17e714c0b4f8e71167bfcf35a9043f8cae2e55e5e14aa405baf4ba0a50b8a006

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_5af48cfc1487b6fbd1ba899d41d8ed05_elex_redline-stealer_rhadamanthys_stop.exe
Size 1.3MB
Sample260724-lec3hsbm71
SHA256 17e714c0b4f8e71167bfcf35a9043f8cae2e55e5e14aa405baf4ba0a50b8a006
MD5 5af48cfc1487b6fbd1ba899d41d8ed05
SHA1 dd7e774b6b1cafbc6369c6d790f89630d3ae9d85
SHA512 71932792afa83dd8d249dc8440a4b06a3cb50cc51a474f3ddd3a46d5148b34df17ea0ff31efcb7dde5755ce8a9122a88a28ed3a19faac97246d08b5cb07467fe
SSDEEP 12288:v5UiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:x+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1815522A27480D072D5AD003A492DC570AA9A6D38567588D3F3453F7FAB38BD2DF3E11A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3172	elevation_service.exe
5300	elevation_service.exe
4344	maintenanceservice.exe
5484	OSE.EXE
4648	PerceptionSimulationService.exe
3308	perfhost.exe
4644	ReFsDedupSvc.exe
1360	SensorDataService.exe
1536	ssh-agent.exe
5884	AgentService.exe
4176	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-24_5af48cfc1487b6fbd1ba899d41d8ed05_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3337141fe62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-24_5af48cfc1487b6fbd1ba899d41d8ed05_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-24_5af48cfc1487b6fbd1ba899d41d8ed05_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-24_5af48cfc1487b6fbd1ba899d41d8ed05_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-24_5af48cfc1487b6fbd1ba899d41d8ed05_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-24_5af48cfc1487b6fbd1ba899d41d8ed05_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4412	3912	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-24_5af48cfc1487b6fbd1ba899d41d8ed05_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007aee438b4e1bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004b86f88a4e1bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000015fccdcd4e1bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b84cd8a4e1bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000afde8bcd4e1bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d030bccd4e1bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002b4c0e8b4e1bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3172	elevation_service.exe
3172	elevation_service.exe
3172	elevation_service.exe
3172	elevation_service.exe
3172	elevation_service.exe
3172	elevation_service.exe
3172	elevation_service.exe
5300	elevation_service.exe
5300	elevation_service.exe
5300	elevation_service.exe
5300	elevation_service.exe
5300	elevation_service.exe
5300	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3912	2026-07-24_5af48cfc1487b6fbd1ba899d41d8ed05_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	3172	elevation_service.exe
Token: SeBackupPrivilege	4644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4644	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4644	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4644	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4644	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4644	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4644	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5884	AgentService.exe
Token: 33	4176	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4176	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4176	SearchIndexer.exe
Token: SeDebugPrivilege	3172	elevation_service.exe
Token: SeDebugPrivilege	5300	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 2860	4176	SearchIndexer.exe	102
PID 4176 wrote to memory of 4992	4176	SearchIndexer.exe	103
PID 4176 wrote to memory of 3000	4176	SearchIndexer.exe	104
PID 4176 wrote to memory of 5304	4176	SearchIndexer.exe	105
PID 4176 wrote to memory of 4420	4176	SearchIndexer.exe	107
PID 4176 wrote to memory of 6060	4176	SearchIndexer.exe	108
PID 4176 wrote to memory of 5596	4176	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-24_5af48cfc1487b6fbd1ba899d41d8ed05_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_5af48cfc1487b6fbd1ba899d41d8ed05_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 476
  2⤵
  - Program crash
  PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3912 -ip 3912
1⤵
PID:5628

