2f49eba6fe3421e97dca2f0170a5de8e7d6d0656e9e6198fb723051e8afd82cf

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_f01c7295df49c50029fed2fce0a26687_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 1.4MB
Sample260720-ssxgmsgs91
SHA256 2f49eba6fe3421e97dca2f0170a5de8e7d6d0656e9e6198fb723051e8afd82cf
MD5 f01c7295df49c50029fed2fce0a26687
SHA1 047e08e67efc6564665b8cd4aebae9d1274d0f83
SHA512 26cc035c487756e742f7779b3d91bf9f395e8cbb3c17abb27f277d3174af989c65472dd2db76dc04d020f22ff37f17cd1baac46163d89b2b72a1a95584fe96f1
SSDEEP 12288:w1ie+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Reyxknw4FYnshx8OfVe247
TLSH
T1C665237C76D5E0B2D40914B30A31E3A16B1EB9609BB5805BEBAD725FEA70CD0D13E217
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4476	elevation_service.exe
1568	elevation_service.exe
4668	maintenanceservice.exe
1712	OSE.EXE
2444	PerceptionSimulationService.exe
2564	perfhost.exe
5996	ReFsDedupSvc.exe
1056	SensorDataService.exe
2412	ssh-agent.exe
6112	AgentService.exe
2616	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_f01c7295df49c50029fed2fce0a26687_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_f01c7295df49c50029fed2fce0a26687_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-20_f01c7295df49c50029fed2fce0a26687_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-20_f01c7295df49c50029fed2fce0a26687_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8e304c19238bf42.bin	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-20_f01c7295df49c50029fed2fce0a26687_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_f01c7295df49c50029fed2fce0a26687_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aca8e2d15b18dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e8ce4125c18dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f7cfdd15b18dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4476	elevation_service.exe
4476	elevation_service.exe
4476	elevation_service.exe
4476	elevation_service.exe
4476	elevation_service.exe
4476	elevation_service.exe
4476	elevation_service.exe
1568	elevation_service.exe
1568	elevation_service.exe
1568	elevation_service.exe
1568	elevation_service.exe
1568	elevation_service.exe
1568	elevation_service.exe
1568	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2540	2026-07-20_f01c7295df49c50029fed2fce0a26687_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Token: SeTakeOwnershipPrivilege	4476	elevation_service.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5996	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	6112	AgentService.exe
Token: 33	2616	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2616	SearchIndexer.exe
Token: SeDebugPrivilege	4476	elevation_service.exe
Token: SeDebugPrivilege	1568	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 1932	2616	SearchIndexer.exe	100
PID 2616 wrote to memory of 3596	2616	SearchIndexer.exe	101
PID 2616 wrote to memory of 4448	2616	SearchIndexer.exe	102
PID 2616 wrote to memory of 2044	2616	SearchIndexer.exe	103
PID 2616 wrote to memory of 3456	2616	SearchIndexer.exe	105
PID 2616 wrote to memory of 988	2616	SearchIndexer.exe	106
PID 2616 wrote to memory of 5560	2616	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-20_f01c7295df49c50029fed2fce0a26687_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_f01c7295df49c50029fed2fce0a26687_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1568

