98ec5f90461a2e0e392a5aa46c270baf6ce134a1dd295855566ddf1e5bf0a5dc

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_fc8f7e3ad283146281ff778338d241b1_elex_redline-stealer_rhadamanthys_stop.exe
Size 1.5MB
Sample260728-yd1hmstgrc
SHA256 98ec5f90461a2e0e392a5aa46c270baf6ce134a1dd295855566ddf1e5bf0a5dc
MD5 fc8f7e3ad283146281ff778338d241b1
SHA1 8df4eac711a9b29e0c40445f7d659879f3818618
SHA512 0438f480b9b8dfb0c8dc9a07bbbc384b97304e3557e523739abfe782bd143b216d0ead5b72f49e8a8893ab633cbad645094c94fdd09f53ffe6eaec3ce3432ea7
SSDEEP 12288:Z5egeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:Pe7ozX0j52pMkuLoiSJVlIL29mhNq6
TLSH
T1D07523413A04C033C55A6475697EC2A19B3FBEB63636C063BF9B4B768B353C29F66148
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5012	elevation_service.exe
2428	elevation_service.exe
4244	maintenanceservice.exe
3548	OSE.EXE
856	PerceptionSimulationService.exe
5984	perfhost.exe
2264	ReFsDedupSvc.exe
5424	SensorDataService.exe
2100	ssh-agent.exe
1724	AgentService.exe
3940	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-28_fc8f7e3ad283146281ff778338d241b1_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\73dc544e238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-28_fc8f7e3ad283146281ff778338d241b1_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-28_fc8f7e3ad283146281ff778338d241b1_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-28_fc8f7e3ad283146281ff778338d241b1_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-28_fc8f7e3ad283146281ff778338d241b1_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
336	5844	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_fc8f7e3ad283146281ff778338d241b1_elex_redline-stealer_rhadamanthys_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f3bf30cc91edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c6f4e64fc91edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003dbef84fc91edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f45aa80cc91edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005d3bc40cc91edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bcc0b84fc91edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fa368c0cc91edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000171c220fc91edd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5012	elevation_service.exe
5012	elevation_service.exe
5012	elevation_service.exe
5012	elevation_service.exe
5012	elevation_service.exe
5012	elevation_service.exe
5012	elevation_service.exe
2428	elevation_service.exe
2428	elevation_service.exe
2428	elevation_service.exe
2428	elevation_service.exe
2428	elevation_service.exe
2428	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5844	2026-07-28_fc8f7e3ad283146281ff778338d241b1_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	5012	elevation_service.exe
Token: SeBackupPrivilege	2264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2264	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2264	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2264	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2264	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1724	AgentService.exe
