
SSDEEP 24576:nngqSf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nngqSfLNiXicJFFRGNzj3
TLSH
T137551212B6809073D5672835B63DC4649B297C300778D983F2442F6F7EB6BE68B362D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
408	elevation_service.exe
4408	elevation_service.exe
1188	maintenanceservice.exe
692	OSE.EXE
1180	PerceptionSimulationService.exe
4448	perfhost.exe
5560	ReFsDedupSvc.exe
4768	SensorDataService.exe
1648	ssh-agent.exe
3216	AgentService.exe
368	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-30_b698d2fb17fe381dbab1eaa1ff24e47d_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-30_b698d2fb17fe381dbab1eaa1ff24e47d_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\19ce62924a0960ed.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-30_b698d2fb17fe381dbab1eaa1ff24e47d_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-30_b698d2fb17fe381dbab1eaa1ff24e47d_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-06-30_b698d2fb17fe381dbab1eaa1ff24e47d_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114578\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-30_b698d2fb17fe381dbab1eaa1ff24e47d_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_b698d2fb17fe381dbab1eaa1ff24e47d_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb6264710709dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000142036720709dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006a383b730709dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000997f4ab40709dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a8d6c1710709dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
408	elevation_service.exe
408	elevation_service.exe
408	elevation_service.exe
408	elevation_service.exe
408	elevation_service.exe
408	elevation_service.exe
408	elevation_service.exe
4408	elevation_service.exe
4408	elevation_service.exe
4408	elevation_service.exe
4408	elevation_service.exe
4408	elevation_service.exe
4408	elevation_service.exe
4408	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5008	2026-06-30_b698d2fb17fe381dbab1eaa1ff24e47d_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	408	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3216	AgentService.exe
Token: SeBackupPrivilege	5560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5560	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5560	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5560	ReFsDedupSvc.exe
Token: 33	368	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	368	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	368	SearchIndexer.exe
Token: SeDebugPrivilege	408	elevation_service.exe
Token: SeDebugPrivilege	4408	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 5428	5008	2026-06-30_b698d2fb17fe381dbab1eaa1ff24e47d_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 368 wrote to memory of 1600	368	SearchIndexer.exe	101
PID 368 wrote to memory of 5336	368	SearchIndexer.exe	102
PID 368 wrote to memory of 5404	368	SearchIndexer.exe	103
PID 368 wrote to memory of 2464	368	SearchIndexer.exe	104
PID 368 wrote to memory of 4140	368	SearchIndexer.exe	108
PID 368 wrote to memory of 3628	368	SearchIndexer.exe	109
PID 368 wrote to memory of 2288	368	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-06-30_b698d2fb17fe381dbab1eaa1ff24e47d_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_b698d2fb17fe381dbab1eaa1ff24e47d_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /tn "SmadavSecondaryUpdater" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5428

