ce4d03745d9eaad88548bcb1137158d1541513933e3f296b50ad6f905894d2d9

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 12:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_998ec8db33a5ad769b77ff008c780e82_elex_redline-stealer_rhadamanthys_stop.exe
Size 1.5MB
Sample260720-p7xt6sc15s
SHA256 ce4d03745d9eaad88548bcb1137158d1541513933e3f296b50ad6f905894d2d9
MD5 998ec8db33a5ad769b77ff008c780e82
SHA1 b90860a7c4a4db2c4f08f9e0cb8c44385390eb8f
SHA512 853ce12f3c32e822653581fe6252c9ff80b408887d42a50abfacace0d61db028a9f7764c305c8b9f2894aacb9d09112d5f5505bc307922f4024e81ec2159f036
SSDEEP 12288:EVv0Sbh1S5UyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+oL4fv:2Mk1S5UyX60d/kSDRBv4bJSvzQG4X
TLSH
T1A97512027781D037C6436CB1756DD2A04B3EB8350B79D603BB666E273EB67E2463A391
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
4312	elevation_service.exe
3016	maintenanceservice.exe
3652	OSE.EXE
2792	PerceptionSimulationService.exe
3036	perfhost.exe
4880	ReFsDedupSvc.exe
256	SensorDataService.exe
4588	ssh-agent.exe
5996	AgentService.exe
5888	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-20_998ec8db33a5ad769b77ff008c780e82_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_998ec8db33a5ad769b77ff008c780e82_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-20_998ec8db33a5ad769b77ff008c780e82_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_998ec8db33a5ad769b77ff008c780e82_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\214f064623e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	OSE.EXE
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	OSE.EXE
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-20_998ec8db33a5ad769b77ff008c780e82_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_998ec8db33a5ad769b77ff008c780e82_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6a8af8e4718dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb5e1dd04718dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000680431d04718dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb62c08e4718dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000a228128f4718dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c284b1d04718dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae2d0e8f4718dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4312	elevation_service.exe
4312	elevation_service.exe
4312	elevation_service.exe
4312	elevation_service.exe
4312	elevation_service.exe
4312	elevation_service.exe
4312	elevation_service.exe
3652	OSE.EXE
3652	OSE.EXE
3652	OSE.EXE
3652	OSE.EXE
3652	OSE.EXE
3652	OSE.EXE
3652	OSE.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2572	2026-07-20_998ec8db33a5ad769b77ff008c780e82_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	4312	elevation_service.exe
Token: SeBackupPrivilege	4880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4880	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5996	AgentService.exe
Token: 33	5888	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5888	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5888	SearchIndexer.exe
Token: SeDebugPrivilege	4312	elevation_service.exe
Token: SeDebugPrivilege	3652	OSE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 3196	2572	2026-07-20_998ec8db33a5ad769b77ff008c780e82_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 5888 wrote to memory of 4220	5888	SearchIndexer.exe	101
PID 5888 wrote to memory of 2412	5888	SearchIndexer.exe	102
PID 5888 wrote to memory of 1272	5888	SearchIndexer.exe	103
PID 5888 wrote to memory of 3244	5888	SearchIndexer.exe	104
PID 5888 wrote to memory of 4308	5888	SearchIndexer.exe	108
PID 5888 wrote to memory of 3604	5888	SearchIndexer.exe	109
PID 5888 wrote to memory of 1968	5888	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-07-20_998ec8db33a5ad769b77ff008c780e82_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_998ec8db33a5ad769b77ff008c780e82_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /tn "SmadavSecondaryUpdater" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3196