Token: SeBackupPrivilege	2264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2264	ReFsDedupSvc.exe
Token: 33	3940	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3940	SearchIndexer.exe
Token: SeDebugPrivilege	5012	elevation_service.exe
Token: SeDebugPrivilege	2428	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 4448	3940	SearchIndexer.exe	103
PID 3940 wrote to memory of 5032	3940	SearchIndexer.exe	104
PID 3940 wrote to memory of 5780	3940	SearchIndexer.exe	105
PID 3940 wrote to memory of 2956	3940	SearchIndexer.exe	106
PID 3940 wrote to memory of 5560	3940	SearchIndexer.exe	108
PID 3940 wrote to memory of 2572	3940	SearchIndexer.exe	109
PID 3940 wrote to memory of 2728	3940	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-07-28_fc8f7e3ad283146281ff778338d241b1_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_fc8f7e3ad283146281ff778338d241b1_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 480
  2⤵
  - Program crash
  PID:336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5844 -ip 5844
1⤵
PID:2880

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2428

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4244

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3548

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:856

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5984

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2264

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5424

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2100

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1724

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4448
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5032
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5780
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 3032 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2956
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5560
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2572
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 3032 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e6a5234f9f72df5f18edf678db4db4e81126579a80127c80320f5e3e6a8f6ef3
MD5 59f84b183aef7974703bc2d74c40a420
SHA1 864691911498e231414d287ab431a56053d53c9b
SHA512 67c7ab9a7f6a5bc6212e2821c1e0cefed21087dd7426d05ee7b7ab8f8b38dd2baf7cd57364abc7033239cb82b1d5030ced7b1447b190087e042c3bd200633e77
SSDEEP 49152:Kb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnI70jIpM3kiSBM29mhNq:83q6HjBz70uMhSBrkNq
TLSH
T132D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 6d65805bd508d64007e9cebb47042289d6b98806d4922a85b7807725c2d5d0e9
MD5 2771bce2719e45de3a62f1f3d3af593a
SHA1 97a4f2334362d52ccf29b3b032fe975ce2f004a1
SHA512 f2cba5940ccafc8db1c9a0ac30a7949c2c9834ed13088659f31405837fce8b4551fb05f3b431f37aa2709fc3b4cfca3f1ac4a3ac144e22a79753c86e37ab1652
SSDEEP 24576:/XYfDtczAe7ozX0j52pMkuLoiSJVlIL29mhNq6:Ktc+70jIpM3kiSBM29mhNq
TLSH
T1A085F115779408FAED6B8278C8B2C501EB33B8964760E79B03E48A655F337C85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 852caccc0c7689b4e7fd3727bbc085010f35200a3b38bb40dffc7db04001e964
MD5 333535172a0502e1fd4e29910f73f68e
SHA1 ec8725b85dcd3024ba30f6392cf4c6e36f5df2cf