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4668

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1712

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2444

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2564

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5996

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1056

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2412

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6112

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1932
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3596
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3044 904 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4448
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3028 904 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2044
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3456
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3044 904 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:988
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3028 904 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e9d4ea7f796ec4181ae56bc37f35697c04b27d7557c323fa34219cba920317f2
MD5 624b673ee53d7c69a9e82e4f2f4b2869
SHA1 2a1c2070f36e3bb137a1f13afec1f2f80c97854b
SHA512 298953c2fe1fab0682de25cc4747544d25654790e5e7b56725085603ff8411d7412ece00097a5a56e2eba266c4ad9669f721e77410d0b0758a04988fdbaff697
SSDEEP 49152:Rb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnRx4x8EVep:X3q6HjB6ix8EVy
TLSH
T1A3D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 ace8597a7da80e2314c0b13d118c644c747f0e3210ac2f67311e7bceaffb9bd7
MD5 4b10f072c97257a09a3f5715dfce881a
SHA1 408b24c268dfadc93bfdc17b91298fafae3739a7
SHA512 f33363c4fe0a7b951449f489f2fb4941ac751f06f362da86baecc62cc5eff6f3262d12d8403cb0a4743072010f05a24538ce8378c0028fecb022c92b30f782fd
SSDEEP 12288:S1XLsswWkxy2lRq2czAj+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:4XYfDtczAjyxknw4FYnshx8OfVe247
TLSH
T12475012873E508F9ED6B8139CDB28512E633B8514770E39B03E4A5295F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 f87582afae0798ceefca921fe174c86e575a33e43a147325f1e2ca09ee4a3359
MD5 a17265df5f8eaad143dbdd06716346bd
SHA1 01816c34cdfb21909f651eac072c0389a2c4d6d7
SHA512 e8fcc202f7a8a220fbd70d3af6ff583196170416ed71a10627eb48a90703468fe89e30032019a5c79e04d4703821fd0829c29afd06476f4a57aec11a347fec97
SSDEEP 24576:00Le5ji0hmxFrMWiyxknw4FYnshx8OfVe247:0Pji0Arlx4x8EVep
TLSH
T1E095AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 555a24658af5696b6e2217cb14a0e609189d23f63586dcdcbd85c5cf3b013903
MD5 5d840dcfaf5934148119397efc1c7074
SHA1 06986ec1ffa049f55e20d4727bd356797c9b0c45
SHA512 ec2c27823fec478af8de1bcb66f8b28279a97fda9701ce59d91a0f1a892db71f45b29fb1caaf62ec44be56660b5d3173df38f346dcb85580c9b7abe912642a78
SSDEEP 24576:3a7/ezSC6vUyD/aqgrvWE6q8wyuoiyxknw4FYnshx8OfVe247:6/ezSC6vUzPvxHjyJx4x8EVep
TLSH
T169756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a696c95a59dc396d97ffb3e0e3c59143f807b44924d5772a4def203989cc5efe
MD5 5ce9193aceba8075760aeb27af07153f
SHA1 8da8761dd3bd91d7bc9beee6db21bec29e631b52
SHA512 6f42886319caa8e42c5362bb63e72c4f7103ff79227f312f2faf300e67ca680be07095c9c70020868c853d4706cb76039eea8252571158a701d86a423f8f37d5
SSDEEP 24576:PVbqPb88hv/l+61iyxknw4FYnshx8OfVe247:PVO88hXl+Qx4x8EVep
TLSH
T156559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 67a1440e397dcbcee54e60172eb7bc6e0e5451d132503e099ada079bf01291d2
MD5 2fcf2a351bd9d85350cf95a5c0116666
SHA1 2f9cb98b46346b7805647ebf357b2d2a977b71eb
SHA512 f8488d685392f1a8c5a600564f1f58310d0e96b38a03507c2e3c14ddac039126d72d2ccadf0bb213e44c4347364b85f8504f4aca0c5d92fd790b974def54a848
SSDEEP 12288:TNqi+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:TNqiyxknw4FYnshx8OfVe247
TLSH
T1F865237CA7DDA4E1FB5E15331B7172622606BDA4DA74C11BC778B14EE4B0CA0E06E223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 28e73361826fa436bd312bc5d5cc136ff6ebd7296e9669f8038374322ec94a10
MD5 df92496316e3e2565f5579470fbec6b6
SHA1 f0763c6c7d8e93a9be5e509fd487210eda63e958
SHA512 9cbeb366902635637e18b99e4500b406d2d54189c2306760f9a0b0ff134ec9b165c59477da97c1c012cbaa410dace8f839e0b07a19b852c0c37fc3b9c90c58a8
SSDEEP 12288:weBNUbTVO86U9i+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:wJIU9iyxknw4FYnshx8OfVe247
TLSH
T17275CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c2a15d2b93f0a0f2f9451aa125e9a54af79c2d78aca228a44fba30f653f3fbb9
MD5 f3ee95917212a11ad4781250046a4e17
SHA1 998adbf217c1daca67c0468df038e3ab8bc3668b
SHA512 5a2f97aebe59ac7f030f307ee85327fefc82a45b3cf9ff826aeedc85aa55e8465995ff2d397fd2c99a9aa19c4b9eee1f997f0e5d0f0917cd2c023f44ba027135
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THv:JQvGAdlCEL8c/yRNw5CSix8EVy
