2da7703d48caeedb136151f317f1a222de7a761f16dc13ebf941870dab04cda0

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_3137022de434d24742f379ebb6af0361_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 1.4MB
Sample260720-tklwlsht8s
SHA256 2da7703d48caeedb136151f317f1a222de7a761f16dc13ebf941870dab04cda0
MD5 3137022de434d24742f379ebb6af0361
SHA1 a9aa9964993f690c529e73d12f4397e27cbf8786
SHA512 6e7de8e63d8436587067928c1c5b45984daf0bd1fc67146ae79c5fb73dbc056c07dcc2b9519c764e2eb7354daac12e42567de983dc77bd4ac90f2f8e5eee3591
SSDEEP 12288:wV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:wVyxknw4FYnshx8OfVe247
TLSH
T1A265237C7699D072CC0910730635D3726A1AF1709BB5C153FFA9B66EDAB08E0A53E226
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6108	elevation_service.exe
1424	elevation_service.exe
1212	maintenanceservice.exe
6088	OSE.EXE
4244	PerceptionSimulationService.exe
5832	perfhost.exe
4520	ReFsDedupSvc.exe
4772	SensorDataService.exe
4764	ssh-agent.exe
2824	AgentService.exe
1780	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-20_3137022de434d24742f379ebb6af0361_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1e73a414e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-20_3137022de434d24742f379ebb6af0361_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_3137022de434d24742f379ebb6af0361_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_3137022de434d24742f379ebb6af0361_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-20_3137022de434d24742f379ebb6af0361_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-20_3137022de434d24742f379ebb6af0361_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-20_3137022de434d24742f379ebb6af0361_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-20_3137022de434d24742f379ebb6af0361_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5808	5164	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_3137022de434d24742f379ebb6af0361_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac318eda6118dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074a248da6118dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c4b3ada6118dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
6108	elevation_service.exe
6108	elevation_service.exe
6108	elevation_service.exe
6108	elevation_service.exe
6108	elevation_service.exe
6108	elevation_service.exe
6108	elevation_service.exe
1424	elevation_service.exe
1424	elevation_service.exe
1424	elevation_service.exe
1424	elevation_service.exe
1424	elevation_service.exe
1424	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5164	2026-07-20_3137022de434d24742f379ebb6af0361_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Token: SeTakeOwnershipPrivilege	6108	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	2824	AgentService.exe
Token: SeBackupPrivilege	4520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4520	ReFsDedupSvc.exe
Token: 33	1780	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1780	SearchIndexer.exe
Token: SeDebugPrivilege	6108	elevation_service.exe
Token: SeDebugPrivilege	1424	elevation_service.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 4488	1780	SearchIndexer.exe	104
PID 1780 wrote to memory of 608	1780	SearchIndexer.exe	105
PID 1780 wrote to memory of 5352	1780	SearchIndexer.exe	106
PID 1780 wrote to memory of 5636	1780	SearchIndexer.exe	107
PID 1780 wrote to memory of 4276	1780	SearchIndexer.exe	109
PID 1780 wrote to memory of 5824	1780	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-07-20_3137022de434d24742f379ebb6af0361_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_3137022de434d24742f379ebb6af0361_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5164 -s 504
  2⤵
  - Program crash
  PID:5808

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5164 -ip 5164
1⤵
PID:3360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1212