SHA512 77ccb26d1626a575a4371470e3463b435ff68adb0e400c6c435a3de3892aa5bcf209afac59feeabb273b324cd2da453b20efd2bfc2e654e919c03f7cf9adef7d
SSDEEP 24576:O0Le5ji0hmxorM27ozX0j52pMkuLoiSJVlIL29mhNq6:OPji0Am+70jIpM3kiSBM29mhNq
TLSH
T1EF959E16F6788335D073C0B9C5D2A68AED71308657308ACB4286D77C7E67BE68A36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d0a32409346c79ec2102a9bae11f82c4b2eab62bcdb435ca167729a7531eee3a
MD5 8f47f151fb47948a6c6504376fccf7e2
SHA1 810b2b446988d98ef1ced5c7b1d793fd1321f906
SHA512 0cd5c7907972d972f73c7bf743cd66add66673a3c4e7890b51d13c72f8ad7fafc03a0ac6e0f92972d312ee5f17b70f50bce45ca914abc4064348684657fe0520
SSDEEP 24576:Ea7/ezSC6vUyD/aqgrvWE6q8wyuY7ozX0j52pMkuLoiSJVlIL29mhNq6:z/ezSC6vUzPvxHjyS70jIpM3kiSBM29R
TLSH
T195756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7f75ee448fb68cdf1c6731cdca17f8b8df793335bf27f8cd65431d707e33ea71
MD5 335edba8690ee734f3472b8db98c5102
SHA1 3dd65bf823ebc2e8cfdc38acbee4fe0bef41e4f0
SHA512 d030014ac42f130b46cab6c73e94fda1d7cef66d96e4f52c685f3fa771f2565351c8d08c79acd3cf1ddfaa025082979c787c06cae5b49fe7f7260a9f6f775e9c
SSDEEP 24576:1VbqPb88hv/l+6b7ozX0j52pMkuLoiSJVlIL29mhNq6:1VO88hXl+r70jIpM3kiSBM29mhNq
TLSH
T102559E66F6748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 1d64735f39e5b574781a01d94ff14c38745ec044ec9725d7b692379bda98653c
MD5 c1faa94e36dfaa1346c05438d4dbea1a
SHA1 41063679686a9ad9494745ff75dcaa7955a6d107
SHA512 0e1d36f1ec3b187326f20fac439f10d6ed004336b23894e1b6ff635de05d8ff9894c5ce02a6fc71fb4f99c84abbee858174963276d3fc5852971b66c92050348
SSDEEP 12288:ZXSgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:ZXS7ozX0j52pMkuLoiSJVlIL29mhNq6
TLSH
T1966523821B0C5453E7BE257075FEE4828B39AFEFB526C0360E6A9B5481397C2DFD1984
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 6fca495f87b6e5563068361e8c7e0ccf3038095c7148d8f70ffc57f9703d0fb8
MD5 d439467624f542bad76ccd261b8e8da6
SHA1 064d0f90976fa60e89479f4f19690754c4ebf6a6
SHA512 92bc1402f80d718dd2d3360b718563ea296252ca496622e391995434a9eba20c951e3bbd7985c0c9f0de9f1e0726f3a5d7f2a497027039a9ca4fffdd239a00f3
SSDEEP 24576:iJIUj7ozX0j52pMkuLoiSJVlIL29mhNq6:iJIU470jIpM3kiSBM29mhNq
TLSH
T19A85CF2BAE28FCE2C27E9DB85A91C640D77278714B22A3CBD175830DCE236D15E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ea6dff0f83f0de0e790b30c01c82979041ce0cb7119ea105fe820f01288d59b1
MD5 6ba522741712a406729e5d9924ace785
SHA1 a4b2eb56ce3b6d01c0d08a1e2548ea7d6645378c
SHA512 6186aee8b273c0c784c17f8209a8104773856c35de1d174f60fc07fdbd20a8ed6d62b39b6ebbf4ab5c7ba663eaeb86b6b60e27853385db82184235133282a9b2
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH2:gQvGAdlCEL8c/yRNw5CV70uMhSBrkNq
TLSH
T17F267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 e0ae3b09f60dc6e369c10b810ce06919483489038f85efcaf66afbfcfffae88b
MD5 190dbeccadfe07f446447119b7266103
SHA1 6df0e40c790e19e1dac251eeecf072bc4c63d7d2
SHA512 0fad27d3df5e8c6ddfcec1dbd911235825a86f71b8f75fe6fa641efb5be1f806549114619341093def42825ea3a4e495a21be246b04f4a7b804149827b65f90e
SSDEEP 24576:8rewsAj17ozX0j52pMkuLoiSJVlIL29mhNq6:ulju70jIpM3kiSBM29mhNq
TLSH
T16B85E031FE74E436C7BF0DB21B36D706543DBA604B6219C3E3A88E9D59342C22776A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b6b752fc616dfc32098be48fae24a611b746846c91ed88e5c7a990364587147d