TLSH
T1F5267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 19167e1c6f01ea1f63ea11d612e9e5af0ce64d477231c8328e035feec0e25e67
MD5 70bd83904bd0fd01e14e6abfe48df808
SHA1 454316b4f15ff9d9bfe9be7d5a010cb0b2eab038
SHA512 9d9484c1c473b7aa18181d31001f889575a3e8b0322f62c75446867701f444cfad82a3d36bd3c7090cc98edd7c8a06b25771fc252ab0101d6661c28393b30c24
SSDEEP 12288:3AwSfxL/2Dc3LDLLmt0LDQewsAj/i+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGp:Q6ewsAj/iyxknw4FYnshx8OfVe247
TLSH
T15A85E030FE74E032C7BF0DB21B36D716142DB9604B611AC3E3E89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 defa780bcd8fe865328181dceba15a0f02835aa5e1617ee37958ba082da1068b
MD5 ffd6daa975d040ead2ec919753dee980
SHA1 af0f2af9d35c019d11e47356a4d8b0c940d904fc
SHA512 6376f73b1672301855fa97ad52364b382b4b5f54e3334b50a5a97a3c253ce409039601908feba0f3a5ee827129c448ff86526ed6ed3f888c6786d6744294aae8
SSDEEP 196608:fUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHw:fUEtQevvqc2W1cpV2EI32
TLSH
T1B8474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d0c97e9813749e7338d12c2d2ea20c1b01b123ffbca79077f2116d5c88100017
MD5 b36a65bd3464ad44961325e02258fc94
SHA1 4ef99d5b9a35f8710ae66f13d88d1d956ffe253f
SHA512 ec98d97e64c394bbeaea0534225188c9a84b401a515b42e79dbfc42a3946bc494db52c3d9bf1edf122cd27e7d64d1fb1a3a5f36132dbbf9ebb96a498c2e03b74
SSDEEP 49152:zCbRquA/m2yL5zQfFiV+XenmE3/zVx4x8EVep:MoqtVjnmWix8EVy
TLSH
T14AD58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 865a33aab8db3cf378afd7cb516db09119e18233a091b8abfb7e2b0eba7c2712
MD5 547799da88b994aa8bac06dbf7cd1759
SHA1 9da6498809ed0dd9931eece94278cc17cccf3cf0
SHA512 55e19fa5c768aa6b5a466aab0dca46b89ea404a291ba078f05cf1743340d44c614c8da4ba38fa648bcea837ce16c01d048a1d5cf7ff3b11ba8e5c2d7ffe53571
SSDEEP 24576:WAhGLJIFoiwtA5l7S53Uiyxknw4FYnshx8OfVe247:WAMyFoiq5mx4x8EVep
TLSH
T12A35AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 ae5b2fd07ff480b87496f8a6fc3bd24fb5d73efaa06fd23df2a738bc384817fb
MD5 1a90db1d409fb546df129dead5ac2449
SHA1 8c9f4777ba62a0458f336de423751927fcfa4eba
SHA512 ff44ddad4a621bf158a0e4414b1e10999408b91abf30e88feda898a582cab12e61683e3552bc8ebcd159738a09926bf86301d70d2b825908a9b89fe545a4fb9e
SSDEEP 12288:zmw5HEjsChNoBFgl0WDm+CIi+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFC:SwuFOWLiyxknw4FYnshx8OfVe247
TLSH
T18675F14977E91CF9E9A741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 37b2ccae45e6de34c76764a967f5759dd92290a00d38b381f202b3be11e49152
MD5 9ae601f9d5771180e6fdc5adc8eac739
SHA1 737eb8bd75f671aa43a5cdebeda834c5e815fc9b
SHA512 52e578c5391711007d828dcc0d796ec20ecfcc5d62750aef91b603f28a2f38617304451489e461bdb51c1a196fa63f5cc19146760692c173ce11add17d469590
SSDEEP 12288:cFZ1Iyvi+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:+Zu+iyxknw4FYnshx8OfVe247
TLSH
T15C6512AC33E860F1E1A7113A89F15205E76274A2677183CF4764625EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 73696ca4c6d28e16a2e72b2fed39f255d262e6765ad711632e8dfc22254daf09
MD5 0102dc3b98302a05d9b9d24b73c756d6
SHA1 5828a9fb963ec4e8e897a8bc33bf623287a515ac
SHA512 c60b574b3590afeeb2bb517288d36d863d779d25488d8414613288bc2dbdcd1f72cce97f193a94a1623a312ca4f0e16014f35eb5a18d928445f8b42c9eb5bf18
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UL:aQRQyi36YOcPQLvw2gAf+PN3zix8EVy
TLSH
T1EA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 404408a61a2e84089b5249c9582e7c39985eb03f0cdd72acf7afc04ea5fcd472
MD5 e02a775a75cb2823a050246a878d9d6e
SHA1 2390a9152a5eef50de5561764462f9e800865706
SHA512 aa84df4aaf96f7daff54e287d510b9f92ecff079a28fffdb95a5cd925af14d12a9ff6cd84bf1ba5b1bb79242a4f116e805b0cc1146fb33a096de681a897cf6b5
SSDEEP 49152:ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UL:BQRQyi36YOcPQLvw2gAf+PN3zix8EVy
TLSH
T18E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2d5c0dfef825488175a64b620ca74fb1f96cb3b6044202573d425d64e4ac5913
MD5 e86e9283a3fdb02817b6a2e72e83cc61
SHA1 c9c089e562bce3aa9679d5973c133dd5fe83409d
SHA512 ac3fa8ac3960496c0258bb0ac9e87c01168614891911c7401a0969e66cb4a85242d71f46cec9105a5e5dd5e8ba7362440adf99c3335be2f491b0b719b14fbb94
SSDEEP 24576:swvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Oiyxknw4FYnshxa:S68Qg55nhheWu7PNU3/lx4x8EVep
TLSH
T1D7B55A33B2F600A9C44DE1769F46873196D27C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b6cec278b85d140cbef9275434fbbbc5e04bf9a7cb3498772c00f863810f1054
MD5 98f755bf30fd1061cd3b6fb586140c0e
SHA1 6263d762f2148ea7e7cad44df04fbf7e4426ac07
SHA512 824335b2cab248661384ba6ba6a5e7e3d41bd48dbe074ae1e22bb863bce0c21d07d8a666aa8e0f86ea9d511a1b728b207e9ec77f57d3e22b279b3eefb3eed52e
SSDEEP 49152:a3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99t:Ly5112gYy5azzVvL69nLKnhZIix8EVy
TLSH