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6088

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4244

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5832

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4520

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4772

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4764

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2824

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4488
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:608
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5352
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3016 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5636
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4276
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5824
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3016 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7d933de66904c9723e1bad701ba54e884cc03af843d21bfa02cbd259278cd3e1
MD5 a7c910e1477c80b4b100e3b2735951fb
SHA1 b0b752618a5f839ba6bfbdc5c33d6c6a1ee539e3
SHA512 b543db96b3609f8d2ad07e51370bf1fa1a62a5cc442e4419aad637f1648c04677095ad5d7383d0a5ff8f5edb4a1b1d5e2461776705b07e9c2f055f44352afcf8
SSDEEP 49152:fb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnYx4x8EVep:d3q6HjBXix8EVy
TLSH
T1A4D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 fe74ed11da5e9cd3a605c74988557b19181e640eb4d8d4cce44e63afe0bcae02
MD5 4d1261bfb37bae438e737a6d7f460d8f
SHA1 c50487afc43b0c16c8fe995533ff1bd42469b1b8
SHA512 6a6ae5f9662672cbd71fc6b111c28d79ae1666154280f25d8fc1265a9e2ec1ed193cc4b83fe9deb4a1eea76f64f21960fe92bdd05084baf473de9f6f9468c246
SSDEEP 12288:n1XLsswWkxy2lRq2czAI+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:1XYfDtczAIyxknw4FYnshx8OfVe247
TLSH
T17775012873E508F9ED6B8139CDB28512E633B8914770E39B03E495295F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 bdefdcec131f929b06014f8a09d790542ea1a4f8f3b16740474f625ca0b4096e
MD5 68de6c3ad80594cf8c8b382f7d359264
SHA1 ba1eb15c53f7c1ac45c29a3df558d4646518e938
SHA512 0a7e959703ffeefd92d8f035445ec15a34b9d8161255cddd790921f26888bab88472db85d2f4e37ee3f8c3eb2440c4c9f93de18c1f8d5b75be6846ef4c715946
SSDEEP 24576:a0Le5ji0hmxFrMQyxknw4FYnshx8OfVe247:aPji0ArSx4x8EVep
TLSH
T19295AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ce6d0f4bc6665df72608771a16d10a45aa5af842d94a5fd824f82a646f70dda3
MD5 02c763eab2a0df669a37c08fb468a1b1
SHA1 aac3fc80535cdf22ab83deca232eb48fdfab7622
SHA512 48a3dff0121b6ceb48c16a9575fadb6e9fea9cb95b950c37e21c74bf6d275f920e4e79f3864c42e0efea6b33f14f16f99c42e9f2f7fe967dca10730ef394faa6
SSDEEP 24576:Ja7/ezSC6vUyD/aqgrvWE6q8wyumyxknw4FYnshx8OfVe247:4/ezSC6vUzPvxHjyOx4x8EVep
TLSH
T181756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c0ba4a633860847b6f0c9efc99d83920f4f14bbbdd3dcbe0aea22f0cee9629bb
MD5 dcde80c5d8a8818449f62508869fc3da
SHA1 55a29fb2577942b4e73b9a37ab1f9cc826466c93
SHA512 4b1f603a77009ce7d5e234590a832efa9814f025453375ddc63fe491c47a496cc304d48384863b21e06fcfa4fa0d7ecd67fe90fd727da36d4484685ab30403b1
SSDEEP 24576:WVbqPb88hv/l+6Byxknw4FYnshx8OfVe247:WVO88hXl+vx4x8EVep
TLSH
T1A7559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 c53d5f681f3a78526e9438fde8b06d78df7f1a265e2595fa2802bf953eb64d70
MD5 6e41e80a4517e2332d529cf4c6f170de
SHA1 9acf024c4c675b56d658ba15952017ad77e200f2
SHA512 0743c3d3cefe8b7d0e7371e924281dab23cf0e2ae7dd09696d926bea2741d8d7fe144248a856d5238b9a0f71cc03f803848ae2c504c4ecbb5b7dc42b9f5ab31f
SSDEEP 12288:VNs+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:VNsyxknw4FYnshx8OfVe247
TLSH
T1706523BCA7DDA4E1FB5E14331B7172622616B9A4DA74C11BC778B14EE4F0C60E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 3b80ae8fef6c0104d130cb77ed440802e9812d09a2357474fb64aa305848223c
MD5 9641f11aed26d8e7c1d7a7b3b524a942
SHA1 123c21f372850626234e6b2bff734ee67af9f558
SHA512 0d369a9c5061c504e0159d596709726e80edce40a1ba271cd34c28a9af75cbb69c2085fca8b24791ccc348fb1f1ca88b7b2d35b3eeed572668cc5766a0b8490d
SSDEEP 12288:ieBNUbTVO86UJ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:iJIUJyxknw4FYnshx8OfVe247
TLSH
T17175CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 94d41b4c23f8d00b2e0956210c2a3e3de610efbcb158a0cdebbfc10b5895df40
MD5 77f8b1897eba5a00815d5be3d60ded5f
SHA1 ed2d985d742ca415de6bce235c64c7629e9fd9d4
SHA512 a7f7e04859687c9ad258113de42b0a090c0dd19148fb990c1a5d205f4aae6aeebd4402fe9bdde18c69df737cf58c27765daa8f14015b8f4368566caeffc6e910
SSDEEP 49152:/QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THK:/QvGAdlCEL8c/yRNw5CJix8EVy