MD5 b1df116910beaff92540a2412cfb3e9d
SHA1 75d785f6d1a4e4f1a926a813c337e4913d7e53dc
SHA512 8d2c1495593fa0660ef94050f843c3ad40ebc705c9e0002f2d95da1d2985d3f0e3fbac44ed7bf47e77e28db18c080ee0af43b365e004b4fdf75abab5843df2e2
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHSIoQ:6UEtQevvqc2W1cpV2EI32S/
TLSH
T132474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 353555dd32ce4ae766657493f38e2dced7e51c96b50ed5abe8f2cf6e19cea476
MD5 feae5bc4a912296d17f10ee154109a66
SHA1 d650831e67e68a741ff5556c0112186a389e8b02
SHA512 59bf78558fce0e8bd7e525a553a4c31d985f7d05704b6227c920d287932281ddc837654c9f5bad73fdc2bc6c768610da1e262dd3e492232bf4da922533f9d22a
SSDEEP 49152:MCbRquA/m2yL5zTfFiV+XenmE3/zO70jIpM3kiSBM29mhNq:loquVjnmZ70uMhSBrkNq
TLSH
T180D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ea8359585a88f78aa57768cb1718e713d2956e4c2c777637728f58a32d480f01
MD5 eeb58c929736c01babbbb61fad3d39cc
SHA1 f243c19679fd9b77581110384118c436b5d92406
SHA512 f9fa90fe52cd4f8f6642aaad7141298d1882ef321cf30ddb4404cbf6f85dd0e7618b7e25e47cde108a3068f32fd1eab6fd7fd4982335e5ea165885793562625b
SSDEEP 24576:mAhGLJIFoiwtA5l7S5387ozX0j52pMkuLoiSJVlIL29mhNq6:mAMyFoiq5J70jIpM3kiSBM29mhNq
TLSH
T1BA359E81EBF955D4F5B3AA7899B69171EA76BCAA5E31C20F1150C21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 9b9599a0be56eba5ca01249efe0cbcd4fce19bc0091e6276547539db6b04f286
MD5 ffc9f5a9d3cc5555c18a0cb80fc6f874
SHA1 484e1fb5b1cccddd6cb4bf30c564d5666c8840ce
SHA512 cdf6fbf120dc219c59c6edc68a35b3a05d16c3d4525d69da079214b7b94a331d2172386db435bfc311e21e6b196034e6f1288bae821fc9f4d5129b036110ad6e
SSDEEP 24576:2wuCOWZ7ozX0j52pMkuLoiSJVlIL29mhNq6:2wtON70jIpM3kiSBM29mhNq
TLSH
T11185F14637980CFAEA6792388597C132F7B2BC563A25C71F0760C75A5F37351AE29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 8fe0e2a360e2d6f1e2390be0cd537f4727876f012c99eed45bc95ad74e64743b
MD5 d59329b1324b7e993a1accdb52f4d21b
SHA1 2425e7f3265e7f916ddd75d8e5cf41618b0ac065
SHA512 5351eb2d363aad1395c10e5d5de602634715ca386afb881961bcf8ff451363e560e12c1904ffc48a18d0099ca4738a65f56690f655541707060a5b1fc5e6b5cb
SSDEEP 24576:FZu+7ozX0j52pMkuLoiSJVlIL29mhNq6:c70jIpM3kiSBM29mhNq
TLSH
T1BA751282379820F6E2AB5278D9F69541D772B8A7733683CF066983641F33BC25E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 20290823706e8b0ed1bd55cb5a36b7a73ce48fb1ef461368391191a389401a31
MD5 ccb55f5efcf5fc0d0084a7041f7a3bbe
SHA1 5591cfc5d76c31f71a224c20bb752670e16f765b
SHA512 0d0a65619c793afce90153a9ce6e2083746ee69b7f0798fd61e0d4e5d1b5aeb193fab3957487b64eb4672ade70311b16ce67b953aac65cb2e014230acf4fc1be
SSDEEP 98304:aQRQyi36YOcPQLvw2gAf+PN3s70uMhSBrkNq:RQyiKayX+PNAIoQ
TLSH
T16C667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 67d1957f05e061bf263b28efae186a41b6d2c7076c316dbeb3bb1178ad56f74d
MD5 ec618cc5195cd837984fa121570b0d45
SHA1 d6291b7991825c302c99f9a738ba6e29c210bfbc
SHA512 f72cac2ade64bbf2090db99d6f3acee7d2381a97c8587fa317f1b459a5d9d0dd2e943c82f84725a6d98f488502f6e3ea7054456b94ddc80b7915affb38822239
SSDEEP 98304:vQRQyi36YOcPQLvw2gAf+PN3s70uMhSBrkNq:eQyiKayX+PNAIoQ
TLSH
T15F667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 deeaa0bfe28d40f7d06962532caa8858125886d5100511bf32acad444668694d
MD5 bcb08b0614751a0ae6b47d88aba9d1f2