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5300

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4344

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5484

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4648

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3308

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4644

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1360

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1536

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5884

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2860
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4992
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3000
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5304
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6060
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6c1cb4f14371e9d47361523ad20dabce7896d6d79c00cab149932ec791c3afde
MD5 32ed204049e39fef621c5b50bf233bb7
SHA1 49d8b008729c638ba8665ebac615ec10466fa065
SHA512 00c1f5736dba05f54b39f6108919baeea7a7e59d5530fc3da8e75842567581733582dfa46c011cb68b3a80ce108740e5a268e31c361ebebf029cce9567bbe9b8
SSDEEP 49152:9b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnfLNiXicJFFRGNzj3:D3q6mjBQ7wRGpj3
TLSH
T135D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 76f258fb34cd2f2b9d8c9529a6efcb37490b4ab969c4216bfbbf95036446e0e0
MD5 6324e03040cf0ac91a5c975e99c1cc87
SHA1 2e1de39a23aefe7322eca3945685524ef4791d59
SHA512 4127e50690c1a2c7d82c57953ded00bd22f51a9a5e8342417e0763063ec4659305b238c1e14ae0fe58e544ae19c1d700b709dd479e7c1e66896450adbe91eb9e
SSDEEP 24576:1XYfDtczAs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gtcxLNiXicJFFRGNzj3
TLSH
T1E275012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 f45facb7e4c0c436bef64f024a6f5d9f2f5b2237e5a6e16c495cc74b6f63f56b
MD5 98f080e2ff23ed7b50e90373d2e3e7b1
SHA1 9b5b56a7a4b946142898ae0c01198db17a10ea7a
SHA512 758382d7447e96cf8f95ace41af9927c559906c5dfd5773f63165d148487c98beba1073180d572c62cbe0b3904d311080aa39347771eb322f065b94648f5ae15
SSDEEP 24576:y0Le5ji0hmxhrMp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yPji0AzYLNiXicJFFRGNzj3
TLSH
T146859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e4ea2b53dd4795cac0f0f557e25c1fe4adcb53ec32c325abc203a13af2035806
MD5 fba299bd88f022001542595cb589544c
SHA1 9b9ee4818119a034421325941a5226a03f9d2d68
SHA512 60ed8da27c756a38a6d5235338de619082d43e806dc07870201349eb6752b4924a71d54ad5197a17a655658cf62544ce2ce7d0beb1efaae4d38a055e63a37596
SSDEEP 24576:ga7/ezSC6vUyD/aqgrvWj6q8wyu//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:X/ezSC6vUzPv+HjycLNiXicJFFRGNzj3
TLSH
T1E2756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4aa22ef55604049a07de815d5ebf0ed87b6b765025ea580ad9856fbfc299bd1d
MD5 9a41cefb28a43b812c74c15fb17faaab
SHA1 321aa010d52a7ffa0292cb843d7e2d6c3738ccd6
SHA512 e290f7cf3dbe1ef6b4a64b26a301981b0f8dfa03f2ad9e63e3a9359474d9cc8e713e7c389a62a63ca060d1f0f73900d1cc344d6bdb600baf7dae5c8c76248bfc
SSDEEP 24576:UVbqPb88hv/l+BC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UVO88hXl+4LNiXicJFFRGNzj3
TLSH
T1CB559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 19d43323899823e625c73b6a28db5c7fff399d910e8d3072d5159d5bb9d7fe20
MD5 d57efbba25aae025689306aa279d4af1
SHA1 2759817807b5fa81bb9b9472c51c5d5527548505
SHA512 483bc08ccfd662c396b0f06191481e9b86bc014418720e5a8f654141ab7a9d6c792e8899b42fbed6bd5410014b8a5056e541bab94c4cf35926b41f347645ac15
SSDEEP 24576:aG1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nLNiXicJFFRGNzj3
TLSH
T13F5523D3468854B1FBFD0039867A5828B5845E2CCA655DE2D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 bb43435d8ed1a34d62fc6fee92269ea1da6acfaf863de1c3280c798ef959882a
MD5 3ba608a0790bbc5f0897ca49a0bf3f2c
SHA1 9e2ba3f4d596c5320fa4c6014d446189a67abb48
SHA512 38fa8484b2c5cc12c07e117342f03f080cf5f2b767ba6ba8c19eede3cc343bb534f49070e364b14a50f885c5e8171b056379ccde3d101c774b4899d9a8f6a08e
SSDEEP 24576:YJIUK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YJIUKLNiXicJFFRGNzj3
TLSH
T1A375CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 68b3563fd9246f1dfd8b816d4da4027f8209672056a6f77164eef18c8d827403
MD5 636f4f28c2c6161f539680df2df48479
SHA1 8a3aa907bb3b1133a1a63d36bec8a125b4565ff0
SHA512 2445fa38e31fb796243585021c1fb1888fcb539de948f56d69cc4f6a21c4cf7278021112e96c2ec6bec78f2eed589613f1a8e122493933c68135e7b3461a4727
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THE:KQvGAdlCEL8c/WRNw5CP7wRGpj3
TLSH
T1CC266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 695574022acd5f7d299206fc3c5291e0d0d0bbd5aba83590e2a7ba628ddbb233
MD5 525bfcfb79118b7eeadd332fb9cac3bc