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4312

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3016

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3652

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2792

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3036

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4880

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:256

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4588

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5996

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5888
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4220
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2412
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1608 1620 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1272
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1664 1652 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3244
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4308
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1664 1652 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3604
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1608 1620 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 db819e65674e9766c57fd0a0e97618a157eba61a15d5b7d03c844c2398a09333
MD5 98f82daacea27fd10a5df887c6ce3bc3
SHA1 95eaa0badfa1f6cf4e3690d1d8aa3407f3911b4c
SHA512 34dda1820fbdb6395c6f7a7bda8a8a1ea7a6b3ffbba994d8952de891c586a3ca654359fa3d8c7770b23821665169e99f735c57e7c094881197fa504a74baf7b4
SSDEEP 49152:Qb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnNUybbzv4bJSv87:63q6HjBQZbHmk8
TLSH
T145D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 8af1fb6331c7f8a8e49feb824a5ee47af3388f8e46399a77b25013f9804bfbf6
MD5 5c40db1b242790b543657899e18d6e39
SHA1 3ac9c5eb2be4d4fa9eb007022aa8735cbd700450
SHA512 6c79567afebff27bae7abf6cb194fb859e18f559f133b8610fc98e88f16836041bb6648917aa1462e8186a65f8b59dc5e181d4435ffbf569ae6496c2cf71a61c
SSDEEP 24576:DXYfDtczAkUyX60d/kSDRBv4bJSvzQG4X:GtcjUybbzv4bJSv87
TLSH
T11F85F12973E449F9ED678179CDA28111EB33B8694760EB8B03B499250F333D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 e4ae8dcac33dedde730573cc8bf212a662e152cd0dc23ca8953c9c806f02a60d
MD5 4ed5ca2e9ceafc6455bd47a3e8ce2076
SHA1 438f9984f45697aee7980bd1e7ffd9a53dfcb5cf
SHA512 23f48690b3f8c6e48c936eb5549c07dfecaae9a8d70393a61e313bedf74ee089c5dd92f9d79fba106524b8cda6ef7df389f1878b06e9719bb84747e269faf6bf
SSDEEP 24576:w0Le5ji0hmxorMJUyX60d/kSDRBv4bJSvzQG4X:wPji0AmSUybbzv4bJSv87
TLSH
T176959E16F6748735D073C0B9C5D2A69EEA3230861B308ACB4296D77C3E677E6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 830a7e3da28b09174c66ff52a6261ce98f613c858eb70a719e0ea4eddfd13e88
MD5 26f63b2d2e36f877ae0f5f4ceef723c2
SHA1 aa3964661f76eca0a0efee4fdbccc723cf4623e9
SHA512 3699665307f0790e220ec1b2c6a0ee4d8a33eb2ea4b0be73bc2c8875326b8fb073e767f0d71c9b1565884eb89f8659fd32621914008287af1dac126c33f2b208
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWE6q8wyuzUyX60d/kSDRBv4bJSvzQG4X:E/ezSC6vUzPvxHjy2Uybbzv4bJSv87
TLSH
T1A8755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089CB4246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f7bee289a4d76c89dede601d2c365bf86eae2c8762b4dc33dded596b4c457c35
MD5 98c734b3b78d55edd7689eda88f12dd6
SHA1 c1b7bec70df14a79a65679ef018d07e37af9f4e4
SHA512 feb99a3daaedee86780c3d5397d1a3376bc76416cff0dd2ef94d40e52cd528f9f62b246060d70222f48ddf8d94b49b29e24fab0c91aa34ad4d7eb9846edbe322
SSDEEP 24576:FVbqPb88hv/l+6AUyX60d/kSDRBv4bJSvzQG4X:FVO88hXl+NUybbzv4bJSv87
TLSH
T1B6559E66F674C331D073C0BAC5D2A69AEE3234425B318ACB0246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 15c7288e49058e0a72c654fd03aaa6e0fbe1a02f66beb3d18e3a6dc92613d570
MD5 eb9b5f75fd77463141a1d20165da5c3f
SHA1 48eae87053af72100928a0e9a7a0f8fcf042ae89
SHA512 c93fd9b4a4ca4741e04676dd44b63aafbd61c637c2b78178709b5a863d40480cccd83087528b5fc11864e9df972951677d22c25734115b3e8a1a9030efad1aca
SSDEEP 12288:cXVUyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+oL4fv:cXVUyX60d/kSDRBv4bJSvzQG4X
TLSH
T1B965234323D5DA25EBAB88B13EF9A1A5073BFC7C0D5A9F05CB7BF1100979696802F611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 e535e0c45d0ec735cbb183aa003c0ba19a54647389840c4056766b5eb1b14b3d
MD5 47176a958bd49ff0f30c6707945c8da6
SHA1 22a8ec0b5ef2cf1f658d5dc8b6b0e4651cb1b68a
SHA512 ff6eede8e5dd983aeffc6914e9699d5f63034aa70bca23047d099f5b4751b566491b91bf28cc9fe6d69ff4bcba99e981e52f7f8e89a68da16bd72483d470d203
SSDEEP 12288:heBNUbTVO86UYUyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+oL4fv:hJIUYUyX60d/kSDRBv4bJSvzQG4X
TLSH
T15E85CF3BAE28FCD2C27A8DB95B91C240977278704F52A3CBD175C20E9E235E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a5a535f633b69ea8bd02fa6511f3b6280a9391e118d1f5709735a7d6318f131e
MD5 fe0850551d0377e5dec04e94d3a99b93
SHA1 877d4fa2cf0898368b70c5ca1ee59bd03345825a
SHA512 0c9a7c753e2731eb6fe54a1a5e371e0c826c36b3b8b7eef406d6cef48883f3949dc85bb7b77a5c7b870270bcab39ea4da06fe689a7af1f09a004de0e8d276f13
SSDEEP 49152:lQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THP:lQvGAdlCEL8c/yRNw5CDZbHmk8
TLSH
T1CD266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 f88fdccef9d81b0c6e85fd30a5789cbe28075d301bbfecfb66121502324da9c1