TLSH
T13E267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 60a310071a058b524299b54f4f5274c7ce0c388be8f0a021a187d2f792415dbd
MD5 8cbb09577b778d068b6728f4bc9a4454
SHA1 9ae32ed24f89f900ee0b25b65b33dc8eedcd3650
SHA512 ee5e3b0a4d4af3b3ca81286357d5d942e6194940acebecf4d0356636953d7c8c01ccf409df1a2e0fc2362bc4d689871d34f8575a6fdecf73fc88415c6d2b8d4d
SSDEEP 12288:lAwSfxL/2Dc3LDLLmt0LDQewsAj3+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:G6ewsAj3yxknw4FYnshx8OfVe247
TLSH
T18A85E030FE74E032C7BF0DB21B36D716142DB9604B611AC3E3B89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0d776adbec8668869dae5fbb8166b64af1cb053478fd5f40b25f4e1bb1847aea
MD5 e4bbb4a2d693ea5ad76aaa5d63f341e2
SHA1 17a47181d14e2363432a8cdafe44ef440c90835f
SHA512 d8e7fcc433f513d776d93be54c5ca4b4216bd959f345b87864eff05e24c77c099c55998ce53419f1ad4ea2b412f616beaf531c92cceff241eb4bd865d08ac851
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHf:6UEtQevvqc2W1cpV2EI32
TLSH
T1A4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8842f3af95a572a0e05f74c297f24131d9fa64f877d865e7dd1076cfa8aaf014
MD5 c915b357a2534dc4d03b81394a1afa42
SHA1 e8d64f3b8a4ab550cbe6eb032373505ba908493d
SHA512 20aa11dec6ae3c78417b80f4e9a896313ddd52565235c413d3ca2fb161c07c3bf14621f7d01b5901742049a13d79cce6462738057afa2202f7f57838e7508300
SSDEEP 49152:zCbRquA/m2yL5zQfFiV+XenmE3/zix4x8EVep:MoqtVjnmFix8EVy
TLSH
T14FD58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ab2c56b0773ceebb5a078f81d48ec2b41a6979c25d5e224aa5506eb34fe9b031
MD5 fa73db48c59395abd426cbffa3ce39b1
SHA1 179111cea1432510ce2235605b26b170f354e8cd
SHA512 d131cd1848a7441abafb3229168098f9af706966abac81335e5aa1d95245b5d22e97bd41b8fdc47d478d2ca21e22fc0d39787c4f7b985bab26f9aa4461a4ac3a
SSDEEP 24576:4AhGLJIFoiwtA5l7S53Kyxknw4FYnshx8OfVe247:4AMyFoiq51x4x8EVep
TLSH
T13E35AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 a7b170d06b6770cce43e06650828418ee2ba5a91fc339ebcadef85456fe3da73
MD5 0271154999da2694eb62e0480cec2e92
SHA1 fb3ec7924b4f5e8454edc3ff47ee45e0dcf00a2a
SHA512 6c5adc679abb61af7b849f5303b3c5edbd56ccea125748b97916feb3788b7b1b811256692f006dae0d2198bd98f8b884f44245ad25f324b844de183178f44986
SSDEEP 12288:nmw5HEjsChNoBFgl0WDm+CH+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:mwuFOW6yxknw4FYnshx8OfVe247
TLSH
T17475F14977E91CF9E9A741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 0eb07cb3c1cb00e61aee60ca26d1d2e57a1b2854c5cfad3d9daf289a74997a6a
MD5 ab39c0962d0c7ac563397921f01604d2
SHA1 75c95b7fc9c81c7e1d3aef483072786a548adc16
SHA512 33fd20dc838b89b623e3ff7da866b4e07fc3880178bda00d7f5377df193dae213a028cb2d55c7064c6ac126f0d7d0cd74958193ef3af42a29acb621bb0759b91
SSDEEP 12288:XFZ1Iyn+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:VZu4yxknw4FYnshx8OfVe247
TLSH
T17E6512AC33E860F1E1A7113A89F15205E76274A2677183CF4768625EAF72DD09D3D723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 42321a09b3730f2162ca7d7ba7f0a1afe2ca4a2f6a5a569ea27a6208adaf0f41
MD5 fc6571c49dbc4ad459f392fa6257c04e
SHA1 8ff6ee2aca0be0729889138f7dbe6efe5634906c
SHA512 b1783556ff308ffb214a47b57dadb1b04d5c81dfd245941e9a40b731b97be2d6909a80c291a27bc6d6e72204e4764cfd9c79410a48bf5c5788952b0187c4f409
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U+:wQRQyi36YOcPQLvw2gAf+PN34ix8EVy
TLSH
T168667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0470d1ecf7c81ba9996f35ffee134409132ff57ddb95e175f19472313f402ca8
MD5 72d27a9d0b83a11060eda85a5042fb1a
SHA1 598207b36ca598e01b322f5344bcf8d1a958497e
SHA512 9bc3e7776c259015f5f74234d5d4c4988cffdacb1d207c4146cf214e3b3731063b7e0c53060deecedddce409d116468d8ffdce35498fa5f440c680a50fd3fcf9
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U+:bQRQyi36YOcPQLvw2gAf+PN34ix8EVy
TLSH
T148667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d1c3ad98c8167115125f5cad8ccaa8101609f8430cc4a7157dbc7d8af869c221
MD5 06acdd26ec4b9df2640bb6c66eee0a95
SHA1 441972c5aa2c808d2446516060781fcc184534a1
SHA512 ea3325ceabdc130d4c17c884b64debfdd2bb6bdb412a0d700d19809a0c324f4fa47308e7e1471bcacf6554732270dac871ce49049024d4075718e10627e20f00
SSDEEP 24576:CwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Iyxknw4FYnshx8Z:868Qg55nhheWu7PNU3/Sx4x8EVep
TLSH
T1ABB55A33B2F600A9C44DE1769F46873196D27C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a609c8c1cb1bc9b6fa2b9b67cfd99ddc74d6a2f363d4ae2a8b64cba575819bed
MD5 7b6944d9b6520d3e8062fd64a5c1de3f
SHA1 26a42d889c7d70316b36170a9908622e6e6a5822
SHA512 2072717da5194119458b3b95b400bdcdaed7d0153204fe5bbe619fab1dbbd7f176337acb255070e62464e07c10fc4c70a5d2518f394b28574fb5e33368c17a56