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4408

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1188

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:692

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1180

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4448

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5560

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4768

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1648

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3216

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:368
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1600
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1086369643-1618123105-2567081378-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1086369643-1618123105-2567081378-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5336
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5404
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2464
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4140
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3628
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 305a164cc1e4b95436e5a4c200d90255565b8cb54fc999fe60bf81f52060f8df
MD5 88807fb730fd306675b249b5b8368c94
SHA1 6badae50b8196a5d2f5dc0367a86606e82e47153
SHA512 a0f5eb734e4164974563415f5170f3a929ed0f774ca90cb437381c00b2d53acbb322ff4940d7cda2c5e0017315c6e0abebe30e2c2f029114b2046ac60e259c67
SSDEEP 49152:ub+632BuPkFKRrdE6ohdstBhuXjfS4LWxnNLNiXicJFFRGNzj3:w3q6mjBm7wRGpj3
TLSH
T1CFD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 475d0d99b777d003e701397584efaa23708a5be907faa9f0f007bc5e88d5de73
MD5 a2c956756376179b1cb258dcb5276886
SHA1 a141a0b4048b9b9cdead3dae8a1093f13844dc7d
SHA512 0ec27b374829dd81f85c0f312493929b599906b629b7795c6ad9d6b909ea842fb4b76598b48eaa313616bdfaf29513d7500e74b4371f6fd4ff847364e9b9fe7d
SSDEEP 24576:QXYfDtczAo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ntctLNiXicJFFRGNzj3
TLSH
T13A75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 525bd27ecfc54b8710c68317c6a133f3012a989c8c96bc50e27c344ab826b842
MD5 ce1715c3ac1c82325b50f3734fe718d7
SHA1 bec44156942ce279139499ecbf912bb752db6a34
SHA512 7e8f488b6955fc4e2896dcac18c9a7eeac750e96d281df0b9ce5a8c4c4b459d671222e96d0f3b82eaeb1de6ed935dbf225012cb94ff1c39fde278ceecf411801
SSDEEP 24576:h0Le5ji0hmxhrML/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hPji0AzeLNiXicJFFRGNzj3
TLSH
T1CF859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6b4f8616d27bcacc9678f9aaf3079ba22ecbea347929a2fdf790ce87706a6133
MD5 9bc66048ebf50b380949fc5a675148be
SHA1 8000b5b72493c66b582cf6e77797c36b7abee842
SHA512 761fa0cb81ee06254ebd5608995650fbf812e8b2380d26ac847573d9df85b983cd190704adf8f6d56c46bcd92b3362735f789830c5e5fa310f8c6ed3cfad7afe
SSDEEP 24576:0a7/ezSC6vUyD/aqgrvWj6q8wyud/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:j/ezSC6vUzPv+Hjy6LNiXicJFFRGNzj3
TLSH
T16E756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8590110c642ae90e3aeba38815f38ea7991f6c4b8d5727223e043166eb5d7635
MD5 6c2b880004c400c9593d47a44cce92fa
SHA1 0a32b8f1c07c452eba385ae5e7a6cbeb7d8dcfbc
SHA512 ff817906d337bbd00de58d28fafbd37bfa11f16c6a4e0c6ed04425f66ce9326426810a677844aaa2988602de633f460ddc93002ded68a2d1a4df63f1c6a45298
SSDEEP 24576:3VbqPb88hv/l+Bs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3VO88hXl++LNiXicJFFRGNzj3
TLSH
T156559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 75f513ccd8c94942cf65cecedf5aa0ddc04225254b7c7ecdb278a16ee89582e1
MD5 0dc33adf9d16071e5faa8dcbe6c95abf
SHA1 56f1bccbe1cf1b85accdab8d71236ce37088631b
SHA512 21064c733bd8edc5007dee37939ae94c3dacc66269ce6f609c50e931d5e8f69a95bc6a360c03b4407e5153913db9e3e964ada6a5eca76552b47df8e1e99a3a06
SSDEEP 24576:VG//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0LNiXicJFFRGNzj3
TLSH
T1345523D3468854B1FBFD003A867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 8922ddc70a96b9f3fb42b04d1eb384f5e74a41ba8567a98dfe9079e9925b4a04
MD5 5673385c261ef977f9f7d381b8314263
SHA1 44f4018ef6340abdd747991fbdd368f29047de4f
SHA512 8bf89c0aaa16ebf7e03e0e45b83caf0d1dab0854d09f1a80e0a7dd0864e9957697100fd5152f86cc31ef337011e328da8db8df47f574bb2a57b9895986803f1b
SSDEEP 24576:jJIUk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jJIUkLNiXicJFFRGNzj3
TLSH
T19075CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 09dcedefed80b9ecd81bc80ec4b38a82cb7d108a8a9e5325309519415b3488df
MD5 d59386e3569078d85267cdc608e15570
SHA1 e603be45db320f11562f03354f1362499e3aea91
SHA512 e26cd5e8d2734d3a228cc81a59df423daf041da7f00f639865313260c3f11ebfd9e3419c6ca31c81db8730fac3658d2ba7e1fdeec0a466e595df74c0da96e8d2
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH6:ZQvGAdlCEL8c/WRNw5CN7wRGpj3
TLSH
T1EC266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 29df51d92ddc2af6f8ac6f91f6206ecb8e206d4ecc84aedd5a7fc6dec074c02f
MD5 264b54da0933079d7e0531c8adf21c9d
SHA1 d67e3ee17d11fa44e2827036ce7c7f714c3d4662
SHA512 1ba6134e3d76619632ba6c8aa2342b4a612b34802dda0a9a105bba958cce829edeb41dbbc627db1a7d1370b0a6924fbea850969883040d55201f508572af68f9