MD5 b358763c83b30d153cf947505b8d87a6
SHA1 480396d6b3569f715609806b57eb739b75270dbb
SHA512 3288a70e4b2039f8f14950940ccab1efd8419b76e0306e5f85cf45d9cf76b79c1bfcb3549ca025d98c72ee3511ff16e4c3aff6db120d57bc8225f15c573ab8bc
SSDEEP 12288:uAwSfxL/2Dc3iDLLmt0LDQewsAjiUyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOT:TrewsAjiUyX60d/kSDRBv4bJSvzQG4X
TLSH
T14185E031FA74E436C7BB0CB22B76D716143DB9204F511AC3E3B89A9D59342D2237AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8db169339187be18ff7a6cfb3cc9dbf24356581f775cc8defe47d031f0805330
MD5 a7baf54276763b525d0d1464116285dc
SHA1 f9e69112cac177b05c789cd731dd93fccd73188b
SHA512 559f83c7e19a38e7276b3307466fee8e5de0c49688b61d1c74033ad0d19dd0c89a22ab80b7d5aae512b8be3b1d9b121cfb989f8faaf76d2f4935812ccad5962f
SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHKZD:eUEtQevvqc2W1cpV2EI324
TLSH
T1B1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 37e8a9fc84a1909d733eed55f39f867294cfb00e5fc9a3845ffa4ada0175c4d6
MD5 b841b8b1007ab6be8ce761d63b03ce86
SHA1 8c54d12657d4c459ab3f5dc0a45406c0683f502b
SHA512 967a342ecfec74268b619cbce03b9f0b14f11503be57710da35292f00a3922b91c8c73edd7e635a8e442944983e0dfe61f99c88b83741fb102e3ca7e36530890
SSDEEP 49152:DCbRquA/m2yL5zifFiV+XenmE3/zCUybbzv4bJSv87:8oqHVjnmHZbHmk8
TLSH
T1E5D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c0d02cc6c1fe56a571e98bc22b4ec4fd26ec0fa7d4bf7e13889fe750e4a5d85b
MD5 9e566ad52f0ceb45e12be0aa619050a5
SHA1 e1c013d8d4f847f26665312875d50245946170f9
SHA512 2de030dea709bd2bd46921d9d29bc11baab28efc0dffd66c64712ee7f0f34bdae993ff12b8e624eab6b83023ed3d09a7fb83a16c7477fb671ed5c90c29cddc6f
SSDEEP 24576:bAhGLJIFoiwtA5l7S53nUyX60d/kSDRBv4bJSvzQG4X:bAMyFoiq5XUybbzv4bJSv87
TLSH
T137359D81E7F955D4F5B3AAB899B69170EA76BCAA5E31C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 46df0f459e26db99e68e2e0a6c8153aaee5eb387e2c44d78906e70a26142e260
MD5 1d1c270af3f6f498c0bd8485269382c1
SHA1 025951e7a5deace90a540fd26d8bb0b0648f00df
SHA512 54e7643aceee8067c50947f79f6f31abf6708806ecccf1e29c93a0043b3c2e6776e4e3b562dbb973511403b726ba95f40093b176702a3184a76c90553fce38ec
SSDEEP 12288:cmw5HEjsChNjBFgl0WDm+CTUyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+os:ZwuCOWWUyX60d/kSDRBv4bJSvzQG4X
TLSH
T15885F14633A44CF9EAA781398997C136E7B2BC152A25DB1F0770C65B1F373616D2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 28dd15a1f95db38b434ce9a63022f508e4b41f08b01209d15bc86c63717a1397
MD5 9955cb691cba92b5331f71d193f2f183
SHA1 d016192c8354f857621911bbf9dce92afaa301b9
SHA512 8e2859479a6c2ebb360464645c18d8c621fbf4734c0534765a6199129a9b148d697323be968b02d6b13df5ed3365d60cf208431a0c7bbd1d9c9a37af8c702d7b
SSDEEP 12288:ezZ1IyyUyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+oL4fv:KZuhUyX60d/kSDRBv4bJSvzQG4X
TLSH
T1BF75128633E4A1B9E2A78179ADF592458732B86A073647CF477692651F33BC20C3E731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0d3c8935e8752dd5c4297c89f37a6a5dba0490abd62c20667aeb8df23762a8a5
MD5 8188d7206b0781b1ab788859fbe112c2
SHA1 8b24d876f6107106fd0abe9e8c336ccd7a890417
SHA512 ca97f6f1ce609eb5c6fc80b699974502934b7b2a3842b2815d6a688a70ebdb65fdb29d22f02b14e585f9a15aedb77d292d197e1586ec4ef984ed25983fa9678f
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uj:aQRQyi36YOcPQLvw2gAf+PN38ZbHmk8
TLSH
T1A9666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 735ecb177e7055fb0bf1500a332794a1765d9a02afcbf4b5c4779e675c69d66e
MD5 4ded27aa0077fb6395c7b797a8768084
SHA1 dda5062a72e44479af390e995e69899f463269c4
SHA512 401d9c5cc3bbbf3c20dd42498a5c7d8c95558092665a8a1e5db37e6ab5c3b4f7a4e515beac08c0e0d4326ba6f24ff7315faca871c2bd04a900d552523af56279
SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uj:AQRQyi36YOcPQLvw2gAf+PN38ZbHmk8
TLSH
T151666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e4a08de7c4037b04a2878d07bd555c97fde92b7f4f5982ad74267b5a7efbecf0
MD5 40d5db42b695ad7128d524f1eea37798
SHA1 13f7a65fc4a49361b642b821415d839d3c28c8df
SHA512 ae7a41d8b6f4e1ecacc79fad59736d8b1ccd4c0fee9bc32fffb945ac5d769329e99ef86fd88b694629798866e7d3fe99160683b87421bd2fbbba00d709074dc7
SSDEEP 49152:S68Qg55nhheWu7PNU3/SUybbzv4bJSv87:QthWRc/SZbHmk8
TLSH
T181B55933B2F600A9C44DE1769F4A873196D27C758FE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b0ce6dcf3a8fcb2a6d4c16df56106e0d8e66e10581c5584172c448e10c5a7056
MD5 888a8c4a47d315ded68a5e9cadb8d94e
SHA1 cf31f1724b6fdf0bf9f801bf8e501a96ff1fdf47
SHA512 8238ae77074ecf4099920811f1086fc177ce9336be04c18580baa1b0042ce58dc12ca8ecd2c9a6cc709f169253940df59403e38b45a217768ec74b0df034ff11
SSDEEP 49152:x3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99R:Qy5112gYy5azzVvL69nLKnhZVZbHmk8
TLSH
T131167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 95a63a4bf6e210747acf457f0f10e917df7ffdd1ac360f717986719302368512
MD5 45ea1859b7a5eb5983312eeec4495c3a
SHA1 761ad3dc3901839ef57a1bdd9b5caa502a08c908
SHA512 3dfd9d62b14d5347b91078f2442ec4c3eb5e3863342354512f2121fc01030384e97584cb0b445a6ace976cca19208c283ab27eb5ed65e6a909c6106249ca3c40
SSDEEP 49152:ZB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl8Uybbzv4bJSv87:Pu6JmVxd2d8ZbHmk8
TLSH
T16ED59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 92d02c5a056dfe736d7603e8e5783d81e0c41d10ba1fe143727f41c7b30eca37
MD5 a00ed60098dd6ecc2487ca67884feda9