T198167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d35e108ad65e39e40f18c7f1c890785bdce1333fed81c6cf94d8b70f327befc4
MD5 66ec4e4a7127e6e1bdc14b9c9d5617a4
SHA1 8f565615f4da072bf1c52d185b5f9aceba0f8014
SHA512 10492bc1162b55c60a329bedf3e5a90d6c40e8076f02ad32101b15f99bdf6e2c456d3b4b68b36f09ff132563015f3927cdb1152c4a49857bfd5c40f34cfb6e3b
SSDEEP 49152:eB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl2x4x8EVep:Mu6JmVxd2d2ix8EVy
TLSH
T188D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 865f917c2d284adcb3033f04f042f16f606aa9b33e89bfe5568e850865a592f1
MD5 6571e470ded4ff4c56e00fe95d76555b
SHA1 27d9a0bbd7480da93ea57a1d3c2140e6d7faf99b
SHA512 4696262912d709efa505c6ff76f0bf5b0fa81119774170731faa7623c2744fd2bbd586e9b1ff377629c0886e1fcd56ac36dc041ace3119dd4a8a628b8e826f94
SSDEEP 49152:F1hpsNoJpF1A6UU44CwH7R4xPx4x8EVep:FmifPbRWix8EVy
TLSH
T1BFB5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 00f4885485e03a9053539395ae14e1d04d68aa8f3c8db800cf68bf1e010e3d8f
MD5 ea283a70e91bb707994fbdb6d458de1e
SHA1 65c7333e8c653870f02e01b05afb1027b708e840
SHA512 b97d24c9b83879f3fa50b4046c1ff94589250ea457068e5737e48a0c5a354769cf2fcf0631de6d5983ad94225229dc0ad56d4b44f77472f5b44bca1a651db15b
SSDEEP 49152:HSuZQIY0Be2KRRVtOnks6NMHqEx4x8EVep:d5dKTi61Eix8EVy
TLSH
T152C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 242a653b215fb435b2c12eb23ef54573f5f8ec870a6f168048657dbd88341d68
MD5 c36fc6a28262b418c3b43a3e49ba590b
SHA1 38e8854f0bbdd8a07ff50d184975bd78b7d40ae5
SHA512 876f909700ef70ca776da1927f0be185d68cc73c5c6cd9698b92b30c7f57fdfcacc7e310bd6ea0e64eb74c7a7d66c3ff82def7139a28597f57b678b629b0ea2d
SSDEEP 49152:vhtSn8EApI0figngiDn0AP5wrx4x8EVep:+X2iyphqix8EVy
TLSH
T15095BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 6b3cb2a322e5b2867c2e82f353918c32aa60d5f2f67387f9194171bf22cde0c0
MD5 c565c2249f5d964389750497ecb56ead
SHA1 968aca7b7e07c2e0a0bbaa2c7ed3fb0cc64f7e5d
SHA512 cdc17bb61948c980d173759481ea7c2e3c5e04a5cd40b46dd3356d98e678adc47728f0df95ca838a8511805f180e20987472ee949ba2622d7e1d09afa3943b5b
SSDEEP 12288:0Si+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:0Siyxknw4FYnshx8OfVe247
TLSH
T1766523BCB7DFA5E2F50D11734B7162626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 db5df47f589bcd60a23aac7c8686d4bf15620fba1f52cddb8673eff039a982ee
MD5 a862de12f2555cfc77c0c53e5507cbc6
SHA1 563e79a3fb74d1a3f8ff3d769f1b48ad13f38306
SHA512 5c050b794a8c4c98dde758165216dea554d7578037ec8e532853ab75e6375343a691159892ffb34d41a6c52419f8ff044e7387c25b795342b856b9d8d4d0ad58
SSDEEP 12288:4ji+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:4jiyxknw4FYnshx8OfVe247
TLSH
T14C65237CB7EF95E2E50D11734B7162626609B6A5EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 0f08e3c1be302062292d6b9425bce4ea4f655c6b5e0728ba12710d69bc9da6d7
MD5 f09570df81cd323fb7812a8f42e92d9a
SHA1 070d29efd0b9a087ba3f8a57e057045fd05be499
SHA512 37cdc606fef9ffda0e8440fd4328162f851de3a15b7ac30210027a39521d77ad565ad9acf7262e5bf075e4ec9b0c721c781f6f16c3ae690907bc236a3377125b
SSDEEP 12288:hFi+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:hFiyxknw4FYnshx8OfVe247
TLSH
T1CC65237CB7EFA4D2E50D11734B7263626609B5A5EB71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 8603aa8da2f445d629fc87fa7ac1b99c96f681891dd38eb276796b32f6db0bd2
MD5 baba0c8c1748474e5d52b6e7b81d2d9a
SHA1 846a6b7eeb4cda30f44d129b5b30513b269fb09e
SHA512 68bead477d88bbaf945ec566c5645331e5b02da38fca317e701b32b7057aad1e05be9bd47a7d62bdf7a1e1912a65fac590bb39a0cf4d453660ad4683f8a87e62
SSDEEP 12288:xV0i+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:oiyxknw4FYnshx8OfVe247
TLSH
T11F65237C77EE50D1E85A51738A716222B365B8E5E731835FCB64700EEDB08A0A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 6765a0beabfbfbf7831b1476b6e6a2239c9c15f21d30e20dd95048c86e786662
MD5 42458b3259ae4bf06ba3b552829e4e78
SHA1 5d6d2b81e4bc8627eacbf81bbd709941d90585f0
SHA512 517a09afa90b70903645595d0adad266a1d02598e9812c4369cfa84fd8c19bfb7330f9dfb9f2a0f5d136fae3e4fef780cc51c4cce88fa4adb92172185a1eea69
SSDEEP 12288:+Mi+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:+Miyxknw4FYnshx8OfVe247
TLSH
T1A265237CB7EFA4D2E50D10734B7263626609B5A5EB71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 998cf83aa174c9220b6fec872e0d9de279892e121259446d137c6dd1d2b15e2f
MD5 8d1509475399ceee719f2c885e597a98
SHA1 aebb0398dd35cc62a8309a33d2deba10f9bfd01b
SHA512 bb5c59ade533ae81e5f631f924b06ee37e8086330f085aa514e94c8aa95ebedb12b5385e304e9c31f3fb5ce0efa84fd7333d24b41b5c552bc664303e4fb047ab
SSDEEP 12288:lni+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:lniyxknw4FYnshx8OfVe247
TLSH
T1D665237CB7EF95E2E50D11734B7162626609B6A5EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 c01beb660469b3cf4523bbf7a1d4ac5b32b19f9ab438e8fe32fd53e5c1696e10