SSDEEP 24576:wfewsAjO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aljOLNiXicJFFRGNzj3
TLSH
T13875E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c252b6252b5510fd2715740fc1e53f8b362525c8963549718b305fcea236d35d
MD5 e83d1fa1ecdca09651916580d743966f
SHA1 d8b928d4598147591055261f8a8ca3a7122e9f72
SHA512 2d02b4c224a9c96f348e2c63d82f2f36c522f8699f27107469eb655aef4851cee373001f487cd6624aa2b63d2f018ecb2705a829f623988be6b6b37fa2181d32
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHaF9:XUEtQevvqc2W1cpV20I32e9
TLSH
T18C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 971bdc5933dcea468ac4f1dfa856e4caa4693962c45ae02acc1a50753f149db6
MD5 0ccf946a7b925553ad1f2eed03c5b983
SHA1 187f28f71d74a155d6a8e1d09b2b7895453dc2d0
SHA512 d992079831e9348b52e950571dd47880cfaa54b3c7d6cc7434e71a3d8305c841c12941df0a244f3aa4f16faefaa913041502a37eeae1ad864ba4d02795050ee1
SSDEEP 49152:qCbRquA/m2yL5zLfFiV+XenmE3/zuLNiXicJFFRGNzj3:foq2Vjnmp7wRGpj3
TLSH
T12CD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 566a2bfd4394f203e459205b102c141af7287bc4d393592a11d9db1eed9e5d67
MD5 a38c4e5d0d11df01b49df2259f5f866a
SHA1 fd727d358443f796916f1f43c3d53f080de335c3
SHA512 cfc5a09f163d2d5e6630a2a3cf2443f1db283e39466b0daf06149d8b205413504ae10fc35b2c4e2a828a8e2fbaa8f76ad9f8b14489bdee7572d0b33639b1623d
SSDEEP 24576:hAhGL6IFoiwtA5l7S53J/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hAM5Foiq5ZLNiXicJFFRGNzj3
TLSH
T10E359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 f06da0b07f52230b711d25edf27c3b32958d59702b68f498e7c9c29a5e363767
MD5 03f44c439b32a223db2dfc96acb288d6
SHA1 e3425dc845b75ed1e0121a2aabc64bade7b2a318
SHA512 a13da93bf7e699b6f688a70fb503751e4b48abd772d19285be247ee30baa1817ada67e28b93fdfd0aa4b828b920dc2c7e43c4eef46dbe92f9d63d3dbb474f002
SSDEEP 24576:ewuROWa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ewSOVLNiXicJFFRGNzj3
TLSH
T11665F18632940CF9EABA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 85ea831dbbbc5b9552d8cb5e339de43f5baeb8fb643cf64bbbec5d673619f5b2
MD5 456cee1f3bcc9fdc13d47ce2d5a8d678
SHA1 50444d9831e82e117e3274bc97f0884b308a145f
SHA512 0d468b0604eee38348cea8ff6d368a186a3340e78f0b1fbd47b3015033ed05f1fcd896066f2a88b30f315643ba6817e113bde518dd1cdd4c499987db0d6ec9c9
SSDEEP 24576:zZuD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SLNiXicJFFRGNzj3
TLSH
T19D55129622C420F5E6BB413DC9F54504E7A17C2A673643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 87dfb297b26aba8b9abbb67a5d4baaaf6ebf8bffe66901e6583b42db7fb4cadd
MD5 00603c6b7d6c2a74e99a56cc1b6a5ef1
SHA1 a80c541b3e672c09f35e5f5f24d84822b63e2f05
SHA512 9ec05e93054faf9f02cebbbe28620aec6243c13886cdb7fb44c74cbc87d953f33e3a9e1543d297a4077b06d1cf4745a69ae9b9ab0b4cb2c10079f6df8df40e4a
SSDEEP 98304:bQRQyi36YOcPDLvw2gAf+PN3g7wRGpj3:qQyiKanX+PNsF9
TLSH
T10E667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b8e519f3435f91e36aca683365fe1b2748e06cafde3b994397a81ad7cbd86baa
MD5 4acf0013d00c2f795ec8f8f577e5279b
SHA1 e705ecd5fc4d5a454c4aeb027cbc9f8c21cd6236
SHA512 c9f65f4ffebba0e2367b94b5d7a81ffb9865ea76d23436c19420899554a0b368a4778f563f010679554e1ce730c8c88f8d43993ca0e7e52040a319bca009bdc7
SSDEEP 98304:bQRQyi36YOcPDLvw2gAf+PN3g7wRGpj3:qQyiKanX+PNsF9
TLSH
T1E4667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ff49de112a3d7155d24ea3b00cf20eb61987677623762f7c2da7031b9f3eb8f2
MD5 b2a38ba07637e748150614f8723206e1
SHA1 f7e0f0cdcfac4a425cec6fa3b1a7096752149f23
SHA512 102b7dce7cda28f9a49e338d04439df6d760856fcf9abab7ba6d8d11c00037b2aa39692762e99037d07de66aac5a1feaa0430241c52982d4985eca0ce04ea435
SSDEEP 49152:W68Qg55nhkeWu7PNU3/eLNiXicJFFRGNzj3:0thTRc/e7wRGpj3
TLSH
T1B6B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c663cb489074ef81b30cf1fc85d9f502a96123fe4ad6c6dae832adeb088698cd
MD5 0336fc575262800e0f112f6f3c35d2ca
SHA1 0ed76ac8a71009caf790d1db9d1ee290af0b7677
SHA512 3f4ac8d07c9ec6fdc09d03e5e55685e2ca85ece1fc5af33b5bbe33ec80551101839048a0782abebcfb0f328d6e8e116256e7a3099d2daa7734dd393d16d682ec
SSDEEP 98304:6y5112gYy5azzVvU69nLKnhZ/7wRGpj3:jLIHRWhVF9
TLSH
T126167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a58b2dd3a0a7aa4f91b4ea3b327056e1a8e8fd7414b1254d29da25f044acdb08
MD5 468fd7d6e32f92da5812ffe46493eb69
SHA1 2884768fc9a28a0fad94b6fd9d48548c818c2ce3
SHA512 38d876aa8650764923a0ec37678e62ff2fcca6debfd4fa107d1e1a98153a2cf8cabe507d0639d74fdf384e75c65489d64e038df367c13b922d7a2fd0cdfcac23
SSDEEP 49152:MB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl6LNiXicJFFRGNzj3:Gu6JmIxd2d67wRGpj3
TLSH
T15ED59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0127f39265b5cdbc963e929dcbb1f4469da24df9b12dfa8c6626d31a37b7556a
MD5 dff22b5c0c55b3f596f3e486f274283c
SHA1 ff3b9fcde0149b84da5ade80694d082610c221cf
SHA512 f1b46d210a29c5bc81620a9797b8f2584f6f6e47fdf8331394199961a70e71de78a54ce1db266d2f7bf5784ae87eff1d0675127c4d79ab0a24749225e0db6c7e
SSDEEP 49152:J1hpsNoJpF1A67U44CwH7R4xELNiXicJFFRGNzj3:JmifPqRp7wRGpj3
TLSH
T1A8B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 90a13b356ce8467125d319ef0aebaca704b33ab852860ad5cdff9b80914ceff5