SHA1 8fa6326d250288a2bc5398dea8b4e3f5860fb68b
SHA512 a77e2e23e2d43ad20ac7599e7ea0825dcef3ee4de8dd6aa7472bf89ac65c1f2d95af3b7318ae1b8b687b27a4b471eaea86113716aa3497a2eb2645099ec5bcda
SSDEEP 49152:I1hpsNoJpF1A6UU44CwH7R4x4Uybbzv4bJSv87:ImifPbRHZbHmk8
TLSH
T103B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c2e7d82c842d9c80cfdc9afc72b71dd7c9bb36ff4dfebf37b790b66290b78cd7
MD5 661f4513c73c374a92c3af420e429e9e
SHA1 6142b5efbcea1d915c05210882f9233782cd359b
SHA512 cfe6e85d8f825a776ec9a2d71a4fcc0659fd9241ca8f14235a77198991261e8f026a0696365ce4b074d62413011ce08976eb60a85c21f9b8fd2628c8f72b7fa8
SSDEEP 49152:9SuZQIY0Be2KRRVtOnks6NMHqhUybbzv4bJSv87:T5dKTi61hZbHmk8
TLSH
T120C5BE03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7de1c3ee064c89a1497f166e5f39e1a20760a6496d0db81e1f9208c70dfd0b1c
MD5 d214d0c234eabc66e1f8b3ac1d13e781
SHA1 e81f4a472f50bcc371009b4385fbf10bcadf2020
SHA512 e2da0b69ce25fdf0fe374fba0b017e7347111dc246f0e799ee3e77e3a826ff5d96b09ca216685cc9210e2be224bc35cf2b815a61b34eed07770d58b11cb3c312
SSDEEP 49152:vhtSn8EApI0figngiDn0AP5wkUybbzv4bJSv87:+X2iyphLZbHmk8
TLSH
T1C695BE13F2D901E8D05ED074C7568632EA62BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 aa01caf109b7674312323a2976ef6a27ef337b439da118257885fabd8cff2f7d
MD5 121ab59a5d2fab7b46130a64cd25b3f3
SHA1 613ebf783bb84404a51f161b131732cafa17994d
SHA512 2efbde6673fd36cbbbe6fd44bc7b468c7aa4f3ba84ac053d60613ed523ae404168c23fdcf7e79f56aaedd01494fba21f80bb409e7996f69b1046c71ddc644451
SSDEEP 12288:NNUyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+oL4fv:NNUyX60d/kSDRBv4bJSvzQG4X
TLSH
T11165234333D6DB29E75684F27EE5A295073EBC7E4D5A5B09CBBFE0100A797D6002E620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 6bd471463026ce14922e8e4d305d66cc81f895468bfb9e6a3c2184c78416e666
MD5 6faa8aae6dc5e303334f9052c2b09869
SHA1 4af46bfd56e6fb5ae72b20f67b8066149601f0e4
SHA512 948623e7e1b90fcd3f839507a8f4f89ea01b3e67ad106fc8922a11370cdf7f28aeaf2247008a4d4d9bdb7a0ef6f58374ac2a779bf4e4623f24e0b239b1f0bec1
SSDEEP 12288:ReUyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+oL4fvw:ReUyX60d/kSDRBv4bJSvzQG4X
TLSH
T1C065234233D6DB29E75684F27EE5A294073EBC7E4D565B09CBBFE0101A79796002EA20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 3321e2ebf06b05eb3856c1dcd87586ba4652befb306dbf1dcfe80b7838100410
MD5 1c59dd82124db3799a93b97f1e22023c
SHA1 494ca3f8501c00a22ada8f5b8b9ece43a03901b0
SHA512 979d2bfc7808a3cf98a25f287a020c65c1c1cd156a739b98d3077bfddac082fa4e1a499aada0e75d173349bc5a25d0314b5d484fd139d7e944a97bdf09a58a7f
SSDEEP 12288:9wUyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+oL4fv:9wUyX60d/kSDRBv4bJSvzQG4X
TLSH
T1DB65234233D6DB19E79684F27EE5A294073EBC7E4D575B09CBBFE0100A79796002F620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 138240c53650d97dd6b8e2ae175fdc09758faeaf9a199f5175308a3344609738
MD5 6a53f21e208da0f2f5171e87ec0695c5
SHA1 c8282e068de4e9c4084d08299e230d7f42656d1b
SHA512 be38b61ff4c34b327fdf0168c0caaadf03032753d0ce4da31771a6e75e96c4d43a763ddde90f687e9db8dddef54afc748ffa6eb0b4d856405803547701fee179
SSDEEP 12288:aVHUyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+oL4fv:+UyX60d/kSDRBv4bJSvzQG4X
TLSH
T1B065234233D9C695DAA7C4B1AEF5A255833BBCBD4B269B4FCB7690110E713D1143EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 6aae7ad5d979d7477e3dc413f343b37c174f861d2ca015e272a7ce5217f6acb8
MD5 acb2c1e4d03a878490cd30374eb8a4f6
SHA1 a9480636b4c4a58321bb980dd63097234cfbb6f8
SHA512 ae92e25edeb44911d0dc5ecbeb46702029b1a678c69655e5fd41fbcf5f4d2f77cf458dfbf46ed648e195dd4c06024c4548b6eac59adcd663397075245545fde7
SSDEEP 12288:NvUyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+oL4fv:NvUyX60d/kSDRBv4bJSvzQG4X
TLSH
T18E65234233DADB19E75784F27EE5A295073EBC7E4D5B5B09CBBFE0100A79796002E620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 479c7c839f2d3449aa0a4b5e91fbfff884c7cd7d0cf86069130b9ba4c654f99a
MD5 e8b412fd34e845de71f65d04a02df972
SHA1 57306f83f4110bc9bbb9584058d741765eb860f6
SHA512 48fef593cbc6bcb46c49b31f1caa810dd05314e8aefcaeffb932b862da1289cb3a2fa28135109d6ece70e4cceb62ac0d39fc5ffab6907e3205d5202601ecd854
SSDEEP 12288:GaUyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+oL4fv:GaUyX60d/kSDRBv4bJSvzQG4X
TLSH
T16765234233DACB29E75784F27EE5A295073EBC7E4D575B09CBBFE0101A79796002E620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 06d168f021b69ec24c8b645c1e26d2288cab12fcda8743e6fb0a5feacf9653f7
MD5 db01b132412d6b67410d7341be32452a
SHA1 f043d5b6a9285ffe07b98ffa104e0b0c3a18e3c0
SHA512 1c88818d5748f9a9c3187d60ef646a53e9b0a07192f386901cf17552b401a4225f63b346048e00081a69d61bdb9656deb783e638fd2c87bf891aff8769b1230f
SSDEEP 12288:dGUyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+oL4fv:dGUyX60d/kSDRBv4bJSvzQG4X
TLSH
T10365234233D6DB19E75784F27EE5A298073FBC7E4D5A5B09CB7FE0101A79796002E620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 d4f52db3f5666591b1d79bb33a4a9c0ea57290b608d5a944cb55fe70e3aa6390
MD5 d936069070e2daba2266fe91cd16f334
SHA1 0155c46ff80857f296dc8cc314f84e6bd2b50b39
SHA512 5e6fdbe105316b01f9613f079ea7462d8f3f83028adadc12617122919ca54f61040ed3b58bd4599d62bbe35ad0939605fc402cf41667197bb11bfb90f5760bbd
SSDEEP 24576:SZMUzFVSO+UyX60d/kSDRBv4bJSvzQG4X:SZMUzfqUybbzv4bJSv87
TLSH