SHA1 fffbd4bdf7b6fc6a5e940ed55e06fb4b54530cc8
SHA512 6fd1df28ed4e6d624a0f78777a914af846f1d796fd6a8d0e6d15fa2e733ef1d02dc3eec464a42a42d3178b54f2972c0322c7cac62bc8a43fedd232af0816b5ad
SSDEEP 49152:o68Qg55nhheWu7PNU3/+70jIpM3kiSBM29mhNq:ythWRc/+70uMhSBrkNq
TLSH
T153B55A33B2F600A9C44DE1769F4A872196D27C758FE1E3DB851173061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 07fae703df4bd43d6839c109dcc5235f71a5fc1334c6ac3a0f54d57ff5c865bb
MD5 b0b7d7ec574da9225045327efe453aa2
SHA1 c25f32ec532aeb660344909ea26fc5444d461c89
SHA512 888ce844313489b44c6cb7a6e555ec3d423fab753ef6cbd18f700fb209cb6ccd8b795d1c190251f245e10ed2ee14a35b9f914483c0c1294dea381337e2354b9b
SSDEEP 98304:Gy5112gYy5azzVvL69nLKnhZD70uMhSBrkNq:3LIHmWhlIoQ
TLSH
T101167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f2e7dbe3cbc7180935dcd78ea2633d1f81d8d804693bbde2bb88c88b3a25b2d2
MD5 4f3e9be9c664e2295e5655e9b27dbabf
SHA1 de8661d6eb1009a85d3496cd01cda55c9c6a5faa
SHA512 a79da360f41779bd0f73d1fdb1cec0efe31e31a856c806d66a64e7f069e00bc6508119719b97e03b70bfd355e4cbd40f8a94c2259a546a225161b84504f5f0ce
SSDEEP 49152:pB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glv70jIpM3kiSBM29mhNq:/u6JmVxd2dv70uMhSBrkNq
TLSH
T18FD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 92cfa18eee04398867f5a0400fb7ff71276c8ae8439b6efe2ce5f5255887c60d
MD5 a25df574b54a480351cdc5fef8bc9a9d
SHA1 f8148d567f0c1a5c9f6f2db96e0206ce8c12f571
SHA512 80f3641293ce916e967b098109e0db02243dcc5df0dcae61008e54828fe4d6038d13eaa9f0e62155f54822589679cae106eb7af10d9247544fdec6882702a354
SSDEEP 49152:u1hpsNoJpF1A6UU44CwH7R4xY70jIpM3kiSBM29mhNq:umifPbRZ70uMhSBrkNq
TLSH
T13DB5AE13F29900E8D06ED17887569232EA62BC460B35B6DF0A90B7961F7BBE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e5ebdf8d4e3017034411962c51841033af82e767b76780e6d02be7b8017ad20c
MD5 4fedbf51d29f794ffde4878dba67348e
SHA1 f4a339ff1c32eec3051a901f59481805303f243e
SHA512 c83e1afd7e7cedf5e4bde84d629bea42bc7b83bdea9e63c3927efabbfed4e439b3c001ce62d456eb5726ff17e7f4acdcaebecd4a84b16f49199f36fbab7bbfc5
SSDEEP 49152:wSuZQIY0Be2KRRVtOnks6NMHq/70jIpM3kiSBM29mhNq:q5dKTi61/70uMhSBrkNq
TLSH
T130C5BE03F2E940E8E0BEE67487669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3b14b22a06a97df3bad375f9159b09a6443b1e663e8fcbdeb8ba859298689906
MD5 77206f37b190661500779e4ecd7abe22
SHA1 f4087064a47cef7e65c3a85b937e83270bda2972
SHA512 c3e298fbf1d278d1e19b7121f568043a1464afe2e898f98aaa4041d185d9d7c01cf3449eb4b495c9a5ca5f2aae03ba60e88e937d52059e0c7bd01ac9e2be9fdc
SSDEEP 49152:dhtSn8EApI0figngiDn0AP5wE70jIpM3kiSBM29mhNq:MX2iypht70uMhSBrkNq
TLSH
T11C95BE13F2D900E8D05ED174C7568632EA62BC160B39A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 c6e61ad7ef0c6f93ba629f1cb2c1da0b6fc25ce8cd189206e8a1e7ebaff15091
MD5 3a869663c62b04763796852d6cdc31f8
SHA1 cf6f6e8d788986702bac858e9d5220179858f3d7
SHA512 0d968de1b7c0cef34c144444812cf359083974068459f636eb778d13056e5b3737a096d9d780b039d4542c0b21affe615f5c10def34f33ecb02ba6fe96087674
SSDEEP 12288:mageKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:ma7ozX0j52pMkuLoiSJVlIL29mhNq6
TLSH
T1326523812E0D4457E76D66B0B5BAD4C2CA39AFEFB62780761F5E87108239BC25FD18C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 ad29a6d43e137daa21e6caa07f747c7656282886bd01971a2d3a0cce0ac8bb29