SSDEEP 49152:G3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99:Xy5112gYy5azzVvL69nLKnhZHix8EVy
TLSH
T16A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ac3470cd98fca20d899876f86fdbd4f8a568a88472562b131fcaad0ef6ea04e4
MD5 b36f69ae3763d43119a332cb0dbb0af3
SHA1 622e2d00ab78cf3d5647cbf11da000dc89ce9283
SHA512 7b827b53fae39a599377369da9de935f233a3ec3a050cb728e4384df7c04cee306aaa4fbd166c1745e809bc41bf36a5a820e9e1b1d1036d9e50ba9a136d9d40c
SSDEEP 49152:GB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl7x4x8EVep:0u6JmVxd2d7ix8EVy
TLSH
T109D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3e0e85a3cc435c86b71d7e8eaef9a29b6da38fc069ec9c87c97996549b31bc16
MD5 9516b71936938c6266fed485cd54af87
SHA1 713b29b389c79c1168858fa0bdae4480ff60ced0
SHA512 379f6ca0a5f193f5d95e3363ca839425a4044d62d5e1d95b664174b721b0617305b811c2fe9c2aaed905f3260715e599cb0b11f4ace108f7a84563f7f3860838
SSDEEP 49152:b1hpsNoJpF1A6UU44CwH7R4xsx4x8EVep:bmifPbRFix8EVy
TLSH
T1E7B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2612aa96aaef7a944d484bc74176d71ccaf2e8752a849fb4352c67a35adf3f23
MD5 55d55641f4812480966fe5a35e929e7f
SHA1 8bd39e6519ec0c3201743439411e7c523fec4285
SHA512 fe32fd83e71a77749a5c5b9252fb29423b4b82fec08035f30cd958e1f8bae1cdf9beeff7eab5dba9c2c7bccaaabbf2cd0d0bac9a0b571e2bfb2a0242db8e8f99
SSDEEP 49152:ISuZQIY0Be2KRRVtOnks6NMHqbx4x8EVep:S5dKTi61bix8EVy
TLSH
T140C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 60ffedd8f15debb4e59bdd4bba6b52644762917e5e3e8593c1863820bd1383d5
MD5 50d642d864efa06e8c35d3d592f605a8
SHA1 4222b3e85e4aa764fbb168bda5c4ffd634d5d966
SHA512 1ffe56012a689a44c613548686e1548fb986f1d6e3050a7f1a4f0f06eeacc2568b4e3d99bf0eaa65fa5fa5a86b335506b97a835e0f367cdc56bb401d57e9bb10
SSDEEP 49152:4htSn8EApI0figngiDn0AP5wQx4x8EVep:pX2iyphhix8EVy
TLSH
T14B95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 73059d31149cf3033074ac579dbc5e61bbbb54dc5abd111c845e5c1ffd443fff
MD5 2acc1a1a3a2455a3b9e8284694413512
SHA1 5be311f4189f0ce1c453930317e60f09bd6c943e
SHA512 1b52c6d3b1c4e75db963ac979c38ce266cdc0901df5f39cb180a48be8a5dbb557da220e4998bc593e57f0762185c707af0d48b223c0b9ce6e7f3d1304495fa4c
SSDEEP 12288:3U+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:3Uyxknw4FYnshx8OfVe247
TLSH
T1386523BCB7EF95E2F50D11734A7162626609B5A5EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 d5d5a8e0a7f6a308cb98904260787b20879afe2842ca2bb1215412687ad21c46
MD5 57b70fa519dadc1bbd4dad18f9433252
SHA1 2e91a27acc20a4d85994bea95528925c6057cdc0
SHA512 a57a38156be1bc6f464543890ac64105503bda1164ff4da750074e1d9bea689c5e20283b467415927dfede08b212bae5bf51c24c651cbe6a17443e3990288c7d
SSDEEP 12288:0j+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:0jyxknw4FYnshx8OfVe247
TLSH
T1E965237CB7EF95E2E50D11734B7162626609B5A5EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 bbd50133f478e2287e5937241fda32ab38c405c9666f04341068d75de46963f9
MD5 107e75b8243f5301ff9f98b900c4acde
SHA1 98a23d94d683f168a07e6aa6eaef171bfa9f74df
SHA512 4a2c7095679ef4f04a9299d6b94b875bf3b323a262c49743055a805de4c214f8b0c6892f60ed3dab5916efa16c90cdbf313d1173c257769935ac361fb214255c
SSDEEP 12288:tR+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:tRyxknw4FYnshx8OfVe247
TLSH
T18A6523BCBBEFA5D2E54D10734B7163626509B1A5EA71811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 7614e9587b253ad0443785c4d712d5d79f7e181a1e1de16afc5b23c9d625aa73
MD5 bb14682685feb5eb35b2f8ea42171fbe
SHA1 0f43733581b35f0035cdb076e64c1a520abbf8cd
SHA512 b68b162fd8a4765f10f47493d9cc8ee17f5ddf5a674ea1cc83600608b4aae2cb0ca2cab669bba1f56d0b34789d1d2bdcedf9ac639437bc1d09f8c92cdf8641bf
SSDEEP 12288:9Vq+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Syxknw4FYnshx8OfVe247
TLSH
T15565236C77EE50D1E85A51738A726222B365B8E5E731C35FCB24710EEDB0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 3390eca0e540aa373d2b7254fa6992a16c50876834ad9ec92db08e98ef553321
MD5 200ceaa1de587e8c49b18c2a7503236a
SHA1 1d5082540a58c51f37a688acedcd933772969736
SHA512 27d0758568fa02af33b4fff48982648e67ae66c465cdceb08d8124d7aef0520cf2557dc2c897f7984f81c275eea8b615f7b6c4d3909cc227079d07322ff99207
SSDEEP 12288:8C+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:8Cyxknw4FYnshx8OfVe247
TLSH
T1096523BCBBEF95D2E50D10734B7163626509B5A5EA71811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 31713e4f7f1df727e53469a7cc5e2d3f501a269d8feb006313350f22860dfb0b
MD5 d98f99c4af4bd5ca5b1c48e36424b5bc
SHA1 e32af7fab3915e826b63dfa08eca369c4702d696