SHA1 aa4e122dd302365b5143d5afb05c1cfa4a85b136
SHA512 80d75c2b277d5e81bc1915d0a0f8fc7053e62256dca88c1f11be7cf380aafa5f6fb7d2749600c4688352b924950cf372c9b94118916d09c1c642458c1443f86e
SSDEEP 24576:HfewsAjo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/ljoLNiXicJFFRGNzj3
TLSH
T14A75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c0b02bd666d1d450e4e4b6d1907a365527b83c8db44e3a79269a7af561daafdd
MD5 f59cd601f6c154d40058f3518e966219
SHA1 d94179e6b773d36e72cf0d733a2ce283b8c2738a
SHA512 2723cf9f8a4301be4229811817181bb5c34aeddd68625091ba51a7c4cbb3b7060a8947e3acbef4521c8060fc00725d95e8347afa45df3d22725c487525b79719
SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH8F9:QUEtQevvqc2W1cpV20I32A9
TLSH
T1BA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3a42d2391a68e4d1fdc29db33dadc7a39457b19dd0bfb3d7cb6a9579d8637b0e
MD5 0ce254943c00209a3f22639b8ca5650a
SHA1 ac310f52e6377c25e268a3a0ab91eaddcfe71c17
SHA512 65cdab6fa55445d37346328123b63b4c8c2516c7c7a79acce9f81fe1fad556ece5a9e95e11c649e109f986aee7e460f18953331791f7b07a78f38be1c0ebd181
SSDEEP 49152:hCbRquA/m2yL5zLfFiV+XenmE3/zILNiXicJFFRGNzj3:Ooq2Vjnmj7wRGpj3
TLSH
T1D1D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ba29947dc7a54e61a43baa272c5bf9ea6936f066baa7f24a2eff402b211337dd
MD5 880e6de3caee337499acd3a09a10429e
SHA1 dc82449b2491300f1566e941a6b67ddc8abc3e1d
SHA512 ea6828547da1d7b1c8adce9145197904823bcced7b7dfea5c26e1c38d211163e9491a6ab58120cc5139d09dd01280e417220a08bf1d5c19ed6f07301a80baa2d
SSDEEP 24576:QAhGL6IFoiwtA5l7S53D/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QAM5Foiq5zLNiXicJFFRGNzj3
TLSH
T1E3359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 48beb17f5417668f13e32bec5a95f72657d29412d34dbe0bb90d3d5d8a6228d9
MD5 1a0c4b808263fedd4cf9cfe74caed963
SHA1 b5e8c1e2423b6f43751a34ee0ac83f1a176b4a21
SHA512 6989edd5d42f711e30c0aa3abdf7e7f8da0addda8fef06037862519b5c6b071e53b86120e283471e5bc047c11646d35d27305d8b6e5494cb8389a47f8e46d1bb
SSDEEP 24576:xwuROW8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xwSOnLNiXicJFFRGNzj3
TLSH
T1AD65F08632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 eb33b8a2fe50c3fb9f3743273fba456e6fa67571e7c5d630ea03cffb5985515f
MD5 fb3ca4218c206b592c6dc2526a74ce4d
SHA1 8106c783f975f08c280fb23e8fcb9c9ee71c845b
SHA512 aea65b4aac11fd30aacfaa6e4fd583c80980814a4acefdb91e84bc3c4ee70269292a3d0c7d2b0642973becc7d9da3838cc5095883c45b0016c092e0b11b940ee
SSDEEP 24576:6ZuR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JLNiXicJFFRGNzj3
TLSH
T12E55129622C820F5E2BB413DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a41caedc63c777bb634a6466413bbe1291703ad610e928c22e41568704dac9be
MD5 1a44bafaeb481f30365520a052795a09
SHA1 77f2c17a60954183ff858e2bad8b15cb4d9f46fe
SHA512 8fc87af476140ec4a3df0204adf288813553830a617e76b385de7b6bf9ca65960782444e97fdbe2037f87c91d05193e3cd0d01730a760eed143ecc86b6082a9e
SSDEEP 98304:MQRQyi36YOcPDLvw2gAf+PN3O7wRGpj3:TQyiKanX+PNyF9
TLSH
T108667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 29581d25b15a8f1d6d29322928df3fee8f8218e5abb2871b312ab03a552880a4
MD5 5d93a08b156ed6756044d10de7c4ea00
SHA1 f3a3b2d9b72bad89559996ccf9b52633e85cfe8a
SHA512 daa902a2be8f3d75b393466db52b4e2e16ac052be682e8d432e4c62278fc48b0818f7efb8d1782527efc7d76bed2a34b58067cce13cd58b95cba8c51aa311c28
SSDEEP 98304:lQRQyi36YOcPDLvw2gAf+PN3O7wRGpj3:cQyiKanX+PNyF9
TLSH
T116667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 032a336b61b13523736d74753a305ecf0f2bf084e6a2569e9525b768fb48e265
MD5 1d86f2d126b0042446298e42b99de00b
SHA1 f6ab3e09717dc0e78565de363ee5f7f4899fb3bd
SHA512 0b2cb274d30006d3c123dc66dad33d431c811d9378d6195fd8e8557acc17fc425837ac722daa352b7f9ed2e82846cc4f12b0dfb228d157425cec95025258389c
SSDEEP 49152:U68Qg55nhkeWu7PNU3/YLNiXicJFFRGNzj3:+thTRc/Y7wRGpj3
TLSH
T1DFB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d4361c83a4d9b1448d8273370ee55746fee9927ab45c0c1e6ffa76e0230f6029
MD5 7180766dce1a73547fca5393e741ec32
SHA1 30e002e3d2a3ec6469349140996df13417430148
SHA512 caa4cf04ffbe37095ee74a0cbf269e052c5fd82e25c0a96c33b08a28c7d772757b8bb59d97b4ecce27748585aae0ad996fc7faeaf5bab303ec8f57c958dffe8f
SSDEEP 98304:jy5112gYy5azzVvU69nLKnhZ17wRGpj3:+LIHRWhfF9
TLSH
T15B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 251ed73887eb8014f5b2f7847df5497c21fc1dec277fc797de59fe8ccc1a57a8
MD5 1cba729f04c05f3740c5e07a3347de43
SHA1 89253733f5196b5b35179f101947d25cb61469dc
SHA512 90e49733e527eecf29d41d10e313dd8636e2b75e1de1c8c7b21e7914cfd3bdae89a2d3c9211cdcfc6e64645c393fa3abe994365ef5a3f2cdc2d811e37450ad01
SSDEEP 49152:XB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glcLNiXicJFFRGNzj3:5u6JmIxd2dc7wRGpj3
TLSH