MD5 b723148ecc26f82cab6438245d3fb20d
SHA1 619729e6b14a88e95b1c7c5569ddc03a5e219b4c
SHA512 49dc2f5397a0e9e174bdcd67db57e07d997cb6aee7cc20e4802dce8d59df370fcbf27961003795e467b73a586ba57230b24a23e45b9ba6142c5c68e29f720b65
SSDEEP 12288:exgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:ex7ozX0j52pMkuLoiSJVlIL29mhNq6
TLSH
T1E36523822E0D4457E76D65B0B5BAD4C1CA39AFEFB62780760F5E87108239BC25FD18D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 3cb1a9ff3922d939001a3fa954006468d8d2fc20954116df412ff5909f9f7fc9
MD5 7cdcdfbcb43c9b3f315c71bccea8bdc9
SHA1 d59d497d54f0d7715b9c7a5c10ce3a7bf2f5a45c
SHA512 0e79bc92495c0a618670db353c34a717d787b0f110f3b974c2bfc06ccb3d3615986380391e1042222b0c1b47c68391971ea93e7929787bf02d501e5a622d6161
SSDEEP 12288:2LgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:2L7ozX0j52pMkuLoiSJVlIL29mhNq6
TLSH
T15E6523812E0D4457E76D65B0B5BA94C2CA39AFEFB62780761F9E87108239BC25FD18C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 fffd6d9fa225d6d128584f6664597e0eee2a57fac6c09bd00111b614fac2c8cd
MD5 42f5e66dbb238b407fb79632e6bdf137
SHA1 70e22a4449366a677d1ab5eaa21442204f7167a2
SHA512 ea960fc8d783ccd6c0390f97fafca044ac88b84502041f80f34169fa49c96f10356db59d2f16d2ec047e898ad0877de94967dc51684f386befc715c23a6fc22c
SSDEEP 12288:pVcgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:g7ozX0j52pMkuLoiSJVlIL29mhNq6
TLSH
T1F26523822B0D00D3EA6AA270E9BBD081D775BEEBB73381BF4F5547544A317C15EA0E94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 1abb0e5acc93dc4963e907a6a0033583a76811919824171360013a953bb83bc9
MD5 e72896e92a96df2a1f8c4e26cba8ff2d
SHA1 3928a5b2409555737f937e01a8e208f7b7458269
SHA512 758650f5662a0f9a6868289eb7e04ee8d0b1a0e719a122a4a54e2462df627003c857230441766f08f0dcb9ba7208554f6a38681edf729b53d2d5988abc83e949
SSDEEP 12288:V0geKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:V07ozX0j52pMkuLoiSJVlIL29mhNq6
TLSH
T1E46523812E0D4457E76D65B0B5BA94C1CA39AFEFB62780760F9E87108239BC25FD18C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 a183c80232caeddf38ff91810941ae1710041c95d045a9f2cf5949a728417daf
MD5 9c2e1616779376be0ba060eebf9b9238
SHA1 04f46be47b3ca06b191bef6e980e29421fec0c5f
SHA512 895dc1cd81a778f4ff8721bfc1ee4ad8f35214f36fd6924024030c45fe5df389242b8d8b6d1552f3576d33c2772896999e5efe8022cd97e5c68420308f33e40d
SSDEEP 12288:29geKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:297ozX0j52pMkuLoiSJVlIL29mhNq6
TLSH
T1956523812E0D4457E76D66B0B5BAD4C1CA39AFEFB62780760F5E87108239BC25FD08D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 61a60743cc018778becf4e692802319b84b9e7f4faf7f968daafbdbf559e39cf
MD5 ab2a8b51c6336d76f1e10c9e946bca1b
SHA1 a3a9edb32a9012bacf4de5de63f94a09192ddd8a
SHA512 9a34d3acb64934d8f74808f0dc1f63e4b350062042106fdd881ed35ab71f7ad01ede7170b41fdaedf94ca6962e48c0a748bba475253f2bb068868b92fe7e3160
SSDEEP 12288:aJgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:aJ7ozX0j52pMkuLoiSJVlIL29mhNq6
TLSH
T1736523812E0D4457E76D65B0B5BAD4C1CA39BFEFB62780761F6E87108239B825FD08D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 f7edbc3876817bdc9b820fcfe518d228060799a2efc8bdeb53059d0bdad125cd
MD5 a1670874f079c546d5a7934e98f043e7