SHA512 202eef4a51c46cff917f3adaee9b6caea1a4dcba6c9fb94a4e9d710bde35e4989d973d76b2a7129e063bb7f9bca7507e4b7673946d14322a3cd9e5d78b3ba08e
SSDEEP 12288:x/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:x/yxknw4FYnshx8OfVe247
TLSH
T12365237CBBEF95D2E50D11734B7162626609B6A5EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 2752459e3b106c1164dc1082af8912ad7e8383035d3f3026de76be331d00db02
MD5 c3cc54f3e5bee2155c001c8284c20a82
SHA1 eb51c9eaa4300fc6bfbcde3016a601969d4823a5
SHA512 d1e32acc196b483585145b36ba50990066b244dc9335a9131843228f9c5b1eb2253c8d794ffc370dbf44beb752238c46b90b11d41bd7f5f78f7a747b1b65031d
SSDEEP 12288:Sb+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Sbyxknw4FYnshx8OfVe247
TLSH
T17165237CBBEB95E2F50D10734B7163666609B6A5EA71811BCB7DB00EF1F0C60A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 9b6bc49fc59ce86b758efd2973b293c94bb7818ea4ba6bf31701c10db2bfcdcd
MD5 8b3f8dd3a4a53bab585aa60f9631e5e9
SHA1 2daa48f84641ae7deb88239ed6e2b873036e04c9
SHA512 848abf5ab30cb25964a1a788555f15a87fc991e42879e2b3dc51063241cdfeadf07e0aa9fa8bfff68f1387110979990fe9946dc3e38261486b23ce7bddb14a90
SSDEEP 12288:eiZwbZzzFEoS2cPvyD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:BZMdzFVSODyxknw4FYnshx8OfVe247
TLSH
T14E7501A8B39018F4EC67413EC9259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 b692e629559046952507189097e95864fe376436f315b56e1c42c2e0810d3b78
MD5 08ba2f28bbfc3d45d2945f45e81c8a56
SHA1 6f582dc75102edad7d3111969fba96305f752f71
SHA512 18f2778386adfd9ec1c701ee3390746b9dcf154bec3cbbe5ad4cc386b495472050a1bf198f49b0f223a60ce4a4c8c3475b7e7cf31b2f6bd2055beef28aa27aa8
SSDEEP 12288:7o+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7oyxknw4FYnshx8OfVe247
TLSH
T17D6523BCB7EBA4D2F50D10734B7163626609B5A5EA71811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 21fffe720bde3b74da9897ade94733a869ee53fa187b25df4c24af47de37e895
MD5 35db2b320b6f452982043c21d5b1bf6f
SHA1 5db8ffaa6941245653d77e249a9e5070d754e371
SHA512 82fd34c1ed22869f9b4983ca46e6f37a2b3ad01e018646ce2c06fec8523916e24f1c45458568e3cd54678ce522d8f0c5457d7ce7d6bce2021306212e305a8a79
SSDEEP 12288:Ec+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ecyxknw4FYnshx8OfVe247
TLSH
T1E265237CB7DB95D2F50D11734B7163626609B6A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 d26cd8e6ac5db4f669c3bc21361af6733d28a216be08da8729cfd123b5503345
MD5 a5fc5088d3b848ef07b12a607352021a
SHA1 2cab56337b7432c760fad2846cd08e874766c887
SHA512 47e54543678016a20ca8ce75b78628ba609aa2a962155556544cfaed782d51156ac1c997ed6652abf220414000bf3a6f195dcda743f0dd04edce821191e48dda
SSDEEP 12288:lyPz5L8n+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:szynyxknw4FYnshx8OfVe247
TLSH
T1A275125B73E530F5D12A4236C9621A12F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 9e62bf32bcc1af7e5425ee8d8e7083ff59edc2462ab8b2bf297540872701acec
MD5 7f3d3121b4af97cf30bb66b57aabe393
SHA1 af6d762dabcb6b6fb8548ae286a12dd5da8a1025
SHA512 5cc0076eb56ae4219f1e4e7d2459fda428fa1d04b18847ef3c68500abc959e50b9ee8b180cb818a485ce75fcc24e2f096afb4ad4a50d0df025834debb043ae5a
SSDEEP 12288:io+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ioyxknw4FYnshx8OfVe247
TLSH
T1066523BCB7EBA5D2F50D10734B7163626609B5A5EA71811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 a133227aa4f67e24df85c77ca9e4c2affdb467288ff2561325651f81acab9631
MD5 b141dea215315f9a12bd8ddd8dc5f33d
SHA1 7045ce97ebf97469b08872b9a072c67aa4fa0349
SHA512 5e5a665cc52f5d438044b4f109dedb10042f108ac8fb0f3078627c4240eac9e1bb304ccef28621c9ac921835f800700908db213b3bd5a0b956b495b35263a7cc
SSDEEP 12288:eo+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:eoyxknw4FYnshx8OfVe247
TLSH
T1B96523BCB7EBA5D2F50D10734B7163626509B5A5EA71811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 a68fba3b5a22129173fe9806abba0fb9c56ef86c1740e7e03c3603dfca7bd949
MD5 8056df3fa4efa1a4c0fa4e43cb3bcb4d
SHA1 d200086f867d4315ba8a2c4bc4e4746045bb24b8
SHA512 b5e581f3592a9936c8967cf5a266592e7cdf893424ffb34512f6d58cf7a0cad4bd513dbe3da625cf556fb10546842a51a8fa94e9b0277901af0317e808292053
SSDEEP 12288:eyPz5L8n+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Dzynyxknw4FYnshx8OfVe247
TLSH
T19575125B73E630F5D12A4236C9621612F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 9fd89dc54ee22f1d5d5b6633f9840efa3004a84fbde66876a157dfdca4642a4b
MD5 41e8d2a5c255180ba44405a3375a874b
SHA1 e37439c3c411b9d8b3f60a54ee39baf656ded0ee
SHA512 1e8201e8640487a9a778f5f7a2c65a1e966e4ee71e91dcfd21c7999a0b879ac8c57c6dea26f64987e3deac05298a5f5404815eec7b190feac2312ce10520c9c9
SSDEEP 24576:ZTGaLl3z0zDhyxknw4FYnshx8OfVe247:ZTFLljZx4x8EVep
TLSH