MD5 41d12ca08f634ab25a9e6ebb9bba4d02
SHA1 eb9ae2a87d23142cc8f38db6bce374af4b5ad78c
SHA512 74cd55487ac34a079464f99000eda39ad09783adebe046b14f88f4d204303ed4675338b3d21b432d20ffba9b0bd175db4b1f926d55a78b08e1f05a468187027f
SSDEEP 49152:dSuZQIY0Be2KkRVtOnks6NMHqDLNiXicJFFRGNzj3:z5dKqi61D7wRGpj3
TLSH
T1A3C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 86f1b28d5d0a9a32fa3d6dbbf656f9c819812a552dc6c06a875b8493b5d93bd8
MD5 4e33ca8e2fa86ac27d4532d9645fa9a4
SHA1 8344dd8b281149f067fc707d046a186e9455de80
SHA512 d5e34567146757841beee0c822923d5adb24ab7cd6a254c644eb0dc240141a3cf2e7f737a779e2fde34c68f9b3282b2f17d32c5d9552c23f85191108a90bffc1
SSDEEP 49152:EhtSn8EApI0figjgiDn0AP5woLNiXicJFFRGNzj3:FX2iWph17wRGpj3
TLSH
T16A95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 067a7d5dc6fd087d032a3b178515ae3385c10f6a6e2e1e74384d57e06553bf67
MD5 a9f7c23dc1cd45175cd6e5500276918a
SHA1 5da014c5d8f980b95b8db4d02fd3931abcf365df
SHA512 013b719ac98b7a8d6825a58141cdf5244a2267809cc80b8f535499d4bb55b1d8e7ff6b65332b62d02fb51f0c587441dcad57449ef6b86381c822e5177df0fb16
SSDEEP 12288:sDiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:s3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C05523D3548955B1FABC003AC6755428F5881E2DEB5618E3E3483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 3362d872ee26a236d41a695505a8510cbc71f3746d3a094205e9b64bf10c29d0
MD5 a1219299cced78b38fb63175ec8c6725
SHA1 1b24d3c807ef181ea508d30a50d1e8f2ab602696
SHA512 2d3a26356484bd817177abb4f142da91af81c1193b26f76d0c90fd93e460fd3c49af853f14fe59405a1a94ba44a71784f102ed527c03d7a95f411363d443c940
SSDEEP 12288:hwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C65523D3548955B2EABC0039C6754428F5881E2DEB5658E3E3483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 9494c4cf86332764434fca70f999c98c2f4a8c19ec0d4a5a87c621a2c1d816d5
MD5 944b7d203099b756fc252a04da390ad1
SHA1 c69e782d7b5ee47ec958b44d077da0fe73fc8ed4
SHA512 4ca77a6202406a40081254ea98c1a1afd7bcebe6d9826c97230ea1558eba40e457ff06b8fa19344d2ce47cf57550f95e2496f16fc8511fa949913e12a8f1ef5e
SSDEEP 12288:EaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:E8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1265523D2558955B1EAFC0039C6764428F5881E2DEB5658E3E3483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 05e9913b09e736655566d365f2fb1e830ee4ab80c4c439eca2185202edfca77d
MD5 865d2b1ed245ae704a352fc2d551371b
SHA1 bc4b7ef43d360ed02eca90a78faefbc833a4944c
SHA512 508b9c811c283d1db656e8a431ee0452cf20adb2c95acb1c59abd8d261af69bf5c5cd44e53ab23738cc2e93fec6f5c067dd2b64ba6ea8e567e96e87f58ff7657
SSDEEP 12288:IVliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:c/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T132552392168900F1E9FD8039C6764424F2A47D6CD7325AEBD3003D1E5A75FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 dd73a171b3ac7589777047a3d21c7521063faf680c567001c77e54c51356b80f
MD5 6e2b3eb5654066deda1562f1ec869f6f
SHA1 70f529eeddfd3239bed55593a1db9897148c67db
SHA512 f6be26c9fecf9c94ca6b8d39c84f7105d1c77c66001123b1524ff47dfdcbc5c27dedef464e090110e90cee4f14d1263f30bf0d461158f0e351405c3dde099b7f
SSDEEP 12288:lNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12A5523D3548955B1E6BC0039C6764428F5881E2DEB5658E3E2483D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 836fd1dd2ad44337b092afe852652051bbce4c1a207350bb43c7860dbc3a999d
MD5 c4857d777a1d7053f9338f03d299021e
SHA1 3cca94c9d3371955f3b736da61422af57cda295d
SHA512 2df0e8a3f6dc5cf8d985780f8bcdd4eaf97719c7400fde9bfd18b5c5432c70b851a11fc5070068915263683060275a5dcacd288d87cb7de2d7c7a7f15992b4b7
SSDEEP 12288:78iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7G/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1075523D3558955B1EABC0039C6764428F5881E2DEB5618E3E3483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 cdd946b4e0478458aed514ed18ed36cc9096309d1f5858e02ed45490de261e88
MD5 b957361c624474718912ff1d3059547b
SHA1 6cdaa63f36973effcb4f5119ea83ef2b8c2dee39
SHA512 72509f73d154795a5abc99decc29f81ccdd7161b83dc4e68976137ab47200c2d1ca51ce5783dae6443ffdcc5617a8d148206aa7936efe8862c6013e3b6663eff
SSDEEP 12288:8YiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F15523D3548955B1EBBC003986754428F5882E2DEB5658E3E3483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 7fd905c940a7d596de7068491cd881c5e8ff1cd7655078ccd8bcd373ac016cfa
MD5 1c95818560b80bace901d3c059d25ed7
SHA1 f0f9f6d36b5516eff94bedd89b7a832b8800c50b
SHA512 8e6b1b1c995d559854e23459f3dc4e103653c5753f798264b68b503274c8a818c09f966380b725139d532edbd93268ff1a6cb40e251504d367fd37069edc5c4e
SSDEEP 24576:8ZM3zFVSOC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8ZM3zf2LNiXicJFFRGNzj3
TLSH
T1BD750295B39018F4EDB7813EC9258815E2B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e5fd71c944aa52890228737939e7830f0cdb57f3010830259817cdaa4f1fb623
MD5 efc57f336a09c77af4fd0c31dfd5094c
SHA1 9e6e572d907e8f27837b31f54026a625394d59fc
SHA512 d1aa7a11cb325b9a6c7ef927cabe986f8d685b666e59f32eb353447d7ae8c25f2f16bfd24c1fa0aa572cba480a75776baecb1475604eb1c1c051d0b8f54edf35