SHA1 f6dbc8b04c4326916eb4b7240137aeb5e89d53ba
SHA512 3d8783d1df0c401ea9cc90dc9e1300b330fbf2f2cbf7031b80e25e8c9105e4d6bfa1620dfe421b01c436c38b5a66f7f1f190979f83e4a0e8b65a02bea734b62a
SSDEEP 24576:rZMUzFVSOR7ozX0j52pMkuLoiSJVlIL29mhNq6:rZMUzfG70jIpM3kiSBM29mhNq
TLSH
T16F850181B35418F5ED67823EC9668906D6B2BC6A1B70C21F07A837265F333911D3EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 75579c683a28cd858f336ebfde6aa85018c1fa7d1d9753a485050beb61d672a6
MD5 1c2c3fa8661ca9992cf80278df2ecc85
SHA1 398eed830d415b46f00423706836cf55a62e059e
SHA512 8a06b2a2ec6cd43ab6b3c1b07f60ba34bdd5d1b0713a2fbee119cd037595c7d7774179507f7889cc4bebab5c26bd6dcf4473f9f9422c165e74e615593a292a2e
SSDEEP 12288:aOgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:aO7ozX0j52pMkuLoiSJVlIL29mhNq6
TLSH
T1CF6523822E0D4457E76D66B0B5BAD4C1CA39AFEFB62780764F5F87108239B825FD18C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 676abc81f4bdd9a86028b2a8e668a762201d06be1f9fc8f7411e71537b1a6ba0
MD5 b844da0e42e2ce60b55da4a4af751773
SHA1 ea60f43beeb7943dfc718e38dbd4582d62ca473b
SHA512 ec4be4526dacb5df8521f45af19e63a25e587e05b2a8ccb32ca8b79fd77ed5ab68be18d96ad5e8cc7d4f58ba9333a1b1ec7892a3250a4e0645bd2dfcc860bd19
SSDEEP 12288:3igeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:3i7ozX0j52pMkuLoiSJVlIL29mhNq6
TLSH
T1EF6523822E0D4457E76D66B0B5BAD4C1CA39BFEFB62780760F5E87108239B825FD18D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 622aadc3018f6af74521e65072e035497a63487515a43d5e1f380ffa8f2d56a2
MD5 ab6a36534bec39f7ed39013567f12072
SHA1 1fa1e5baf594f5aa6e8ca75b1eaaee154926606a
SHA512 dc25c4c5d241ee93d2a79dbce384365a4759724709f8d4b733c9cc17f1060be843c3b9f0b7f1286babc0bdda9805de5ff3cbf9d1e811ba1f8b075c30187e667c
SSDEEP 24576:azyF7ozX0j52pMkuLoiSJVlIL29mhNq6:at70jIpM3kiSBM29mhNq
TLSH
T180751243375930FAD27A9234C8A21A02F772B876673186AF07A447751F377C19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 3fd5ebfa94febe482edb2f98b86c4c812c1bfbb9015a5ae5b0c306c94f4807aa
MD5 e7a1c458593bc5b46f2991fbc547b4d6
SHA1 e0bd27e9ee39f9960728f39adb5f9665f5ee2332
SHA512 70a2629849e45249b9001d35bc69b65ab3f818a83f7ecfd28e138a1caee3ec759253c1f3b85d7f793a3f285a9c4ce0ecfe3072bf142bd3ba3a323731eea63b7d
SSDEEP 12288:0OgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:0O7ozX0j52pMkuLoiSJVlIL29mhNq6
TLSH
T1E36523822A0D4457E76D65B0B5BAD4C1CA39AFEFB62780760F5F87108239BC25FD18D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 81601c110168726d2ea9430614aa6dae083be20c7a89a04b94c965ae52632be3
MD5 eb398666917259df8fb338d549ceb374
SHA1 e3481f5509a148d8966acb049e9728a7fab2e4d9
SHA512 0c5fdbe475b99831927a35bf8cd8f565272110939c146abfbee4e32316c87d12f328b133dd46d48fa4def0c57153eb3ee3f6f06330cbd701db00d3ee91a3b65f
SSDEEP 12288:rOgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:rO7ozX0j52pMkuLoiSJVlIL29mhNq6
TLSH
T1656523822A0D4457E76D65B0B5BAD4C1CA39AFEFB62780760F5F87108239B825FD18D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 134712bb616482387c8cfe99ec763e6b988cf0c94f8f8dcafab2e65bbb237d12
MD5 1d26db77d8fce2d226a4418c815c0230
SHA1 bea0e560691e974e2357821f8912efbc0b107668
SHA512 dba941b2375f3522f5cffcb1a097ab76c0a926e9ec960f58a98f39316cebc4badd1d51c0c847277f1f738ee57dde44b8190cbd4b9c84ebc0ee2a0bd4dac787ac