T172850195739058F8ED67813ECD659906D6B2BC6A0B60CB0F07B936261F333A11C3EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 c84af6c36a630f303eea7d9a89251bae7e6f942248f72963fbe7eefe4a1e03df
MD5 9509030fe8aef5dfa20f03a1d6263192
SHA1 e197b7a678eee98c394d9586631bfbf7d99f9477
SHA512 33fd4dcd096c576e4d4b543ad16422f15836a1e2ce9b7ea6117944f39b5b3bf498122c289e785e5291f0365ffd23fd1fb83b8dade04bc0fa8a78faf4050b2d9d
SSDEEP 12288:RxUyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+oL4fv:RxUyX60d/kSDRBv4bJSvzQG4X
TLSH
T11F65234333D6DA19E75784F27EE5A298073EBCBE4D575B09CBBFE0101A79796002E620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 a6fa347c35c4502ac82c74346b772353a01b2e0ce0f408d5affc05c6d4d4cbf7
MD5 a88c972e7625001f1487d238d26e33b8
SHA1 6a2f93622e49e223748cdbad5b93fe3ab5792ff5
SHA512 8606f3c42bfd123097ab3eddc278e584f6451d28d96bcf66ad80ced7a224d1ff177cd0d3ccf3d90ed58e8dce6156ea465693b20b8b749544a6d9bcb985c1d423
SSDEEP 12288:hlUyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+oL4fv:hlUyX60d/kSDRBv4bJSvzQG4X
TLSH
T1B765234333D6CB29E75684F27EE5A298073EBC7E4D575B09CB7FE0101A79796042E620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 dab57fd9b3872933ebc1e09bb6f762b6c7304f2a5c9f98c91aa4c750a5d45458
MD5 0be04857e5e613b5319910484e84815c
SHA1 a4a4db1c19e0aadc851415961d6c0ff7295081e5
SHA512 92923c84c9e7450f89da2e1ff8c5be61f52c26f2a9e0b65ff1a6c377585b5426856eaa919ae6c5878a7348541402d8fc6bc977b47f92d1eec5f21765bdef34a8
SSDEEP 12288:nyPz5L8yUyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+oL4fv:KzyyUyX60d/kSDRBv4bJSvzQG4X
TLSH
T11B75014733A571F9D277817589A21A02E736B83A0B258F9F47B482362F376D15D3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 66e17ffd65e3f342c0c514e3fd3591942a59da05954f361c544fe40564d6a907
MD5 304d35a60805b467737957d771b0e24b
SHA1 fafb83f8a7768c07a1bcf5d4d0d82d65e5c895cd
SHA512 f5884f635dd2ca33f3c83a29c5c5cd17a626a74584f24d9cc842a7c803011b0a9ff9e1941467a1b628b2a9c2ec4bd8f3c98cf529c9d3c62aca41f75749406409
SSDEEP 12288:5xUyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+oL4fv:5xUyX60d/kSDRBv4bJSvzQG4X
TLSH
T17965234333D6DA19E75784F27EE5A298073EBCBE4D575B09CBBFE0101A79796002E620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 2e8e115f142029f623528735cc38ad1bbd8e8e3bd11ed6fbcf4ad2b56d32261f
MD5 d40611a8fe100a0b91d4f54a305a8c5e
SHA1 046d5d7edaacf78b0bf56bab950c52bfa07fdd93
SHA512 86fb90b7309906cabce6cd827e4f96692eed62545dff4ac118c470099eb50ec2b5efa123f57880b78fb0e12333ee3521c7e87dea71e3d696eaf825c29be857b4
SSDEEP 12288:mxUyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+oL4fv:mxUyX60d/kSDRBv4bJSvzQG4X
TLSH
T14165234333D6DA29E75784F27EE5A298073EBC7E4D575B09CBBFE0101A79796002E620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 e886ed674b8d5e57ce932bce7af8c99122d7d04e9cf8694fc0ca5ae3d7bae48e
MD5 d2468af5348f66fb2ca3917c409349ea
SHA1 14ba6cc88f827d5d2d3ae9003e629d043590bc33
SHA512 8a6a069fcf4960abc1446d3e6e4dd631577728f525d28b9d5eab966c71b877b400fd428ee3969de787845c8cd1821b3d5ddd7487528432e8c03ae359a5d1ffc6
SSDEEP 12288:cyPz5L8yUyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+oL4fv:FzyyUyX60d/kSDRBv4bJSvzQG4X
TLSH
T19175014733A571F9D277817589A21A02E736B83A0B258F9F47B442362F376E15D3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 a37ee152534594737e51d17a5597b790a91a3bb9706287a241994156a79e52e7
MD5 a203af84d79c6d0a78ba1ad0681ab8c6
SHA1 7d6f8d068a667e547e28b330324984c21b134456
SHA512 bf66903089cf3086e7b7783ea4c7fa83f6cfe979ab455577f3dc4dad204a3b121df472190c359e819f117a375535b408696a535d828c2598bcdf22f05efa5339
SSDEEP 24576:LTtaLl3z0zDgUyX60d/kSDRBv4bJSvzQG4X:LTgLljzUybbzv4bJSv87
TLSH
T107850195739058F8ED67817ECD658916C6B2BC6A0B60CB1F07B836261F333A11C3EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 67295738e34338d022074e2daf835ce60929de3ecae75a93a964173585fa240b
MD5 86a697f577946e11114b4666312ddbd2
SHA1 c2da0b7d5583b7073f1eb4db3dab77cc74c52d55
SHA512 ba341dbf0362ec88a3273583cb0bf197588af86c10df8e111a2fd2adabbf6b385bdcc64e3d08d19f8e7511e5f295b20186d24e5f73a8528fded22e0fadfe8cb4
SSDEEP 24576:03Jd9CHKy7GZcUyX60d/kSDRBv4bJSvzQG4X:+Jd9CHKyaqUybbzv4bJSv87
TLSH
T17995CF90B3E414E8F1B78A358D765511CA767C6A1B31DE8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 0f84d08501452a243b52a10ae2291e8a953613cb9b810b069f0ef75d4fc7b47e
MD5 4d7feae1e4943583a22b60cdc54ebc83
SHA1 95acc7490045c288c9c2e42fd7f9d7c2f8ee9020
SHA512 f315b828443c48d15ee17bcaa92421da49aa0c9c47958e050f35665da4043c9f9509d1a02397829f17f3e29e8a93fb0a69954885fef61270b935b6a778ae3c89
SSDEEP 12288:WQUyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+oL4fv:WQUyX60d/kSDRBv4bJSvzQG4X
TLSH
T11465234233DADB19E75784F27EE5A295073EBC7E4D565B09CBBFE0100A79796002F620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 37299a68b97c63687619fdb83bc35644b98c32803951b1f39c3389ddc1dc58fc
MD5 1335a4a67b139fdb9df8fe2889155663
SHA1 e741891d0f10a569c52d6ffcb6ed5848e76eb1aa
SHA512 b4b1191cf22b809da916d6d188c8b213c0816f4250677e0cc6a07d6d314ec3a0ed60af21d1c02ca8e37018ec6491c0d76a4d3d0be82db5481d4c61bc128ce9d2
SSDEEP 12288:qSUyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+oL4fv:qSUyX60d/kSDRBv4bJSvzQG4X
TLSH
T14865234233D6DB29E75BC4F27EE5A294073EBC7E4D575B09CBBFE0100A79696042E620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 d2ac312a3d8d1678857fb8fb56af4aeb458006d8cac637908294a7e650013897