MD5 9e8658f5b1016465ebda3249499ffb15
SHA1 515594fd751dd91dc20e613c5f15d53e3d1ac81e
SHA512 fb5c314db4f146c304885c0e482d4e8d7eb69804b2faac9b1869ebf96ab02e111485b79d5b53997a54952c132056398dfa90982c18e9faa28a87972e88f6a9d9
SSDEEP 12288:Ybi+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ybiyxknw4FYnshx8OfVe247
TLSH
T14E65237CBBDB95E2F50D11734B7162626609B6A5EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 afc29d5f13f6f94066a9eede71410e7919ecdd4d1acedeab8b30a45f44e975e6
MD5 998e5ee49e97dde05650258bba6007ab
SHA1 8106eb90523d8946cb0470d2ecce14336a9ec355
SHA512 48282635c724fa249210d67a0827f5c73e136d4e880ee406476c4b5b31f2f0a120f4a09a902be85e3a1b19d3d0a80475d5e0e0e4867297a9dd7ca94d52b69fa6
SSDEEP 12288:EiZwbZzzFEoS2cPvyDi+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpm:nZMdzFVSODiyxknw4FYnshx8OfVe247
TLSH
T1357501A8B39018F4EC67413ECD259916D6B27C694B70C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 15ec5846f7fcc1af0a164b6a23569a51082612b630ca3b585cc3d01bf52a489b
MD5 bddd6fee093e049f414e35c43b7ae65d
SHA1 34f0213f47ef97bd3fb37e42bcfa77b05396dcd5
SHA512 b3b23d697c718f7e2fdd8583f635ac46fd290277425791b020fbc5e624779ed120b875a7885b20462985b60b87369cfa3f2ee914fc4d63dc15fb689b31f9dd8d
SSDEEP 12288:vui+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:vuiyxknw4FYnshx8OfVe247
TLSH
T1886523BCB7EEA4D2F50D11734B7163626609B5E5EB71811BCB6DB00EF5B0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 953a8d882860c341ebfbae2620fdea9ed81db914abadb3559c90ec76da3d4ab2
MD5 a28c67357818a4fc7f854c9fd3e1ada8
SHA1 bc3e1e42ddb6ce8cfcb9454f95c95989c7820ce3
SHA512 e09ee9a38a67fb46924ec39f30cc46c44a8e510d556533e18b8db5c20da3d5418690384d8aaf3d09ad338b93700351635a455ae0f13683340b032453c90fa31a
SSDEEP 12288:dai+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:daiyxknw4FYnshx8OfVe247
TLSH
T1706523BCB7DE95E2F50D11734B7162626609B6A5EB71811BCB7DB00EF1B0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 299e2aeb97ba6b0d4ade3562e71405b025ddb0036e9dde588299b7561b3dbe89
MD5 d3dfa705f17bb6366208916acba35d12
SHA1 53765d87ddcd05d4c24fc14016886297ae098260
SHA512 e18df1070bf097c0e3571c35d05da86f8be7c973ce8b8da5df5d80def842df14bdb6e8867cec064b18d63b52ff0d48434f9327d2d0ee0f7b8dc8935e2a7407bc
SSDEEP 12288:4yPz5L8vi+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Zzyviyxknw4FYnshx8OfVe247
TLSH
T1CD75125B73E630F5D13A4236C9621612F372B872473086AF87A4527A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 ef12774432d358feef8dca79fbb735905f37d0c59d48cfce8a5d9d80d0eb17e5
MD5 0dde3a63adad0d9f1aba1f1dcbf68426
SHA1 1d787071055bfe202b7107c437a0bbfb4e4b7645
SHA512 bcd651dae260d6a62cc2345c2e75a65908a35e7c57ebcbf819d73568e9dde94c67ac6ebbe7e1d8ac4fb3ab9a27071d5f8df18a00375a14d839f6fa7ca7f60998
SSDEEP 12288:Qui+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Quiyxknw4FYnshx8OfVe247
TLSH
T1576523BCB7EFA4D2F50D11734B7163626609B5A5EB71811BCB6DB00EF5B0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 35dcb02d060d4de970116a2d3a0b684a087692af0be29c6dab279b95d0aaf5b0
MD5 458bdcb000cbad3be7f5038c814e6915
SHA1 677a9b41092770ed86ee707f0b02b42a0f8fea61
SHA512 7faebe2de516f2aa283c5ac96de21d95acc4c04cfcde6d2447f09ce1f09fd5e77d1b06b2f33ca3d4a2d5794a52d2f098c8b44f4494dcf25c70676a8407ff530d
SSDEEP 12288:1ui+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:1uiyxknw4FYnshx8OfVe247
TLSH
T12C6523BCB7EFA4E2F50D11734B7163626509B5A5EB71811BCB6DB00EF5B0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 744a76d3fd08963fa2f2d9a041309ab62fafca7f081bb4ca14d7c2202fbe1fce
MD5 823696793f0f85e0f201e1444abde6f2
SHA1 304aac9d7e3aa8b22ef7710109d1e31292309d7f
SHA512 d806d1e018feeacfaa21cd8c0406f7e850e3a9281f477122b82aab48410862e67537ebddd35f51e0c73ba8931e2f548d4e101bafef7a17540ed85fac045b2ea7
SSDEEP 12288:myPz5L8vi+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:bzyviyxknw4FYnshx8OfVe247
TLSH
T17675125B73E530F5D13A4236C9621A12F372B872473086AF87A4527A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 a62401bebcc7f53d31b4659a1b9eab224fe569340c80079f49cb3f262ce0d0a4
MD5 41210df7b27abaf4a3e5f3a503dc60e0
SHA1 434aa7b2959c6fb72fbea1eb86dd7c7ad5298cbc
SHA512 655eb6f612e67f4b55b240059fee3ed5588eb8f354bc9f5972bb4666b7421ff1dfef5057af640454784cf048674b6b6839673e30ad28ca49ef8a366c3f062c72
SSDEEP 24576:sTGaLl3z0zDViyxknw4FYnshx8OfVe247:sTFLljCx4x8EVep
TLSH
T1707501A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 4e6f090ce542381d8d1b78dac65784b0620a32cc7395cb1cb3eefa0a5376119a
MD5 936fb56b94b1d7469994b1c849c15909
SHA1 0fb49622a5079716a01258af14f9178ae103a854
SHA512 ac50ee6dbf4f258cc9a59c81fc491d66ac8c32db3460fdfa3c4e9a840b5481e74c2bdb805ede7531bd95b383d5a85f08b4f8fcc831a6fdcd8393b22ae2f8c9e7