SSDEEP 12288:fHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12C5523D3558955B1EABC0039C6764428F5881E2DEB5658E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 31b95c524d7a2b73d516856670a953baefcc3279300d1bcd5c3befd37b86e02e
MD5 01cdf9790e3eae9c853ccec627fd8f48
SHA1 6f6daef65147978ce5eefb2a5c91a3e14a485da1
SHA512 9005808f18d0481b8503dfa155c13f83e05cf379eda8f5068a7746522850874dd6aa97d3a81e45ffa58d4a56613fb642c999b84a4a1a956f1016f2ce959db449
SSDEEP 12288:T7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Tv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1805523D3548955B1EBBC003986754428F5882E2DEB5659E3E2483D1EA23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 4b40fe177779dfe178030f67f9421c90aba3cb4466c8c8204589787e1678a61e
MD5 31dbf7d69f4a6f67dec38237059dea66
SHA1 4363be1487b4bfb86b00079de4ee74f774c40a5e
SHA512 814bfd7f75475122074e890a7878bb27fc6b12e0887109f469f8ae65db09df6b90ee58899f66664f7696279d2d67532b4907d7d00fa836c6ff53f27f0269f857
SSDEEP 24576:Gzy+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:G1LNiXicJFFRGNzj3
TLSH
T1E3650157629530F9E17A4139C9620911F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 aa6b313d79599ebc883205aa6e75c2f5bd4d549e758da0ef129dcf751f3d9077
MD5 76a2f65dba085b7a450a4cff9698402a
SHA1 626b351464a831fa88331facc91eb8106533f2b8
SHA512 0989f65672da8551d15c8d5be2f047b051c52617f28c6035329fedc712aabfd30ea3f22cbc8ad932290bbdd9d246e39b966da58b4d11ffe9342c7a79c63f825e
SSDEEP 12288:EHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ez/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1065523D3548955B1EAFC0039C6764428F5881E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 950abcc055b9209ce6b6902ee35f8bc65d839d224662236842869364fde13d5f
MD5 d122ba032940c8bbfc3bcc2a8ceab6a6
SHA1 763c407c905cab8119447ba2d2ca6e4b2c494c34
SHA512 295256dd260834508910b3a853d46a36ede2923d437178e47ce7ba50082432b78f8a0b54e4df38505eb139177b28a1d974b6d1a5e686ca3cd130bb8879850a80
SSDEEP 12288:CHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Cz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DC5523D3548955B1EABC003986754428F5882E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 63c7ac68c857857de3a52aac045d2391ed4b4152f43a647248b56ca6f99129cb
MD5 2ae0aaad5da76545623e99a623a7a50f
SHA1 5d26b82efb6e494f6265ce7803f10650725647c7
SHA512 9b358277c5682076a71ad6fe8efb0cdb7e33cf110c5083541a991c9b553bb644c6c70d7458d870081988ed7131a874308225686734f7a3bdeb958d17072c0d70
SSDEEP 24576:Fzy+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:F1LNiXicJFFRGNzj3
TLSH
T179650247629530F9E17A4139C9621911F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 a657acc702a289f3a2f8e0cde523de8ffc943f4cbbf522686c035690a2f0f796
MD5 23a69fe56a795c6862b85762a1f18205
SHA1 c135da895d5d15dfb89db87b567691fba8deab0a
SHA512 4d14f42275f0d90d8dbb68a1a382f20f2ab8045ed60166f05ab0f2062b89c5c5929f92439683d1c0f6c050fcc9f5a322ad9a4fcddc87d551fcfee587f9c48feb
SSDEEP 24576:AT8aLl3z0zDM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AT7LljdLNiXicJFFRGNzj3
TLSH
T12A7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 1b8fab903a0eb9a5de2f3511254b82c962d15ce02c3b3e1bfcfd278e13ea33d5
MD5 28c5b558d76876ac33c236805b3e51e6
SHA1 58b97cdb1cf8dee961bc7092aa7865f2e736d7f2
SHA512 99a55394f79063c282e896610cfb2bce2d2328ce5dce8e53256baae8582dc64ac75273d50e71aea7e1dcb430c194121942d9eedd285c0d50851322d633fa550f
SSDEEP 24576:a3rd9CHKy7GZA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8rd9CHKya2LNiXicJFFRGNzj3
TLSH
T1CD85CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 cdf1e36df20d26f6d2125ce2046a6fb6395d06627a394c5ff2f88053baf87802
MD5 32dfb40ff4caa09a95445975f056c461
SHA1 8e5aba6db06e7207ecf3b954cc41926671ad0d77
SHA512 2df7eda4e7c6023053525d4883566af165032e46773e02b47feb33473546e7a034ace144ae8834615390735803c338ae104fb5e12c46303ec7a271a51f1315f5
SSDEEP 12288:C6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Cc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16F5523D2548955B1FBFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 287153ee78e74085d3b5db0e0301d70614127dcdecdb5cd17c52eeefbb4183b3
MD5 dbe58561845665159006926cea4c09be
SHA1 4a5e459f6d10f2ae47f6b91c0914b8205ef21f92
SHA512 8845eb0acf65dd6995451b11152bc9ffe721e661abb69a6074e3c2c035a9dd235e143c28007fea3f55981d9014036674be0165deef305e6aac099af67702eebd
SSDEEP 12288:N0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ne/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17E5523D2558955B1F6BC003986764428F5881E2DDB5619E3E3483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 99ad6b8f7eb204714fcd7e7f93e6fb022348da60d47771db8fc5960e3e996252
MD5 dfef577c6060ea2fd3f95cd28c5aaa0a
SHA1 55f5e50e677050eeb8b6604b8982933d2e8d8eea
SHA512 b409f50366878d2e32288593efe03de313cd7740f2a2f61d47d40ce98ab2f9b031bba9d2da1af7faa0055b14d022b874927c40165f3349e3e08482246779705b
SSDEEP 12288:55iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5l/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C65523D3548955B1EAFC0039C6764428F5882E1DEB5658E3E2483D1EA27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 8112035766e5183856afe46042ca8571f771daff1702f29c7b38a74800ccfe90