MD5 2962141da710241194aa056dd0841af6
SHA1 f5187d430a6fc412318e877553cfe2f93221886f
SHA512 9711e05e4ec7c77f2dbc6447e875f3f4945a4ce8fb668bc05ebf1b7ad47bc50bb336306681412d9d4d3af84b4076324148e32bba60ba7ee2da775994be3db6b2
SSDEEP 12288:VbUyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+oL4fv:VbUyX60d/kSDRBv4bJSvzQG4X
TLSH
T14E65234333DADB19E75684F27EE5A298073EBC7E4D575B09CBBFE0101A79796002E620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 a820281d284c170ba843625bb643771c290728fe997632311477bd8a2f8540a4
MD5 acfc24ebeb8822fcc765d661505095d6
SHA1 b53782860fa6c4c69cc02b11c750284e91adb410
SHA512 2043f9e30d8357ca9de6337aecae9ad07b579aaa6b7ad24f1e7e3df4ac0a470445398a4f1bf874c5648e53138683a104d6571e7c82ed4052211f6783e1700dea
SSDEEP 12288:kxUyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+oL4fv:kxUyX60d/kSDRBv4bJSvzQG4X
TLSH
T1BB65234333D6DA29E75784F27EE5A298073EBC7E4D575B09CBBFE0101A79796002E620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 3ff3f1448019b662af4d62867c5091992f971370ba15af56d600a26366c72e2d
MD5 7b122ce026c9958ef1801815809bf00d
SHA1 9d263dc993aca609ddc7937ac862d5e302f58abe
SHA512 133004cf875de7f6ee214b05c058e428ab93ffa1888344a0bd76b0f1abb015c413f6e335587b4ea78ca6a1e350e009b5213551a21c71c1084f98125c62591297
SSDEEP 12288:bQUyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+oL4fv:bQUyX60d/kSDRBv4bJSvzQG4X
TLSH
T19465234233DADB19E75684F27EE5A295073EBC7E4D5B5B09CBBFE0100A79796002F620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 13d4b70ab4e94a29ea86539c5657c5a111b566b6d3060026c21fb490bf113de3
MD5 7884abd8e92b4942e754e3d480ded252
SHA1 609c145d527dc86ed0514364c597abce7ebf9dab
SHA512 351ffc5cbf24f6f47024f6367150ebcfc529a424012fa67424b7de5d9c1cc299ce818a80f78e59a73003e5c6d6da1dff00c3aebc709761cb7767e3f1871aed0c
SSDEEP 12288:E5UyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+oL4fv:E5UyX60d/kSDRBv4bJSvzQG4X
TLSH
T11165234233D6DB19D75684F27EE5A2A5073EBCBE4D5B5B09CBBFE0100A79797002E620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 c84bce41721f8429fea8c8679df316ff6ddfcde44a33169a789375e5ae621b23
MD5 c6bee4b34455f5f31405fab18a316981
SHA1 b87ee674fa25fbd7d3bdf6d4fd10d6c9f1486458
SHA512 c7eea54d78f57579ef5645535247a7095dd2c5ebf8d8a14532b6a9ee29a147b6ef3503384de8c4060f85b32e24d522fff74f230abc394608b363c42b74515192
SSDEEP 12288:LvUyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+oL4fv:LvUyX60d/kSDRBv4bJSvzQG4X
TLSH
T17C65234233DADB19E75684F27EE5A295073FBC7E4D5B5B09CBBFE0100A79796002E620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 392ed2f1672cc6898d21d2b1c231fae4448e73d00d44cd89d8855df211492f67
MD5 41dd2430a9b52210c9e28c4ae06c204d
SHA1 70c7c83ae746ec5cfb95aae34436fab61553ffaf
SHA512 a3bcf66a58cb89f4a298b04038dd5c52ee51980e72481739efb4db15ed5beb65fa829204d23225af0ba88f0d70659c17663f707ccdcf99859cdaa6f441d54a20
SSDEEP 24576:2fwvuk9RX6wkyAI1UyX60d/kSDRBv4bJSvzQG4X:0MnYI1Uybbzv4bJSv87
TLSH
T15B95DF29EBDC44E5E1B7913C99B7460AF2B178690B31C6CF02AA536D0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 12418adee843ff2873fe8da70ca4ec444958181e35a22159f732165f6f720791
MD5 a44b7f364478ee21ba290753e1ea77a3
SHA1 d608fb7ab95ffd56965f4c5eb987202c40de4d08
SHA512 2c1e4be5319229e742456dcf8dcfd38c2e1158fbf588416473ef17851985aefcf8719790a626013ba3d9c178eb8533a29d8309094f47b64280ad5de94fdaf70a
SSDEEP 49152:wYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0EUybbzv4bJSv:eySzPcZbHmk8
TLSH
T1BB066C96A1A841D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2d92314cfdf19157c3d6c869b862ffcc0ce5fa47e45a3180e3580804eb2af91f
MD5 94fee94ba2c2506534d0271b193004a3
SHA1 ec10470940036148a859e694dfa3c161f8900d57
SHA512 db90e682aac4975359b5beb998ca9d84486f5db2eff4823420e270a26e3d82d0a00f833216a41591ffa6195219b2d8fe0de2a6c50f4473ddf4d14068af5b5b89
SSDEEP 24576:v47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYOUyX60d/kSDRBv4bJSvzQG4X:v47JUQj1irIhCnDHUPfF/UUybbzv4bJh
TLSH
T19065AE1EA3EC01E5E1BA927885554A5AEA71782E1F31CACF1270837D6F23ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 a57ef870489a54448121e76ec87a92c50b6a375f900f63ebf0a04a6b91ad9e36
MD5 675aca1db507c3f413e801623cdf3cf2
SHA1 d8a5d5db8816d5f58e06b4673d3401affb3cbec9
SHA512 a0c46613709cca49a12b92aeff7dcc42a249e1959bd164fa17484d33abc86e908c2f429511e977b5e122c4e90a740b1106fb321edb0e13fb6e45eab1d4d11103
SSDEEP 12288:IjsfhUyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+oL4fv:3hUyX60d/kSDRBv4bJSvzQG4X
TLSH
T1E975F10AE29842E8C16E9175CB965640B3377C2987E2D3CB47E1F53E0F766915CEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 952KB
SHA256 8d52fa49777b552fcf7dc195d901e030e50a482ac4e4b339de78e8c272ca4357
MD5 22579c7d7d42247ce95a85796c20093f
SHA1 ff8d59d5c65856128dc8f3e6fcf7d4a556fa0681
SHA512 3f15ceb0be5d06209287b107384d02bc8fe5c42cde962c6ae53cbdbde20f61c9d8f1c3b3d615f472f58a233b747cbe2820dc520410e20b8ab412eebedde45f0e
SSDEEP 6144:NsBC2nayVaydgPjxDPotMxmBjjMU3fhklEzG2Av+I51OiqbMcSSPO12ZTAXm558P:61kfU3fm/BY9SSPJOmHY9aRMXOFZDvQ
TLSH
T153251711766AD75FC6AD40321E33C1CCAB707D41EE449B0372C99B2FC5B6658BAF6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 bbf84986bbd5226e53f64cb6c9013bb662c99fe481083b7f2eaa71ff3d74b72c
MD5 86003e9a33d15b212a1a02eaeaf9f5b5