T1A9D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b973c8ede0947438f4a42a004a16c8aa0c9e83eb2b28f1de1839dad1abbe38d6
MD5 e1d42839135aaa0f5c217673af301777
SHA1 c0ecc43401d0b908dfb57c3500659757d3fc03a2
SHA512 cf291ae3b0ef5653a256a3485c9ff0255832f56d13bd3d7228bfada659cc42a4a34d47361c8a21fcb1e510b4fcfad6ed754d98c30ab63997ed8a0edb7ca1a0de
SSDEEP 49152:31hpsNoJpF1A67U44CwH7R4xqLNiXicJFFRGNzj3:3mifPqRj7wRGpj3
TLSH
T1CEB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4e5c027d056fbdc43147525b895c04fea8fd86ff776e5be4d7889dc26a5fa176
MD5 b85e46db330cd7e9dccceb14c10a3763
SHA1 41e9eb22c37b2aff7181e03d5acc09134ce8cfb8
SHA512 a96f1251d2fb38e0c293e8c0063ff03437aa4f8bce66d67fa08bc4ad18c62cf1d8fd7b3731cda9bb2ba3cb410c57e9cf6794378f95e992157971ad1a5c14db49
SSDEEP 49152:LSuZQIY0Be2KkRVtOnks6NMHqRLNiXicJFFRGNzj3:Z5dKqi61R7wRGpj3
TLSH
T181C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e1bda78a63c95578491b2e22da524e2bd8770267f7cec6be58acb939c0c67dea
MD5 d0eff15fc0c542f00398846aebef0dce
SHA1 a1f0d768ca160ae7c6142740699a16780d12ba52
SHA512 27e72027728eab75cca2df9eed5c73bec0ffff240e0c8b1f73a929d36edc38de88938a0105ce49846d54678e74d55e67ba7781292db5b97a140d60a2554f8584
SSDEEP 49152:chtSn8EApI0figjgiDn0AP5wGLNiXicJFFRGNzj3:dX2iWphH7wRGpj3
TLSH
T13795BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 282f71bc612ad23740a7515c4eea614e00625f6b76b2ce606380df2047a57f67
MD5 643a99160b353bc4f5f9b0f8e451be4e
SHA1 0daff8728c2373f4e3b27a7da24f19bcd0a597c7
SHA512 b5d6dae7dcd1f09e4c803baba2b87de92a6a954667eb5e559fcfc778f5934a299d21e1e28538f3884150620d7e714ae2f7ad690b65be1ea7f375d45dbd6619fa
SSDEEP 12288:GxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:G9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1305523D3548955B1F6BC003AC6755428F5882E2DEB5618E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8ba7eeb0f66456c285e3a2e56f5c4835102c45d9e65469e123eb76299b1b3f52
MD5 bfd7ccc0972c151e273d0c5fb86a7d62
SHA1 b573ecb5a919333e019c0da0f491736e5c68a458
SHA512 32d92c2f1c8dbaec1860a5db2d71200675f6fe8f70898239dcb71b16a32f59b577bea093d185345e0d82edf27876f80ef965daa114da55c6083f2d8b96e7b8b2
SSDEEP 12288:lSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:l0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17D5523D3548955B1E6BC003A86754428F5882E2DEB5618E3E3483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 5d976e8b8522681e18bb1e6ae548a79c6f58222fed6fa585027adfd7ce67983c
MD5 58cf28ea5dbdc9f689f439b8d39a83eb
SHA1 b818d5f27b8ab05028aa1df94b8c881c4e11a153
SHA512 76ac9eda0fce2815d98eb64209613adc9d22c24221350321a3b35890f79c9fab5e8b4b455b32adfffe71e4dd2c3b4e58af4cc4de73d6fa04580591256727a035
SSDEEP 12288:jgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1855523D3548955B1E6FC003A86764428F5881E2DEB5658E3E2483D1EE238FEFCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 465fcaced611ef012d9716e8b5fee4e911454ed51d49c9c0a78ad40347235708
MD5 76661bf7662172a109a6089e7140269e
SHA1 d3b06d1943b9e4cef5ce377aeab955dfd0d57edd
SHA512 5f0517fcd8867e964217e8cc29d339562a07716f26a9392f949cc634f90dbd012adbd772fd0fbd53e83417c7de84a6363b07f31ce8ef774e4dd52340a9eec594
SSDEEP 12288:fVXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16D552392168900E1E9FD8039C6764424F2A47D6CDB325AEBD3003D1E5A75FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 96b9cf42b923661437c9e4fd571536d78f0c0050d074cdd6647a35587b8ad626
MD5 7be10f786babe67eaf7f2864e88acc29
SHA1 6818889365bac0062c59521ea544aec4ff63ba16
SHA512 2ea19a717edaad11c0d4d952fac3c3c9f051202502a74254122326645aba3dcdcfbef41718be93bc2e4cdadc4928fdc296e5b1134ca5dc80e4346f5600573012
SSDEEP 12288:YPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Y7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E75523D3548955B1F6FC003A86764428F5881E2DEB5618E3E2483D1EE27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 640d01b4d6761bb5809de66d675a3ce8ed97534c7b8a287f5cf2f462463fccc6
MD5 2fbd1a73b765235fe4f3184ee78c7241
SHA1 7efa68ba4aac316dbeb3fc009103389d56fef1d8
SHA512 77412123f0917513ed59fb8b44a487a4320d97089c1fe826f878c62113ead45afc8f7640e668c435c7608d5b3cfcd6dfe9ba1969dd870bbc2f65a726beadea9c
SSDEEP 12288:MGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Mw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14B5523D3548955B1E6BC003A86754428F5882E2DEB5619E3E3483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ca56fa8dbc39a10ed8d3ee25845066e66d328e0000e906303d96aef6a1943647
MD5 550b144a7972e8a863dab2c4ca6073d2
SHA1 862b89cb5e2bb8be8ea22e18b092745bed0f2365
SHA512 96d66d30fe52468813a609f4a027b900de1de6de36a329f201645c6dc039f2ad794a0dc1ca9b6fc1d24342551ca37d019582fb2ffce4d13c72bf7e0170aa2419