MD5 6052167119c70cabcab8d64b98af7c8c
SHA1 0f6f69055fc33699dd74b72a4568d1f22dbef0c9
SHA512 a2a25b5b25acfdc6b876d1acf7c858f38bede5ec052dbb0a38741230fceeb75df1e4d8adad218128ba1bfe7b9d3dd1fe2548a2b301f58fe172537ca5d78da206
SSDEEP 12288:eHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ez/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B25523D3548955B1EBBC003E86754428F5881E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 5d732b42f258a80bff22b71064f8e20eb7a76b6f1a937572d8ef1753ba645c71
MD5 4240b2745a08082f6e0d40cc4751ed9c
SHA1 2c339a929174f9432716a51e0aa199eac3cf5ec4
SHA512 26b413f1ad83592d23f72a1a7beff0fd8b4b03089891abb47547edd0a805095c7b3c46aaee06007ebbb993d03504cd9da1f2441eb405414fa988b47f748388a6
SSDEEP 12288:+6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+c/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1145523D3558955B1EBFC0039C6764428F5881E2DEB5658E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 d24dc60e44dcce9ac67797594f75a26d0d24cb33b2f24981297496180d677789
MD5 2d5d6ab6c8c3c5c09aaa685822457f31
SHA1 6cf73cfa07ac79ec4b32b88b3f0ac84cd73d9eca
SHA512 9d022efef6bc62231f06f5591491bd5a632ac4ffc75aba04967826512cd2ef7957f20828917ac19b5191f6428a3e4f62960a980af07edd4cb7faf136943f66ce
SSDEEP 12288:EviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Eb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1215523D2548955B1EBBC003AC6754428F5881E2DEB5659E3E3483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 5ffcd2834b32f062d225f54ef80da6f3f7541873a110b8fad12995b836965f46
MD5 f633196c10385047616bc97a696ff3ee
SHA1 ecc5a2dcc4b18c0cbe7bd1e1353f9390d7e6add3
SHA512 a9b779835dbb2190df9ea705477fc8ba8671254df5816af92369c1d0263e5f157141b83ab6fd423ba1e5128508f1b8fd3d5d8cfef42cf2d3ce79e4b8c8922757
SSDEEP 12288:tNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1375523D3548955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 78d2c232d61190201d8427517efad2a4c0de406fd15aa60b318f93d593118392
MD5 71130a96b6012a932ce8a217a7020736
SHA1 9dc023485187b6390830fa6f28011499f4cacb1c
SHA512 e16a592312fe4648ded41d4d0717391c9c25b8f838b199697cd0934f6ff0b214edb6398e78936726f63285bec68fc9c85c03e4f7283ee7615f7cea843d58b0f3
SSDEEP 24576:9fwvzk9RX6wkyAIf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0MnYIfLNiXicJFFRGNzj3
TLSH
T1F485D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9a45b1dff3a591392dcd36c58102fbccc6304124b8efa2589c5adcc4620763fa
MD5 86769d27ba818c73fb13e7a8894607f8
SHA1 64c75ffcf2b7a1b8b59d8ed9818cb76a3bc3c4cc
SHA512 2f1149640f161781aab8acc16933afb485dde14940796c500570acb2a1c53286a046e94ec33c153fa3f77e06284699e3ebc3a31c6038f795c440bcfb89f4d5c1
SSDEEP 49152:fYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ILNiXicJFFRGN:CySzPA7wRGpj3
TLSH
T181066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 cf05b76dc71ca38d9ec99b5fbe9494ac36a69f8c766be0fdce74b5992456f664
MD5 7ed109dab415da5b861f6478e90d0848
SHA1 d1e58707322eacb59415c3fc6ac9d43f640a9f1f
SHA512 0be9d498c7577ebd22915ef8598758e37852a0824d8a3b0a3dc05c2d3cbff582927f0587dd41cbd6f56a67f701538b78d732a3fe4c33ee79c67b0b791a0fcb45
SSDEEP 24576:647Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:647JUQjqirIhCnDHUPfF/4LNiXicJFFS
TLSH
T1E465AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 38a56e5a2efe7889d021edf78f39982e24b5e663551d33a9b5b3e989af7bbb68
MD5 4bc13ec5d6ee4b5af23a96e7b2b57062
SHA1 a0cb2dcb3df0012dbd49bc848c7fc2894363580c
SHA512 8293f4eb4a9f1b0cc77b77f01bc96e791d3005796a6f6e4c5f151e1ccb07c767b266c9b033d08ec39e6d27c7312ea14eeda06fcac6c01f61789fd8df482b8fea
SSDEEP 12288:Qpsf3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:hD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19A65F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB92C0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 988KB
SHA256 3a0486aa470be83b04d005fd7fb31faea9157c2e6d38e109211a1854e967778f
MD5 63dadcb4c7d9fe8b3ae40b6b8743d936
SHA1 24a1c85fdbdc3f52bbf428caca916edc028ce579
SHA512 1b70f725b0778c619037f508d89b16cb70a0b62258b63ac510bdb9332854c14ba60759baa62413fba205df2a2140bbe4a4c1d5e45762dde8777916df0f879261
SSDEEP 6144:/sBC2naAxSvIVrPPniKotMxXN0TU3fVkwm+ep+whgooCqI/yzz/DoOiPsbLCmK18:gkmXwU3f7gYzz/FXC/u00LClI
TLSH
T1A1251701B66ADB4FC66944321E37C2CDA7707D41EE45AB0372C84B3FD576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 75ab44e994714941f047a64f31128e9c4a6cffa769e5d905acc3891cf6a5b843
MD5 f4f56ec2d375f844bb04766ed6eb2858
SHA1 da7838072224e8f8b9c4c04d43c005862219d05e
SHA512 162653baaa1404246a06fa4e659d0e442cc67b7e679c69e6d6831a5514f50c3731874ef5e0c1ca5387449574dba17061eb18f685d321b50f1749b9d30f3df0bc
SSDEEP 12288:Y6hHRP7CF6w9u1dHVIZ5YCGHybCANyhozqp:ZHRP7CF6w9uXHVIZ5YCGaCteg
TLSH
T12A55D9409136E38FD1B76132072A5B8DA764EC43B7056F26B3C8497AD86BB15A0BD3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 08a2b579a1220afed4af20fe1c193cba217f49c986aaaad61a1a2497af83cc6d
MD5 277b778b29847ddb1ef211e6d847fa87
SHA1 efc401f1523fe7a2e9856ad26c07c6cd0a2a5a79