SHA1 833b497829e5a050df7a857cb68ed7dbecab2ba7
SHA512 944f3a1eaaad8d4f092d98a2d9da515ac17b1f2d76e3aedbfc49ec3a51dda6188bdd5855f207f5d500572cf44eac8c7b7734e5edf7bc37b784d5c7c116c847cc
SSDEEP 6144:fwguMN9OfihIOGcn8e0D9tMx1QWcOCvD9tMxh91BPFse8BA6JV9C3D:fFOqp870p8BeD
TLSH
T14D55D7409536A38FD1B72032072A9B4CB7A4EC06B7496F2673C8593ED85BB15B0BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 d35050655fb47b2bb80e682ce78439aba6bf41995e5e894ce142ffb8218e3f33
MD5 e0b1c34b5697b560e49b9a275f827185
SHA1 2544017230bccf4457727d32fa1742576f000b11
SHA512 066b1d420661cd8275e450f3867d94dca6a9c51f9d3b0230db3be8187f6af8d281d748f6d7323196e4c0b6c4e972e370420967acde41ce877c63a2c1b97f630d
SSDEEP 12288:Sd7pUyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+oL4fv:mpUyX60d/kSDRBv4bJSvzQG4X
TLSH
T1F665234323D9DE15EABA94B129E9A224073FBC7C0F059B87DB7BE1101975AC24C3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 58e32541a28e84a85825a1317b168397e7237afa5c37db8425bda1ec27083f57
MD5 7b5f9c79c0d0cb54ee2fcf40d861e423
SHA1 dc84af47ef29ca78003f73c784f6d8a706d0f564
SHA512 2428db55aff9fa3958861e3a40574b1f2e875ce8b413f354b8ef34e74f8ccf9e8ffa7c49fbf0d8478181ccfb4ee28ccee7e7c38e25de0b0410b730039a6884be
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYzUyX60d/kSDRBv4bJSvzQG4X:Qgb4mBIBhGFOUybbzv4bJSv87
TLSH
T15565AE1E22EC02F5E1FAD2B89DAA4417D6B278160731D2DF1251423D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 005506419cfe1cb3b669038edb90ebb447dd47328da077f40f0298409fe8b8d7
MD5 290bcb76e715ca40ce0143341b2cab8c
SHA1 57a1b02275edab57677c3156d3a427a2771fab3e
SHA512 8f4943b5b86436a68b2c2b8abd1c9cb88d06e62ab548a30b35b1f15eb006d03d98d30cc6ede96a469bae87407eeacb21a23017f726f62c801669cd0996839e32
SSDEEP 24576:fG88u8FpJqH1Rzria7/m+UyX60d/kSDRBv4bJSvzQG4X:u7ZFPqVYa7/7Uybbzv4bJSv87
TLSH
T15495F16577E102F1D47BD1388A864663F672B8250364EFDF07A88A511F33AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 51499e5274a2e0ef74216ee9da3494dbdfe002a47d34ae203a4e95599f539af8
MD5 8e9512123a5065fa0366c40f1fba06cc
SHA1 d8f17dbb47a2e1aeeb156af5bc02f238ded4b590
SHA512 d7ed83256d831bb9260c27cc56581ad2ba6f96ca49f67dcf5452c828b5428545e49b3145c153dc76511e32b9b2cdc3d957b9b9c4eb1ee80d15a7307e333df5b3
SSDEEP 12288:BHvUrBFrEjwaQqUyLnr60d+qK2yQkSD6gr8qB594bxXSPyVqOOZn+oL4fv:BPUr+NQqUyX60d/kSDRBv4bJSvzQG4X
TLSH
T10485E11F22ED18E5E676E17D89868319E772B866071296CF02E1817E0F77ED86C3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b3dc98ecce492f0a650113432da3c46729a3dfdb19479dbc82417ab807ea4deb
MD5 aa33bb4b0229f71f8bce2dfc0549116c
SHA1 6a7c41a766e855ce9a048c3aadf43aae4213dc87
SHA512 b196985a8e466a4f4bd659e5c29445955294b50816d8cfdf2aaf5778c1f0ee8d13667cdf012190e3983eb5004c338e316cdfc33fb481cbb41e8004bdb7cdd98c
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjaUybbzv4bJSv87:SG05lO43bdZbHmk8
TLSH
T1C8D5CF6A62EC11F9D1BBD07CDAC6860BEBB23825033556CF02A486A91F27FF4557E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d9468757d0cdfca7dc04520e7bb125704bd04cbe350e6cb1113927153adbc956
MD5 7ecc213ec2d713ed9875083b61d3c7f5
SHA1 e98886712122f91cd8d51fc607f9d0ef82ecab82
SHA512 72ff7b06d1eb43fea8ba0dd360e5f1964ec38825f8fe74e84543681d26ba935973adc0e3bfae72492a5b2a097db331b5a8e9ddfc0693b8db703577d552866291
SSDEEP 24576:ofa5POZ3dpFWVM50JicR2hG0lasx2+47eidnEUyX60d/kSDRBv4bJSvzQG4X:Qa5POZ3+Jt2pasx2+mSUybbzv4bJSv87
TLSH
T15F65AF5EA3FC01D5D5B9D17DC583861AE5B1342653329BCB022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2b3137b479e99b3138cc426afcd99882de0c35294b678deeb5626d436412b00f
MD5 cd405029aec8526da8263a15de4f4045
SHA1 73bfabe7d408201b55d95b3cd13b92ea0f27260d
SHA512 bca13fa767b7c49aecbe0de202d74dfacbf2eadb5bdca3513303ae1a3d65dc20ba29a3012a528ebb7b675d8d46698ee36915b549cecdb1d0cb013a7102d5ebd6
SSDEEP 24576:XNcwHdjbyQ4nLC18lb/EOjowL7Fk2UyX60d/kSDRBv4bJSvzQG4X:XNc/zEOVHFbUybbzv4bJSv87
TLSH
T1EA858C1623E901E4F5BBE1BE89779546FA71786917308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b3357556114fedbce23890d9f19289d3c279f8b895a158c38d732c47e92c7a56
MD5 fab2322ab6bd68ef62e7a10b4be524e3
SHA1 a47e3c5a7c786f44f06f5880c99515753ee5242b
SHA512 397c04712749d1ff50a0cbc751a59b266b82f8264aa7f0ed67c739942483fdc1d28503e1a84f0dd5aa1423f23297213250c27ba6942bb53a582c92371c89bfc9
SSDEEP 24576:e8kNvNnaFeYhJNtmZBmoUyX60d/kSDRBv4bJSvzQG4X:e8MwBtOmoUybbzv4bJSv87
TLSH
T12555AF6EB6F846E4D1FEC6B59D238512E6727861073293CB4390C13E0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 c6a8f3e69a7c860bede58920d6c21ef93831ac6cf7f7ca8538f53a12e04e8619
MD5 1959f4485cea4df37539a81f3560e7d5
SHA1 9b47dcb24d16fda97cd70036cc1ceaa8358dda49
SHA512 14524fa317a1b2df28adb9fa199ef3b743f805587da6d3ae040e21e104e6e2fe0bb6ab5e393fd9d920a839142b9b448331d146398ea1f66a1a8e31fcbaa46793
SSDEEP 24576:nD3FHshBIYQgAtUyX60d/kSDRBv4bJSvzQG4X:nDVHeBIAAtUybbzv4bJSv87
TLSH
T1E695E16EE79C04E4E57BC1BC9AA38606E77138AD032256CB0695C1B51F6BEE42D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-91-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/256-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/256-92-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/256-98-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/256-304-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/256-303-0x0000000001390000-0x0000000001633000-memory.dmp