SSDEEP 12288:QqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1195523D3548955B1E6BC003986354428F5882E2DEB6658E3E3483D1EE27CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 a1ba01e689ecf32d7777e3184669aa49d37b7ed7fbfdc3ca9058cd84b5f8816c
MD5 0c58f921046ed410ed9d58bb91458460
SHA1 e8b7680dced0843be4d3d14679e159472ed1acbc
SHA512 4e52b3dbc372de15e2eb3a6baa2f30501d7d5f93dad042a96ac93d9c28d74b21980b5fb0d4477a9ccf0d4a5d93d49e597cd9ff6a9b4a85dd399222efebd9a0e2
SSDEEP 24576:wZM3zFVSOU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wZM3zfALNiXicJFFRGNzj3
TLSH
T14D750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 332dc132bbbe3e84ec829db49b7c2368eccaace8ce9972c6197b56bace8f5787
MD5 9b2d3564a7d5f394deb6c865dfa2f3bf
SHA1 0d6269d2b824101b33d688a73518b21f1e8c3ce9
SHA512 f4ec09ac0b9e91d2d4a4d8d10decf35ae45d881015fafdaafcaeb1b63f019dbb4b60e350fae0555e58f822da9551afce8815c23bf44d52f1cb1fc35e759e526c
SSDEEP 12288:f9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14D5523D3548955B1F6FC003986764428F5882E2DEB5659E3E2483D1EE23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 67c2e06215302aaf9b9c8add51b4bd99a1e118681656f21145ed1b1733341b46
MD5 a1ec0d268454ebaa6d5aa5de567603e6
SHA1 ee47356d20bf08d11c635da759045a5ec6229297
SHA512 754bc728e90d8f5fa23166c58e51e552a62ded39a3e89e47e76b6004cf9324314cab635719621d3450066ac89bb1d5e67892d2fdf7be62efacc7fa8a3b53e6be
SSDEEP 12288:JZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:JF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1145523D3548955B1EABC003986754428F5882E2DEB5659E3E3483D1EE23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 eae5278dee5e30283c03c77654da568afa42fc2b02ad6497a62b9487f57ea4d9
MD5 9f29937842c78b589fd4ad17dc12dbe1
SHA1 c3c7528524367a656b4ecce24b6bfc9ea59c856d
SHA512 faac17f974293dbef7ac0f865bbe81fa4a74ade1d338295c2ec801d63f310846bcced12652a2500fdcb181582096d431c450d67bd41c63c7c542bd593138cbd2
SSDEEP 24576:Vzy4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VHLNiXicJFFRGNzj3
TLSH
T1D1650247629530F9E17A8139C9620911F3B17C3647208AEF53641A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a7bc69de76e6fc9c0d3acee6c2a58e93300582aa2dceb7645c6ed014ac7d7c84
MD5 64fa027102842aa0710364d4a2a57401
SHA1 4f334a7f83ccd439f04b410447b033914dd16f37
SHA512 7e717b323ae6e89572cba77430bc953b0cd84593562ec38620237e88d46fdf34aa58a5d661323adcc59f2dc780275b35ffacf073876e8524f226db419e6613ce
SSDEEP 12288:c9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ch/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1695523D3548955B1FAFC003986754428F5882E2DEB5659E3E2483D1EE23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 11cc63123fb8325920c7079d34ffebba3bc8f9385d9ad5520576ad74348809b5
MD5 18284165139979d75e4b86364478089d
SHA1 5a9859c2614149ae12299707541bc125b7de768b
SHA512 cffc6de21e0499ab4894833f1ba1e998a41130d6172183ffa7eccc4685da468cc64d8ec41ae8251bfe6e11644ab4b5745ade7f166cb66cc1a489dbf5d338a106
SSDEEP 12288:V9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Vh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BF5523D3548955B1F6BC003A86754428F5882E2DEB5659E3E2483D1EE23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 07bac6b1398edc67657b1f5299f259c3a77120e6ce2279ac71c798a9f2f0629e
MD5 9be9ee2d4c44b5efb98a2bfe9edd9b6c
SHA1 8d2e41f3532b785548f23d48160a516748dd389d
SHA512 57f11c61e313ff09e5ed787c8482c8b2712fc6c9a1f4fc5ab4e060acd3a01852ceae3d1f9297360f5ee19513b2788d19a6e3753e5bcd23132ae36d4a0ba02547
SSDEEP 24576:Czy4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CHLNiXicJFFRGNzj3
TLSH
T12D650247629530F9E17A8139C9620911F3B17C3647208AEF53641A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 93f7532144462bc2a9d7457a5a6b8e0acbc6d371a06da44f051677deba6c857d
MD5 9097f96a1b0ca8283cb9755234797932
SHA1 8a9adfc6dda8e0ad46938b4a44d6bd1c05b9ebde
SHA512 4f3e95f8024f73c580a372c89ebfb14570b897c18ff5fb50a1f5a851b826cf5600da4ead4508884e301ebe6c8bdaf9a0736c5e8efa427e30949a5169f82c4c21
SSDEEP 24576:XT8aLl3z0zDi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XT7Llj/LNiXicJFFRGNzj3
TLSH
T1307502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 6b6f73a7c73ac74bca75f9514701325c47f0c590d7acb9bcd5cf07055c85425f
MD5 69ca510cc5df3ab9e728c8d1a768cb01
SHA1 8f77390d2fa43304d14ee75e169cf93bd98fe602
SHA512 dc42f71696dd6acb230e87d7d15dcbf105e238b62f6e09b44709388c0258d2a331c13d881647cd0cbfa0de8408d80bdaae82f94b6be2889a8a93f4257b4c7bae
SSDEEP 24576:m3rd9CHKy7GZu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Ird9CHKyaALNiXicJFFRGNzj3
TLSH
T15185CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 71573da9033fb3253c5a12a348a39ad5fff4d76af529f6526622764904c7860f
MD5 20ce6a04ffbfd91453fa919e7406726e
SHA1 78309299449cec156eb0c37e96f759b3a7946230