SSDEEP 24576:63nd9CHKy7GZJiyxknw4FYnshx8OfVe247:cnd9CHKyatx4x8EVep
TLSH
T17A95CF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 6742c4b52c80219830a5014258ddcf7e6b3990ef1144e2b80dc403c82767e87d
MD5 cbda161722e555d3733c8e796b67a580
SHA1 8049460a9667fbae3834b58ed7fd0e0fbaee6862
SHA512 e9d621e66a2c25f1ab9604026d3ab979d889f0375e52473e53e70578cf8157f56ce780ba729d782d660b9a44ceecd76fcf93d05e60391aeb6d842241a094a065
SSDEEP 12288:Nli+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Nliyxknw4FYnshx8OfVe247
TLSH
T14A65237CB7EFA4D2E50D11734B3263626609B5A5EB71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 86019ad94c91f7d0bdd83f1f0fed84e2815b95b4137677018e3c3d6092e1285f
MD5 32f68a9c015b25933ab1149ddcc33589
SHA1 17924004095f80d16f6dd15e9d580551e67f263d
SHA512 820954e1882c64b57e10cc6d55dde408faae539e5ecce07249a3d5596c133d1a88b2cfc1fd769fd451511e97a56a5f00e86beba3edee99abe91e900495ec0011
SSDEEP 12288:8Pi+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:8Piyxknw4FYnshx8OfVe247
TLSH
T18B65237CB7EE94E2F50D11734B7163626609B6A5EA71811BCB7DB00EF5F0C60A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 b2f35b151b50089b39acaa991f35f2fc0749d887dc4e4b30a0323049343d3782
MD5 63ab821cc4d72c2afd4f3c47a00f7e5d
SHA1 bbe971a4c51b05af38ed8dd08ecdee99729ac3a3
SHA512 41c01459aba21fe95f5fefd2ee5444258b45ef9a64aa4161f0be1c2e2383220b40d769326cee44d9cb3add866b7f90d7789acb74db0da6bca55a79bc6f2cab43
SSDEEP 12288:BAi+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:BAiyxknw4FYnshx8OfVe247
TLSH
T1E26523BCB7EFA4E2E50D11734B7163626509B5A5EB71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 f6954db08250b7a7237cb88f08730c7d59f026a99e6375d6a30965f08f648ca3
MD5 fab716f03e58ab2bafa1d4e0eeea4497
SHA1 4c035d76e4e40ff7a9d55ad192e7a5695ec26f97
SHA512 0444964c7dc839675aec414ce5ccba69dbb1f32bc131017bb54b19180f52b193f7d722cbe656af02a56a29017389ce41dcc7040cfce9fa5495e3f4b84580f055
SSDEEP 12288:7ui+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7uiyxknw4FYnshx8OfVe247
TLSH
T1BB6523BCB7DFA4E2E50D11734B7163626609B5A5EB71811BCB7DB00EF5B0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 1372643d82aa37c1b0309d68b3f821f25fc1ebddabf6c69e0de738a6ea0f397a
MD5 8092cfd23f2a89ff0b18a07dd797bac0
SHA1 8a1fbe6ec9961eb6fa0ca56584286ba4120dc5fb
SHA512 5959008ebf0411578130a2171625dae936b3e16f6a2c2ffc08496bd03240c54401624173e584b7af4a12c9f84339a29b32741fdc755ba3fe171b0351b8474862
SSDEEP 12288:Cli+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Cliyxknw4FYnshx8OfVe247
TLSH
T1456523BCB7EFA4D2E50D11734B7163626609B5A5EB71811BCB6DB00EF5B0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 af5518b556f1fb255498658d3ed71e6001967fbf0a814b52e1e2c8a3cf419beb
MD5 00ac2ec52b293bc8b2208a2da77c04ad
SHA1 40db0152dcd80c7555ec48d73a42f7fe435177fd
SHA512 856d5e190c52abc7ddeb3ccc16b28377f098565eae467ff64d6d9770ce23db7a810e247ab32740a338f8a91e9e0ec7a920e9af429e3c69a73a4ef76368c72d70
SSDEEP 12288:Ymi+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ymiyxknw4FYnshx8OfVe247
TLSH
T1A865237CBBEB95D2E50D11734B7163626509B6E5EA72821BCB7DB00EF5F0C60A01E523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 0c2fa61adb6025c6a39c41195024052ea6f6f71d8524cbb83f93302c86772c6d
MD5 c2f5d84ccf4d607cb977643c39cadc7f
SHA1 31830c1d05e27c24b8d8e3e4650dacb62023c860
SHA512 931aea320240b504fff8a4cad0c15316d6c5db838518283feffddf37a72e9aa85aecbcb7fcf1d22785276d31c49733509558188a941c8c687d9489f65e55c0ef
SSDEEP 12288:lMi+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:lMiyxknw4FYnshx8OfVe247
TLSH
T17F65237CB6EFA4D2E50D11734B3263626509B5A5EB71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 f19c0cfe43c27d859efa041dfb28219412e02dcd5335e24779071921ae29e1ae
MD5 b902d1049f153a11492420dd649212ad
SHA1 ad153e0bfdf31ad777047b2d6e04b6bcd37b41b2
SHA512 960748151c8500e298e56b26807a25bf9b515b7ee654b4496f1e4187ca036ad19ba913cdf9bf9d0e832344dcbdb693ca6abbf5062429c9ad2183c9be0a587868
SSDEEP 24576:BfwvJk9RX6wkyAIKiyxknw4FYnshx8OfVe247:mMnYIox4x8EVep
TLSH
T13A95CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 88e55dc05d63b9de4d75080389d1b9a3466d82a7de4956b98b48776eb249b5ad
MD5 58765b0404778e5467ea360038d07220
SHA1 cf791d34e019d22a54858ae9c8db8f1ac8cd6ac9
SHA512 eb47e056b3a4151f640316c44880db670868973722bf4fe29d74f8814e66f25463c297c3715be1d0eb41e50feb8d5784f2c72ca528fc26a62aa9383dcb3870fb
SSDEEP 49152:9YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Lx4x8EVep:9ySzPTix8EVy
TLSH
T1BC066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e1e0d4f2f3e0b5dd36a5ee297cdab68f812a3f04043a7ec99533e7156e5ff2c5
MD5 c2a7849ccfc63de7395b461bc356725e
SHA1 de687e9f3bb98a3ec877f4d182cdc16f36528565
SHA512 3f977f54713f68af619741757154510eacd329e49fd785b6b19fb3f9b602e675fe9198f1545ab212169d7f9c0fdd1b2a4328252f9e60ca151910626077d28b8d