SHA512 81fe1d6cddf81e544ea72ba4e01e9dd695b2e87b7aca3acc4fe5ff2aa342652fa4c8e8cba73db0ce34ccb0752c033d651bc3cc7209a83ea94c46257e1b1d559a
SSDEEP 12288:4F7fiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12B5523A3568859B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c5884a18ad2450d7afdd23091608120bfeafa3e8912c3aaa2eb8dd577ac6e5bc
MD5 62d9b924729653329679e2c65cd9f96a
SHA1 b8f7901737ded0e0f5715290bd11dcc98da6db7d
SHA512 8b1e9f3f66d6a8500276b4dbc42f5cf6f8cdc10c71a8d2fc1dcc20524a287e333e85511ab931cc5c02457972a47bba0aedf7fc744b4c7fd89d0af4d5ef1f04d0
SSDEEP 24576:4gb6bmBIi49WNNFpg1rSvFv7bYd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4gb4mBIBhGFyLNiXicJFFRGNzj3
TLSH
T13965AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 ed333a3318cc9fa3a1c5d42350e516654af91f690d868582ac4b0b84ebd8966b
MD5 f0b10356039f388ea38f15dbf5499313
SHA1 9f40e46964db88b1eb9ef57dbb4ccdf2d61a60a1
SHA512 e9f9825e7b866edd101f51e094544c91607a6cfb99d031a3a78f0272783d740a38a2bc32085aec7f30856f07b5a3c72d61c73ae80c6c61f6595cebb510bb9614
SSDEEP 24576:0G88u8FpJqH1vzria7/mC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:H7ZFPqVya7/FLNiXicJFFRGNzj3
TLSH
T18885F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 f8526498d42ca94092871d3608ce277960b6c1335ef706374ff3bca09cd75fcb
MD5 32243c8cf196a09de98d308cb5cf670d
SHA1 e8a6ff5d631662620023f521b23829899c5520df
SHA512 149b40e680777123683fd17289b828ae49836e3b2dcca9ed4c996d9e2f8d60617cf87f727c9cbac364bd0a08bf197cc152b32c54a31e43c2f6c58a69cb0b5323
SSDEEP 24576:8PUr+NQ2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8JQ2LNiXicJFFRGNzj3
TLSH
T1DF65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8f25a9bb3598fa08c445357a3476bcce32b5e241090d8f1d48caade0df38b7bb
MD5 361a0e4d084035082075f17eb861d617
SHA1 e8dff2964b64ce467d27efe872c09204d0f19399
SHA512 e338df16b53e53e13ffaa41c0e38b4bcd9035340e705488ce8356c66a358e130d580fb2501fbc35f39438d7732e821c693bb2585aaecdbe88429562f694e594d
SSDEEP 49152:yBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjGLNiXicJFFRGNzj3:9G05lO43bn7wRGpj3
TLSH
T168D5C06E62EC11F9D1BBD07CD9C6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4daeaf1657a714c900552c954fca381acd20dd9ced3f9797f5e8a440925758e6
MD5 6aeec366797ba7f7ce021ab3fcc23a5b
SHA1 246d4a31a6898f65d064418a27e38b5c6549d49d
SHA512 cf1344c0776b11f67aa5bb6d344cdee5a3d4e428468f2cb4cdf021a39964fc2d784c8b8b0da5bede223ff7e6fae831f5870b534a5511ddf5ca84600079b53e9b
SSDEEP 24576:ofa5POZ3dpyWVM50JicR2hG0lasx2+47eidnI/TwSfVcYG3K/cJHlnFR+IGNe8jg:Qa5POZ3lJt2pasx2+meLNiXicJFFRGNf
TLSH
T1F165BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d8874534e2bb8a2dbc013c127fded22f71da951c26d09d10fbff1d8a42b71e31
MD5 d306b904b3d313eb3c68b3d073b1c7fc
SHA1 dd3149ed5f326b213c285c9f588590c3a7a13261
SHA512 1b4ab7cad6f4257b50561e072daac98db9505f978fb7727bfc5e95e64c2e2e31602268dd92381f1eba466c637b0458530878bec128e0a5cca69abefabf5be513
SSDEEP 24576:/NcwHdjbyQ4nLC18lb/EOjowL7Fk6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/Nc/zEOVHFlLNiXicJFFRGNzj3
TLSH
T12F858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fb4074648d94565870996fb1e6580ba57d526df11737b18ddf84963c915db16f
MD5 dfd20b8fc25aa9012ebd50b7ab8f51d6
SHA1 145fb5116ad597738966bb3fdbdbe32caac738f5
SHA512 518babd536f959586d631be4a533d171d2f2b69b2923cbe262a18de7fad84a5d7e35c4e8896f35e976bdd401998a85b8c6b0cabd3b19ddc49634486d37d96f1a
SSDEEP 24576:QzkNvNnaFeYhJNtmZBmUd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QzMwBtOmOLNiXicJFFRGNzj3
TLSH
T14055AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 92722eb2c91b45b6ef43e51818c9dbf7a6aa3e22f4abe0a384672628d1797d31
MD5 fcdedec0eb690829493b7077e06ed358
SHA1 c3af17eadf1d792fdba1356b8e6544f9d2372ff4
SHA512 5874a109fb26175aa253ed4a32e9e42113685ef40b902812ae1165657fe287f7d6a80e0078658297e96b7d22e994065772f12ec0f6484f7ce52444c13b50eaee
SSDEEP 24576:KD3FHshBIYQgAX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KDVHeBIAAXLNiXicJFFRGNzj3
TLSH
T1B475E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/368-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/368-152-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/368-146-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/368-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/408-20-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/408-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/408-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/408-102-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/408-13-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/692-64-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/692-57-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/692-276-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/692-58-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1180-68-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1180-76-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1180-70-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1180-296-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1188-42-0x0000000002320000-0x0000000002380000-memory.dmp