SHA512 7e62150c34f8404f66ae6e16c8fedbd275196f57a9b2ffc8d4a9523483e7c0715d7175a7dd8d24746c82a6ea6cb21025e5e1bfa66e2b91c56f660e506ad98326
SSDEEP 12288:jAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1315523D3548955B1E6FC003AC6764428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 32dc024d1c32efcaa3fc94632a0725001b2fae5d376b7b97fb58f9ca43ade55c
MD5 8c215dfd1d50cf610cfafdce18a8502d
SHA1 8ff90ccb833fffd9427c9dbb880a411807ece083
SHA512 fd3850d0546584a8fc4ffc8a89cc0995182f5c9eb257e6f5e078d7349437a9c30e9c43f27a2fd81af3af6c954c78c21ac4a05ecab6a83f0958eb9c408d7f20f8
SSDEEP 12288:GuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:GY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1465523D2558955B1F6BC003986764428F5882E2DDB6619E3E3483D1EA27CFEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 62883626561cc224dc539decaecd6b78ccbcd33f8ee0c4dd418d7c71ef40f9b7
MD5 092198f0501241cd691911b6b8b0ec8e
SHA1 03b19d60e31942d8d349d6b0b8add226cce384d5
SHA512 f382020ca3f6add7859c5450b5ff674352abae500c24c4dc83597c43fb548cada51d49a12bb14f66bfa1e22790845bcc0e4516e66af4235ce27c93343a304f41
SSDEEP 12288:YjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:YX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1755523D3548955B1E6FC003986754428F5882E2DEB5659E3E2483D1EE23CFEF8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 50856e9c0319caae24aa3bf23a505eff9a6cf91a122a5272b36de0110c9e3ca9
MD5 4c2284cbf383fed673ced5423256916c
SHA1 b6d6c7c68058a1e222255b9228f593ae8706d974
SHA512 1f1fc8a02e3302b87fe9c00931dcd0384bfcdf1290cfbe6670648f9a792da74a007d860c058adbb462be05a7cfa7e592152b97027d9609d87e0d172e49f02808
SSDEEP 12288:a9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ah/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1665523D3548955B1E6FC003A86754428F5882E2DEB5659E3E2483D1EE23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 1e8b3c1be0091aa14c99fa82f0df73e33b79045aa4c12ce3eb02648589411b82
MD5 4d857c441cd517cae8dedb27a0138a20
SHA1 cc5ab37ddf726a2149696b6babb9285907fc2200
SHA512 279e83d11795ec508cc1755c59dfccd5fb6be02749df73d3dc89a012ffaa7a9804cb0368207417ba8699f728c3a8198e0731b75b263e58cf1cf9e6b785d37346
SSDEEP 12288:yAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E55523D3548955B1E6FC003A86764428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 3520554ead0f33d6d5678797ccd8a8e6a2c3ec17c33225a16c4f4fea40e4d14f
MD5 d51f4b4d2a3f7bbda39e058dd5b00056
SHA1 e661cac5091142c90dfbb6807ed3f6a38cf29423
SHA512 4748f8f97e7131dd6f3fb1dab6838e55c1a708cf5feef1bedd7d5e78516e81826f6ee9092aea765e83d1d762ef8917c0fc54a33100a0332089c9d2ba0cf6294b
SSDEEP 12288:s1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:sZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1055523D3548955B1E6BC003AC6754428F5881E2DEB5659E3E3483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 af6aeaff9978a71fdd504064bfe7f317190bcbfa19c1372d8e5c9ba4218af4e2
MD5 a1c5718b953eb9020656bc2d4cea5d36
SHA1 208a40b71b57655800a182e62d8759d41f114788
SHA512 b9b8a5ebea5cf3ca5c469f981a78870e64c7c37197f6b71df2cfa81431acdb984aa159db52cf319dbf423b400f497d1ec59f26aef38e978b5aa11cad863cc591
SSDEEP 12288:KPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:K7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1395523D3548955B1E6BC003AC6764428F5881E2DEB5658E3E2483D1EE27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 34d933aa9ba71de635022484655f84772ddcecd071006420440035b319828ac8
MD5 16f1e220c60881157dd7111fe14787d4
SHA1 da1a3cd298f2d1925e458ff578e2c8d6ee77b868
SHA512 7cb8714a6194b717643b650bbddcd3f4a4b6ffa8a4dd69748d95ab82ce6cae429b3776b296da2f065ca58d8e4c04cb78a530cad4a0bc1a76a7f10256c2e96525
SSDEEP 24576:yfwvzk9RX6wkyAIV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5MnYIVLNiXicJFFRGNzj3
TLSH
T19A85D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1c4acaea6136fdcc334ec947459f3a45b01a3f6c329433661452c0713e15e948
MD5 c8a7acfaa7eb193bbed71b90a5f91f5a
SHA1 660a39d75ee6e456f87cf86bff7e779c2a3d76d5
SHA512 54747031dd24f52ae0c080fcb89375cefabb3bee64173d032f28b5e86ed416028c3072e7cadd7d72605581eac6fc509e5c586aa84ddd3bc6ba0c9fbbcbbd5335
SSDEEP 49152:dYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0mLNiXicJFFRGN:MySzPu7wRGpj3
TLSH
T11B066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7a96305583952cd0be4a64920e25a587cde5c61073b9f076d2dcfab524a4ae6c
MD5 b51377c6a1bb3c6bc359b25ddb6b8d36
SHA1 a11b31b3e8ed8a029227d4d28a7b423b5482638d
SHA512 1f95de7d618a5fc7df92582ce6cf824ad0abd3ac61790192a86639922b0d2424e2bbc610f188ebd35ccefeab626638b327bfdeee7e90d95850055a08a290757d
SSDEEP 24576:i47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:i47JUQjqirIhCnDHUPfF/2LNiXicJFFS