SSDEEP 24576:C47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYziyxknw4FYnshx8OfVe247:C47JUQj1irIhCnDHUPfF/bx4x8EVep
TLSH
T15465AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 12b4e679e4b5eebed1b28096d5289a829747da3ca84ad46602c2d0d7e31de108
MD5 d4f7b410baca9a97b74f9be370a9dcdd
SHA1 121f4e5fed3447f22dd042a9e7113afb88aef984
SHA512 ff2b184f645734abd8616ab36eb7179b82e11cac8a571756f40dcd7c00c757eada4f1069498ea514dc1b5282c016276e6d73f374e5af9bee7fd707dd12b5cb68
SSDEEP 12288:4+sf+i+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Y+iyxknw4FYnshx8OfVe247
TLSH
T14C75F028E29842E4D06E2236CB625641B3237C6597F1D3CB97D0F53E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 6c7a046c0ddbaff89909f74cc5e7c36f905a7fe1e3f4a8c06781eed7b4200d14
MD5 b298f5aa4cb07dd38427c646df4c95e2
SHA1 3276f615b559dce87d32d94c71b54740a2aaa644
SHA512 e039318ce0a294b00aad63732df32f58226e000ae87a458a543c884ae3ec07af8d3bdafebaf0ceb4008f17e81bd90e21b1bcb335a0b93fee888122782be4a92b
SSDEEP 12288:kjKAiy5SGPO/130+iBPS+XKRHom4PsCpm:kPi9zd30vPSKKRIm4a
TLSH
T12D451711766BD75FC6A940325E32D2CCAB707D02EE456B0773C8473FC576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 a3da16ea7a25f466892863e351080a6a69526b9b0d148625ee243ebc177ffc4d
MD5 6c1a7a9350fc5651f9a45b20c257998f
SHA1 68868e82f3f1f299e59a547ce33a0e1339f44a1f
SHA512 cab1d52e4818a40effa5ea678853111a866cabb63c2897e05fa56a564b1721056dc05956349b499b2591cb7eb6566f04ea2f9f50cf8c406419a9487266573fc5
SSDEEP 6144:vIBx0W3I3O6CFC7x9gc31AvKDexH6vKDexHuZIW/mudrbhZCGSUZLKb:zWuOggXo4ZTrbbRKb
TLSH
T1AE65D781A537B38FD0F7503207296B4CAB64EC07B7056F2673C8453AD86AB65B1B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 a920d7d87ae93840ac2d3872e6775e8b6c2b9996d0af228ba74eedffba8a0e88
MD5 8a3efa0e5a7f2541b1b2a68cdf839374
SHA1 894816930b059728d1c6c79e1896ed8908fb8f88
SHA512 18aa322e320ca0609384f77229bc7c8bab08a442f644441e300eeabf866452ba9d9a433a1686db7aec4e371d73fee88c4a913bbee7bb0cd9ebb4c729e03845fb
SSDEEP 12288:4472i+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:t2iyxknw4FYnshx8OfVe247
TLSH
T19565237CA7DEA892F86D11730676A231360AB5B49F70C19BD728B14EE4B0CD0D87E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2c64161b728985a79bba7183d29c93e2250f4e69f5a1936d39c881c3f1577f2e
MD5 fcfaa960f7a1252fc98b9e82bf3cd66f
SHA1 c43d4af2c1f37a97137099756f275141d32f802e
SHA512 735b82ecaccfd30bc1769fea380296fd0b8f476211c8fc3c692312437b4a982460ffb3f7068e8e767626a4123e187e97f2bdbb4f2af366b68ba052a5be46d6ec
SSDEEP 24576:Dgb6bmBIi49WNNFpg1rSvFv7bYoiyxknw4FYnshx8OfVe247:Dgb4mBIBhGFRx4x8EVep
TLSH
T12465AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 4aec90e9ed0209023af8afa4bb1865cca04a849f810ae5a84f1f6240e6c42330
MD5 ccb54a32f39be9dee468c738ff68a6a6
SHA1 9db9123d29a68e66cc4ccc0773bc299f865dd3f3
SHA512 7b9d6939dee3b816c004920444ed7b9c6e00075ccdc56df6bebda19ed9b2ea7e136c6010bca0ce28f1690e47a8a2f5bd2faa30e22ba7f4566c32dc2d5c54dfc2
SSDEEP 24576:cG88u8FpJqH1Kzria7/mDiyxknw4FYnshx8OfVe247:f7ZFPqVVa7/ax4x8EVep
TLSH
T10C95F16877E101F1D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 72a197aab2c529f3df5cd1bd3b0f6d2f3e836e751d93667f25488ef80ed06701
MD5 b06f9f56858aedbf41a49dc00dbd5dc5
SHA1 67e34b878b975d24af20ffacda2861c0b3bb2f70
SHA512 578891746b5a9b8727f7939eb862a008bf23e21cda58b10e8922c3feda4fc1aa0558ac24d25c0b125db1dc71a04d1090cc34eb7c1bc94de6d8893abe1412b3a4
SSDEEP 12288:vHvUrBFrEjwaQXi+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:vPUr+NQXiyxknw4FYnshx8OfVe247
TLSH
T1C175F12E22ED18E5E67AA17D89928319F771B4621711D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 49bd684d78a5191cca1c3bc9eaacc627cf49a529f8e3cb194d38e5fe9b9c4248
MD5 2d92cd0f3ab453d8eb292dcfbc66f475
SHA1 0bbc20c5010c29b51ba28f722551cda3d44a6121
SHA512 f66d70fafcb480e9645c2fa625a64806f83d75a3a5bf8fda42f43ce6051fc6c50230abbb143250166b7ce1b0792617b45cf899ecc17d0b15884041ad3a389766
SSDEEP 49152:8BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjdx4x8EVep:fG05lO43bgix8EVy
TLSH
T1C1D5CF6E62EC11F9D1BBD17CDAC6460BEBB23425033556CB02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d9aa5a5ff10aac5e305f6bc720a137eb81f4e481e2e0a3fd1a4b165c30ff7a22
MD5 040c3e9f073b7807b8d7c305e4f3848e
SHA1 dcb4b7096ccfd55a966858b0fdd3f14c44f8c78c
SHA512 777f9d39e5c0d4d12a199c73f518eb231826eb97e5419cbfc4335edf2b9e6245bc4f6d9a81ac68b1a866fdf0706a7fed2b2bf0087bbaafddceb47a08bf74a276
SSDEEP 24576:yfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnhiyxknw4FYnshx8OfVe247:aa5POZ3+Jt2pasx2+mlx4x8EVep
TLSH
T1DF65AF5DA6FC01D5E5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0951f71374b55adbf56a648e73b32e7f27df62ab53784ba6502cac384e35ef82
MD5 75f207c90c475895649ba52604c81e06
SHA1 9e34d3a79531596237af289836f6dcdd2da86be5