Download

memory/1188-52-0x0000000002320000-0x0000000002380000-memory.dmp

Download

memory/1188-54-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1188-49-0x0000000002320000-0x0000000002380000-memory.dmp

Download

memory/1188-48-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1648-314-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1648-117-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1648-123-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1648-116-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2464-330-0x0000025CA5710000-0x0000025CA5958000-memory.dmp

Download

memory/2464-410-0x0000025CA5480000-0x0000025CA570B000-memory.dmp

Download

memory/2464-411-0x0000025CA5710000-0x0000025CA5958000-memory.dmp

Download

memory/2464-329-0x0000025CA5480000-0x0000025CA570B000-memory.dmp

Download

memory/3216-130-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3216-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3216-136-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3216-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3216-140-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4408-127-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4408-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4408-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4408-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4448-80-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4448-311-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4448-86-0x0000000000910000-0x0000000000976000-memory.dmp

Download

memory/4448-81-0x0000000000910000-0x0000000000976000-memory.dmp

Download

memory/4768-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4768-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4768-110-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4768-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4768-315-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4768-104-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5008-0-0x0000000000400000-0x0000000000607000-memory.dmp

Download

memory/5008-28-0x0000000000400000-0x0000000000607000-memory.dmp

Download

memory/5008-6-0x0000000002470000-0x00000000024D6000-memory.dmp

Download

memory/5008-8-0x0000000002470000-0x00000000024D6000-memory.dmp

Download

memory/5008-1-0x0000000002470000-0x00000000024D6000-memory.dmp

Download

memory/5560-91-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5560-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5560-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5560-333-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5560-97-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5560-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download