T1D87502A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B9F736A05C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 734f86ae5baa720262e23c5e782b5af34fc097b9ccb607f215f2afb9b80e2688
MD5 0c91eb8c7e606f6f30178185c6591c07
SHA1 cacb081e58e0aebbc195af953ef5fe53d56926c9
SHA512 55b53a9f605445a489c2d401433621b248caabf4926ee0502e687c47766a425e041f73bab8d94b64d83b233dd5db2db8c025b035f46a932f0d0ae4753dc22205
SSDEEP 24576:p3nd9CHKy7GZtyxknw4FYnshx8OfVe247:5nd9CHKyaax4x8EVep
TLSH
T14F95CF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 1dbaf88e4a1fcba0617b81fe9b68a402e2c3a9d06cff23640e0cf8ccbf90d49c
MD5 4b033e3aac9903caa483b9aa712cf207
SHA1 9b52d9b509239bed108480fad16fb02c34505988
SHA512 1e1b237d26efdc5915e9800283ff71f6665660313405450cf855e52a73c721bf18b423754295c2b895766ef60d4882a288ba04919a8d62173d864c18bc1e4703
SSDEEP 12288:Wx+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Wxyxknw4FYnshx8OfVe247
TLSH
T1EA6523BCBBEFA5D2E50D10734B7163626509B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 b85b701c19dfb74cb6831ec4a9c584edde1ffd0d8a1b3b15e0e9ab3696a5a990
MD5 cc6260cea22e48de4e2369cc311e877b
SHA1 aed7d07125af6ee8e997213db2831a28b1aa61e4
SHA512 780d4f6e684c9bd39544e71426202334a98f8ef36078459413d0b2a0ae98297ce2d7aa04d57c65bf481d3d7e1852dafaf3a92bd845e303b71af7d3cc49d5376e
SSDEEP 12288:7H+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7Hyxknw4FYnshx8OfVe247
TLSH
T1946523BCBBEE95E2F50D11734B7163626609B5A5EA71811BCB7DB00EF1F0C60A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 89e41d36d6c22f344c95ec07d097b3291a04ca25998c204a105dbe509fd12ef0
MD5 f3ef577f98e05fc53ceec3e8d13b337e
SHA1 536f7cda885488e5b97c06022aaeaf4d2ca7ec68
SHA512 4e193efacd22974f9bc08af17b3f41070c09f646acf286a7077159c36d6c1b03d11966b5372cef71d63da17dad58303bce26607bc5a8ecc9b03e65502ffb267f
SSDEEP 12288:Re+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Reyxknw4FYnshx8OfVe247
TLSH
T1026523BCB6EFA5D2E50D10734B7163626509B5E5EA71811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 8319af91de856624bd6ee7ea9deb461270f2cc7c946114f32807e668c4ef2935
MD5 b7d9edab88a436f56412e388c64a5531
SHA1 069565b85a3664e6ec4cc5650a82904d95dafe70
SHA512 9fa4bd4ae918a80c210a38452e1ea9d966a7ff87c74a1c793a05106345b041e8be80451a90690c2df6f72423d7e8c3363e3ade2bdf8aaeeaf181c339ae070010
SSDEEP 12288:Xo+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Xoyxknw4FYnshx8OfVe247
TLSH
T17B6523BCB7EBA5D2F50D10734B7163626609B5A5EA71811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 8e634b82154d6a0d01efc74a127c4d92a0c14e5e4dc27076eb35dbe3beac6c8b
MD5 5f1c7eba7979c1fa050e9bc5e6befcb4
SHA1 4e28069d62405ec285f6f25edd769ddf8efd2e1f
SHA512 183ad804005df76e593574d2c9aaf34a515dabb48611a8741a6b02aff4a32649e6aecf50a7ab70c8bdc616893845b82af8c11a0ce06e8467d06110fb7faf3201
SSDEEP 12288:lx+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:lxyxknw4FYnshx8OfVe247
TLSH
T1C36523BCBBEFA5D2E50D10734B7163626509B5A5EA71811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 03438673c9172bbd0d31323e87c02415e4679ea7a208ca734b9fb7cefac71143
MD5 813077a5908377e5d7e8a24567c51965
SHA1 35d24942cd1a1220ef66bcc126aecadb02a757e9
SHA512 cd31ff5f1dc0077ee51d5883ddc30b433c1fd3a859711f419dde40308e816721918952669b0df0daf0806c62dd85343010a4861feebe3a122764d91fb7bc05b6
SSDEEP 12288:6g+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6gyxknw4FYnshx8OfVe247
TLSH
T18F65237CBBEB95D2E50D11734B7163626509B6E5EA72811BCB7DB00EF5F0CA0A01E523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 601aa2594fc0c30b8dd2beb4af7464a85ab56a7a07d36cb4cb8104b7594c31cc
MD5 686a95c59fe4ecdceb64ac6130069286
SHA1 2e7cc23fc63a69b8fd110941aaa96d551822cdd1
SHA512 f9819bc7dcb78fdd59b522b5aaca3143a63cc613773c6c47bb595ee785341eb64dfc21eaf1cc0553de70d103c11eee7d30a5af6b778d9129ddff75745d968e1f
SSDEEP 12288:LC+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:LCyxknw4FYnshx8OfVe247
TLSH
T1586523BCBAEF95D2E50D10734B7163626509B5A6EB71811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 ec8028e3c99b682a38495aaab31ebf81b5083877a40df3676816761a971e7571
MD5 f1505c41d99416f37797d0eae0a04d55
SHA1 aeb2b8a0981bd858880957f12a3c194e49dff0e0
SHA512 074e1fe2b4e0fd57055d7d3d2a48da3a5edfba1a11d6d1bffaa6ade091aee419342ba3d3619f80e4e3bcdde9d3d12f13142de5bdd742ffa0f31bc8ec2bb4dab9
SSDEEP 24576:QfwvJk9RX6wkyAIMyxknw4FYnshx8OfVe247:ZMnYInx4x8EVep
TLSH
T14095CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2a98695f3912e972153be7965906b62ee93704ba0e6298de0b7a8fb36fdd8ab4
MD5 230bb29ee11285cc6ef6c88fa0cdb0a8