TLSH
T17865AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 e4b668ce112ccab5a200fba96f6ded0b27a1b0aa966d1a0d2de29f3ffe39b122
MD5 6860945521a27cb1485b8542bad3e673
SHA1 d9371995c2d3ed7af220cc8a55b8e8564bcb765d
SHA512 f7e9e5ef25ff78490816ddfee681e8f639fd9455f12256cde5ba5df9cc8b32b9e7ed065e72c14d246febf4069b4e797797d460c8a33036c8be58f95284cd0033
SSDEEP 12288:CpsfNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A965F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F3AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 481119654195ff602142751a48ebea1139d2db94c44eaa2bcc306741e902d763
MD5 6c5efb8c51a94a2874477d59d6721ccd
SHA1 20a21c9f96d2e94f01e1351b90c443d919c84b6b
SHA512 b43e6d46827ed3485e2b7e6585a50ff40a93f9bb6c0a8b11c0734f5a2fbaf1b05fa2506aff42df5123ad3f1ed899016d6c17425ad51d6b1281f036756266b52c
SSDEEP 12288:dvvdqU3f6o3ZP1msobqT0jOo0+qpQ8GhEzJ99AARMeNzzP:dvvcUPDuj30bpQ8OE99SARM4
TLSH
T1C0552740722AC79FC6A990325E32D6CCA7707D01FE456F0773C8973E8476669BAF5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.1MB
SHA256 2ba440f1edfedbe02a9449fc7c4685a92dc33e891ed1c893b5d44fcf7dd405b7
MD5 70277758d601ca422876e2c5a74b5010
SHA1 1d6f097944a827b8146fefe3abbfb0d09d9d3e20
SHA512 622e36b1fb063e330aeced1175c112dcba77f1a9e3662f743ea17a21878b44cdbcb3b12b9f9ee8f92f3a62b2cd710733047e04ab6996758fb475bc95ab388737
SSDEEP 12288:UPsYbiao6kMzLc1eBynLEtNPor7RvQg5nQ3:UPsw7JLnsLEtq3phnQ3
TLSH
T1B1451B41A5A7E75FC9FD90370732C68DAB745C02BB853B0573808A3C986767EB5E22D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 0ab38f17cd309f2c05cb62cf09ead690dc08f37164b3fefe13a0f8a8fd142113
MD5 490aec21b49a31040c5750fba8307ae0
SHA1 a120ff524e5b3df1c514bb99d2b9660528fa9163
SHA512 24992f5ea3cacbfe7906223a64b5052b6959c4897187370d1ab9a3a97d1264ca1dd4d9fb6b8bbaa830a90a04703492211f44898c458cbe1a1a6ae19a271c92d0
SSDEEP 12288:NF7FiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7J/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1235523A3568C59A1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 62bbd42e1c79397d44fd7163ec5881625963f77ef93a4e483c4e47eb4dd1dff5
MD5 2458cba90719290225feccb527c0ed89
SHA1 2548290c4b1ba7b5c3a1d5f7320d3f27dfe7ccfa
SHA512 34706593ebc48c21b7a92019121555b788301a16aae9ff4bd4181b28da22cc92d375d747916894a766fa1d94d9bd5343a6f2fc13c6377b712e833ea82bbcdcb1
SSDEEP 24576:pgb6bmBIi49WNNFpg1rSvFv7bY//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pgb4mBIBhGFkLNiXicJFFRGNzj3
TLSH
T11E65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 f098052aa44367c267df6697881a69c91a4eecf730cd7761f6acc64087b6071b
MD5 258756fe25ae04170b9586a8c34836ac
SHA1 4092c33af9656c4400391956e5a209e3a718ad3d
SHA512 26ea135ccb80e55361f1bbd4ecaa618b6bf0bbccf595e31b912247034efcf7139c33630cc063fe655b8941970f75fc1ceb8a007d4407199d5395023cf88c53d2
SSDEEP 24576:gG88u8FpJqH1vzria7/mU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:z7ZFPqVya7/3LNiXicJFFRGNzj3
TLSH
T1D085F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 ebe043cd441b8a2ee575dd3a22d45b5ad572fd4d535e1787bcf2a33434be17a6
MD5 bb4e077e0122cb88d137ce41f0a3dde1
SHA1 7c7b2b89370688104121ff8154aaca3132ac9c69
SHA512 ce2b7c2125f8241fce87d2f96ed2dead44063d066129380598c52c24870d1a1aef28ae4e78fe0ca220eec1b1900655055fcac44c99f53a7f5e66d96f283e2867
SSDEEP 24576:EPUr+NQA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EJQALNiXicJFFRGNzj3
TLSH
T12E65F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 91040107221774a9f8306f2f531a71940c5b16e5855587902eab26bc0cd6993b
MD5 f772d50f7896c28a16c966af3025d59f
SHA1 9de1059edc880637a6e34b8ad2e0a3534a0c234e
SHA512 b212ac938ce03a73a98646a1216459c7e4c3598b32a017af5785c3427051717ac4c525cfd6055c44879b6bb4a4abe697a5c421dc60be4c7185a7802a45b5f1c0
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjwLNiXicJFFRGNzj3:YG05lO43bN7wRGpj3
TLSH
T186D5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a3adcd398f05c360c51d881dc5acd45aff7028859a9ba269698799d5bae45e0d
MD5 bf984fa41d55f1c1d73d4f882ac10792
SHA1 fa779da9a7ff5c1da32cb660fae030ad7685ea88
SHA512 cf5f045b03411010cc31f926a7f4835daf22d78930a6253ec7e38fa6d8a3f770d5b9fd73f4837ac7fe7fd8cb592b8275c60a58b86c6c86654c3672e5aadb5a62
SSDEEP 24576:lfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnm/TwSfVcYG3K/cJHlnFR+IGNe8jg:la5POZ3lJt2pasx2+mYLNiXicJFFRGNf
TLSH
T1D365BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4c4728e1d842c3f802195e2732d965adb61183ae06a9c48f8d91b02579e0f1ce
MD5 bf94eef5c7a549ea364a95bb7d8d4bd8
SHA1 61f2579e0b800038564056c04652cb1fef53fc9d
SHA512 4938c59ce79ae93101f39715205a1c0f597d4147ff4915bb3299c694373343bdfe31fc9efebafada54ad2f2440d59841af4e0ee6eac1369f624b2ef7566d0902