SHA512 597fca9b54c36c6346142904d5e3929ad104e7c33ce3c6701c10934c354c2c89d3b81be2690e527ecf6991d694d576ec25f822f3c536903a26b2691e28990342
SSDEEP 24576:qNcwHdjbyQ4nLC18lb/EOjowL7Fkriyxknw4FYnshx8OfVe247:qNc/zEOVHF6x4x8EVep
TLSH
T122857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8afda49f9707b2876c019e76135fad388cd8c0cb7a06bb6a1fb6aa2ec021b7bf
MD5 162a3cff9fde2a13880af90dbca1aa4a
SHA1 c0387c1809f20033c2a6a27d943f7277340d3212
SHA512 3d087261948ea8bb1996cd358b3dd2ec72f83125f252d9724514a56cde86f0aca25dc793a03710596e4fa396038022a44059e835b710e56a16241ef3c1d0794f
SSDEEP 24576:x8kNvNnaFeYhJNtmZBm3yxknw4FYnshx8OfVe247:x8MwBtOmCx4x8EVep
TLSH
T1C055AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 74c517e34a7f1302e73add7eb6da0b6d8fd9abf01776d6ea99288efb9d120183
MD5 477fffb6b785b0d1df22427077687f08
SHA1 ce7f6ab8a3b601bf53b4bae27e8b77d43c238c4c
SHA512 32c4fa9c836f6647b417758eed795549f792b9f82df0ab81767fa8704ce626c68c310a2999968abdb3831e088f24e2e58675943fc1683adacad4bf0bf6c7ecff
SSDEEP 24576:OD3FHshBIYQgAyiyxknw4FYnshx8OfVe247:ODVHeBIAAwx4x8EVep
TLSH
T1B485E17DE79C04E4E57AC1BC8A638606E77138A9033256CB02D491BA5F67EE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1056-105-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1056-111-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1056-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1056-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1056-317-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1056-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1568-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1568-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1568-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1568-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1712-283-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/1712-59-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1712-65-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1712-58-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/2412-316-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2412-124-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2412-118-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2412-116-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2444-77-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2444-69-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/2444-71-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2444-298-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/2540-51-0x0000000000400000-0x0000000000568000-memory.dmp

Download

memory/2540-6-0x00000000023C0000-0x0000000002426000-memory.dmp

Download

memory/2540-7-0x00000000023C0000-0x0000000002426000-memory.dmp

Download

memory/2540-1-0x00000000023C0000-0x0000000002426000-memory.dmp

Download

memory/2540-0-0x0000000000400000-0x0000000000568000-memory.dmp

Download

memory/2564-313-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2564-81-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2564-82-0x0000000000780000-0x00000000007E6000-memory.dmp

Download

memory/2564-87-0x0000000000780000-0x00000000007E6000-memory.dmp

Download

memory/2616-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2616-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2616-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2616-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4476-21-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4476-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4476-20-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4476-13-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4476-91-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4668-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4668-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4668-38-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4668-56-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4668-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5996-99-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5996-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5996-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5996-93-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5996-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5996-332-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/6112-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6112-131-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/6112-137-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/6112-139-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/6112-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download