SHA1 63b1914b67491b2fe8c7c2e61087beccba28de18
SHA512 32cdadb6ede8f8d02c0fb9b1e4331296e421c5a7be14ee4b58d3782128df4082a766fbafd0379cf862682936f58cbc63ab0f29cffac9cfb082ed037c14f72414
SSDEEP 49152:0YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0wx4x8EVep:6ySzPYix8EVy
TLSH
T153066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6bb3a7fac4fe00c867c1695f48af31c8db5c291472fa00d42cb5b54f1bb83975
MD5 92ffbc6097b7114b7f977d9d838ce8a4
SHA1 d274bc311a47f7d131efe4a324320531e1280034
SHA512 ab8bb92c9d2c8ae7cc17b95b46fd177c0b93149a408a87502e55648a4c8e18efd8551a48bace0c5fad4ebb5120611509f5fdad399e7bb888897add400c91e82c
SSDEEP 24576:747Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYzyxknw4FYnshx8OfVe247:747JUQj1irIhCnDHUPfF/gx4x8EVep
TLSH
T15965AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 9f946d807c4f57b4ddeaa480b258d49150553182481b268cb5724667ed0eb8a7
MD5 a423def193d6f66803d84a4e01b54abb
SHA1 0ea9d9196520b07a867f2344f8666c4931fa44bc
SHA512 246ba6c89611cd5c9c8ae86484020da72af0bc270b984a7e7f6225f4ac55e1386e85102ef78d97b0a0c9626294a3687b98f82875a9c24d5b49beb24478f0fe81
SSDEEP 12288:u+sf4+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:24yxknw4FYnshx8OfVe247
TLSH
T17175F028E29842E4D06E2176CB625641B3237C6597F1D3CB97E0F13E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 65bc42b81e1260683365d507cb1ebc2ae58c7eab255f12892bf26f80e23764cd
MD5 9cc94292978b02ee76f3a00029d36be8
SHA1 1f9471f24c9fdf998c13952d6113afc746f09781
SHA512 160dcc13e0e0842dadb4039a2d8d42453795842a3e65f4d10969674e361cc06b8c2140b7c82911be153f689c84a51ceac12bb4ebdaafb13f906c8858c8ed19f4
SSDEEP 12288:p47w+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2wyxknw4FYnshx8OfVe247
TLSH
T17265237CA7DEA892F86D11730676A231360AB5B49B70C1DBD728B14EE4B0CD0987E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d6ef50079b7a3c3a88999a21c23198337e18fb5b9bf718b0f4f2b0be786eba78
MD5 6277bee78904ffda494f1c8f03a9cc02
SHA1 71d9ab5dc81b02fc4f6a03bcd30b00b3f857ad8d
SHA512 62af8e51b34d368453b447491e24f0a52a07be493643b852c462f3ade48f75bc49b626d2b2c9f6a55acf630fd63fd76fd44256ef3b595c256ea5e747264f6963
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bYmyxknw4FYnshx8OfVe247:/gb4mBIBhGF2x4x8EVep
TLSH
T11E65AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 9edba328646c7e4882e48e040a18d192f52b487406b5ee36ec0d4cd270b3600f
MD5 00b27430fd65705a7506f1ae2d81b0be
SHA1 c61ba126a1c29293fcb1d6b0fe659adf64824fbd
SHA512 2b1356ce39a948641093e36503946c65251488f4a54e694431414ef7025e5ef9c07885b35592d6ec2a592be9e5e64da1e9ac740af7ca6922fc589ff5466767f7
SSDEEP 24576:HG88u8FpJqH1Kzria7/mDyxknw4FYnshx8OfVe247:m7ZFPqVVa7/xx4x8EVep
TLSH
T17A95F16877E101F0D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 2130560b1d85c2957272dc97603fc4a61fef5887e97cbcd22d2d754c0576a4eb
MD5 ff6b58197905c1cf2c6df5b3bd6fa726
SHA1 051cb30307c66393be8fba96d730fb18578e9f8b
SHA512 655aa4972c6412c035cb3311672a2cd26307489342f4e68e50da66bb3db8a7d35d7c89dd07a0adba31cb8339a2d87bf85c7c753fcbfeb3c59c9f1d47973f281c
SSDEEP 12288:0HvUrBFrEjwaQv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:0PUr+NQvyxknw4FYnshx8OfVe247
TLSH
T10F75F12E22ED18E5E67AA17D89828319F771B4621711D2CF02E0917E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8e6080a22310cc7ae9dd124924df8749c060984b67f33d5e27f596c5faacbbb8
MD5 73adbf5a7cac3b1ef5b999f5093df1cd
SHA1 967d0ee35866fada4f1e5e41c1bfd37d571c00be
SHA512 9dab3e5a0ddbd0f3cc4b25a5fc832e928a2852707bf619bec7a520eb602cf67e1d0b74b01b1b6921d28e60ea0c86024a1c1829637092fe49f956b7664936b53a
SSDEEP 49152:cBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjqx4x8EVep:/G05lO43bfix8EVy
TLSH
T13BD5CF6E62EC11F9D1BBD17CDAC6460BEBB23425033556CB02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b53138acd14a486a55ef59d3f249ca9d413edf3802973c89e6aa246387a39c96
MD5 16655408b2f775aee9c170c075d3fa58
SHA1 0b982bfb38b23159262f39d521ed42451afdbe8e
SHA512 1b73e7d9689693fe1f9ae583d61f5a42ec18173b1c35ecb5fd64e39be8d5fb2aa8e9c705ba104a5957aa8c58dee1147409faf52ad2b6a5d2d1941a8c5b880902
SSDEEP 24576:8fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnlyxknw4FYnshx8OfVe247:ka5POZ3+Jt2pasx2+mSx4x8EVep
TLSH
T18265AF5DA6FC01D5D5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f525c6f410e6501cd1beb7c74fb281f6dd35d71e845d99f9e4045f1453861e35
MD5 59c84d036f5f13cae5d40af0aacddd01
SHA1 9d2b67c2d4ecce7364da51f77098729a768ff6fe
SHA512 6a1fe3711ee422471351926f9bf5c6138b59c9c96e9783ee7779f35bfb13de2e1863a22647c20ecf8a10b1a7a3be90136bc00ac7bce69d10c4a0db7e9ae1a88c
SSDEEP 24576:kNcwHdjbyQ4nLC18lb/EOjowL7Fkryxknw4FYnshx8OfVe247:kNc/zEOVHFRx4x8EVep