SSDEEP 24576:MNcwHdjbyQ4nLC18lb/EOjowL7Fkc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MNc/zEOVHFXLNiXicJFFRGNzj3
TLSH
T192858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 84016b8a25b879944b4db02d142ea0dc3915f175e003cd93aae9bd910c572ece
MD5 23743ac50fbd18479695994e99206f59
SHA1 66fbc2c676b49c602ee65fab108e005e17e534e5
SHA512 2055399646acee54c976e34e84cc60e2bf12b7fbfc88384b65fee9d1d371185c8eb567e8c45dd357d8d00da52f8204d5da816108c41bc27140b5dbc3ba700799
SSDEEP 24576:szkNvNnaFeYhJNtmZBmI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:szMwBtOmILNiXicJFFRGNzj3
TLSH
T1F255AF6EB6E846E4D1FEC675CD238512F6727861073292CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 848b6b25f91787d44e25c3e3afee787b64bb104b43c331a78e83d15b44b03dbf
MD5 04e6878d995cc4dd931feb8e0b9c3365
SHA1 158a4cd4d1e013ec922fa142ac632c878da5cb1a
SHA512 673a4082e2182f699f64e6e05b2eb8a4621fee763cdf8ba27c46b107fcba675cf134d695e5db4771ac28a93e7b08f90d1121c893cc8ec098caf61bf9f3c94da2
SSDEEP 24576:HD3FHshBIYQgAd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HDVHeBIAAdLNiXicJFFRGNzj3
TLSH
T12375E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1360-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1360-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1360-111-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1360-317-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1360-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1360-105-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1536-118-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1536-127-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1536-124-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1536-316-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3172-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3172-14-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3172-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3172-21-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3172-20-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3308-82-0x0000000000930000-0x0000000000996000-memory.dmp

Download

memory/3308-87-0x0000000000930000-0x0000000000996000-memory.dmp

Download

memory/3308-313-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3308-81-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3912-48-0x0000000000400000-0x00000000005F8000-memory.dmp

Download

memory/3912-0-0x0000000000400000-0x00000000005F8000-memory.dmp

Download

memory/3912-8-0x0000000000A30000-0x0000000000A96000-memory.dmp

Download

memory/3912-1-0x0000000000A30000-0x0000000000A96000-memory.dmp

Download

memory/4176-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4176-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4176-152-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4176-146-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4344-56-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4344-41-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4344-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4344-54-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4344-42-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4344-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4644-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4644-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4644-92-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4644-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4644-98-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4644-331-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4648-69-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4648-77-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4648-71-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4648-298-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5300-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5300-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5300-26-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5300-116-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5484-59-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5484-65-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5484-58-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5484-281-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5884-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5884-139-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5884-136-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5884-130-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5884-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download