Download

memory/256-301-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/256-306-0x0000000001390000-0x0000000001633000-memory.dmp

Download

memory/2572-1-0x0000000002420000-0x0000000002487000-memory.dmp

Download

memory/2572-6-0x0000000002420000-0x0000000002487000-memory.dmp

Download

memory/2572-7-0x0000000002420000-0x0000000002487000-memory.dmp

Download

memory/2572-28-0x0000000000400000-0x000000000058C000-memory.dmp

Download

memory/2572-0-0x0000000000400000-0x000000000058C000-memory.dmp

Download

memory/2792-65-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2792-57-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/2792-284-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/2792-59-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3016-43-0x0000000140000000-0x00000001401B4000-memory.dmp

Download

memory/3016-41-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3016-38-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3016-32-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3016-31-0x0000000140000000-0x00000001401B4000-memory.dmp

Download

memory/3036-70-0x0000000000A60000-0x0000000000AC7000-memory.dmp

Download

memory/3036-75-0x0000000000A60000-0x0000000000AC7000-memory.dmp

Download

memory/3036-299-0x0000000000400000-0x0000000000576000-memory.dmp

Download

memory/3036-69-0x0000000000400000-0x0000000000576000-memory.dmp

Download

memory/3244-388-0x0000022CD9420000-0x0000022CD95FB000-memory.dmp

Download

memory/3244-319-0x0000022CD9420000-0x0000022CD95FB000-memory.dmp

Download

memory/3652-46-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/3652-47-0x00000000009E0000-0x0000000000A40000-memory.dmp

Download

memory/3652-53-0x00000000009E0000-0x0000000000A40000-memory.dmp

Download

memory/3652-269-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/4312-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4312-14-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4312-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4312-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4588-105-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/4588-302-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/4588-106-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4588-112-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4880-300-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4880-322-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4880-320-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4880-79-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4880-85-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4880-86-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5888-133-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5888-140-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5888-134-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5888-308-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5996-117-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5996-123-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5996-116-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5996-125-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5996-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download