TLSH
T14B857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7f03d122b4ccb15098dece180bff0185b1c196f56b40437975829571f36fde53
MD5 79b4ddb127346f9d9a9c206c2a7f1ffd
SHA1 c3ba6fe0611da68a768a7768fdd472bdcb5dff26
SHA512 985b54448d3b50af59af491051016d9ae7c50ed953d3a491a37066eca795cd12e2b928f4201fa8751fd7da420b9288ac80c9b2c4a53a90d78c7d70c875419906
SSDEEP 24576:I8kNvNnaFeYhJNtmZBmEyxknw4FYnshx8OfVe247:I8MwBtOmfx4x8EVep
TLSH
T12755AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 46662d55e3222c8998e464b9ff1f21ed2b3d8d4adaf4c0eacb48d5604c73aeb3
MD5 95ddfd7721ef1db0229b0b3ec1a44bf0
SHA1 34d3885fcee1de1b7a25ef4461caaf160d910007
SHA512 fe8bfd356a46a8bbb0d18f5533c7f21689f4ce8de21ccf72d013b7d7a9a5a0f94b4faf1252c1c9905858795d7aedc9ad509cc6e8f0e8847766281a507708cb23
SSDEEP 24576:7D3FHshBIYQgA0yxknw4FYnshx8OfVe247:7DVHeBIAAPx4x8EVep
TLSH
T15485E17DE79C04E4E57AC1BC8A638606E77138A9033256CB02D491BA5F67EE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1212-51-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/1212-38-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/1212-47-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/1212-39-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/1212-49-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/1424-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1424-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1424-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1424-130-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1780-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1780-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1780-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1780-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2824-138-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2824-132-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2824-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2824-141-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2824-145-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4244-78-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4244-72-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4244-70-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/4244-285-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/4520-99-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4520-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4520-331-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4520-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4520-93-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4520-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4764-126-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/4764-117-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4764-316-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4764-120-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/4772-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4772-317-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4772-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4772-112-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4772-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4772-106-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5164-64-0x0000000000400000-0x000000000056B000-memory.dmp

Download

memory/5164-1-0x00000000006B0000-0x0000000000716000-memory.dmp

Download

memory/5164-6-0x00000000006B0000-0x0000000000716000-memory.dmp

Download

memory/5164-8-0x00000000006B0000-0x0000000000716000-memory.dmp

Download

memory/5164-0-0x0000000000400000-0x000000000056B000-memory.dmp

Download

memory/5832-88-0x00000000008E0000-0x0000000000946000-memory.dmp

Download

memory/5832-82-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/5832-300-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/5832-83-0x00000000008E0000-0x0000000000946000-memory.dmp

Download

memory/6088-57-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/6088-245-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/6088-66-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6088-58-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6108-20-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/6108-22-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/6108-14-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/6108-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6108-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download