SSDEEP 24576:WzyF7ozX0j52pMkuLoiSJVlIL29mhNq6:Wt70jIpM3kiSBM29mhNq
TLSH
T1D1751243375930FAD23A9234C8A25A02F772B876673186AF07A447751F377C19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 66170e1f2f8a1239872994b05f2e50fba43755ad334c007f48bb2ccce441b901
MD5 509c2e071544e2ff60884a4aa1821456
SHA1 fc15e9e338b7a433fa9200a016f71893111eeb21
SHA512 53c31c2be8a2bb3fb22b6b44a7358fd96b7a1eed8781ef44b9a6973fd062346cec1d690fd8612ac8b0796f433841fbc892b5652775bbf741adf822bea35696be
SSDEEP 24576:LTtaLl3z0zD77ozX0j52pMkuLoiSJVlIL29mhNq6:LTgLljl70jIpM3kiSBM29mhNq
TLSH
T12F850191B35018F9ED67813EC9668906D6B2BC6A1730C22F07E837665F333911D2EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 b8f0500272366daca029965acd4ee436591b223d729cb2f7fc9a4488f047ff08
MD5 e2d72d6e33e20c55653890bb9c277ca2
SHA1 abc787f7c414d9c562411d67965921f5d3f25288
SHA512 de4d61856fd36215af167059a7585d7541d905e821c6953ca4b0682b4f3af8c8cf635c666ff707a933292e3c083c45b534ff86bdec3ab645d2e940ba25efc165
SSDEEP 24576:R3Jd9CHKy7GZn7ozX0j52pMkuLoiSJVlIL29mhNq6:BJd9CHKyaG70jIpM3kiSBM29mhNq
TLSH
T17E95CF90F3E814E5F1B79A35C9769501DA767C9A1B31CA8F03A826191F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 86701821941fd45e4bbf7d45469fea2efced1d89865cea834e650b8eeba9fe06
MD5 c684beb468baf92c7cba0f727ad2e7a4
SHA1 a0e0cbbc9be89b8725d39d7605c980d08e6ca5cc
SHA512 f7451f1556bc355fe3c54af091dfb2dada3a091e3abae6696e7b13f221adc2687459346f16bc4d39187adfe14247ba88082725aa1ee4ff95fc685f98e53dd5a3
SSDEEP 12288:ArgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:Ar7ozX0j52pMkuLoiSJVlIL29mhNq6
TLSH
T1556523812E0D4457E76D65B0B5BAD4C1CA39AFEFB62780760F9E87108239BC25FD18C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 d1bca70c7f880e8c55c84c20180c2495b0b236ed75d223c23370c1974c03efb7
MD5 3b952c056a28074e8fbefc489bf75e98
SHA1 296a2d2b70ae226b99baa2e364908e7905791482
SHA512 40f0eed5857582546a7074962ef6317d5829d37cb11c5297ac5ffe4e229c1f659784af47e5dd6a478a0c149ea7323032101036e535a795c9631d288a5a977a21
SSDEEP 12288:zlgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:zl7ozX0j52pMkuLoiSJVlIL29mhNq6
TLSH
T1156523812E0D4457E76D66B0B5BBD581CA38BFEFB63780761F9E87108239B825FD0894
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 7ad7f550da2d4e2e440cb0a93c9a4d5a8fcd6bf4f89fcaab1df6b4fb7ffca391
MD5 5f98b81868e119251f2045916b260356
SHA1 2514175633bb9e77a396a1facae5455eb2288433
SHA512 79eaafbbc4618717b9c68f771215deadc08992d778d579521594987323a4adce96cbe970760ee6d699c98e047a3220c8a4e52d2d800ab55ba1759d9d232cbba1
SSDEEP 12288:YwgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:Yw7ozX0j52pMkuLoiSJVlIL29mhNq6
TLSH
T1826523822A0D4457E76D65B0B5BAD4C1CA39AFEFB62780760F5F87108239BC25FD18D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 5c0a117e5c9577f66250e3c31a868d2327d227568456962063277a7ac99bf297
MD5 58e9373d8a01b2c4ca02960186afcdc6
SHA1 b9615a8385045f0297714d9d7facde3fd9762175
SHA512 fe316118ffe8d44e6e58cb3c3cf260ee9dc82a509669c68c78692748ce8734cb9deb90b11e840bca8971bfdb4bc4ee4089aea041cdfb1216c001aaea81143682
SSDEEP 12288:/OgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:/O7ozX0j52pMkuLoiSJVlIL29mhNq6
TLSH
T1A96523822E0D4457E76D65B0B5BAD4C1CA39AFEFB62780764F5F87108239B825FD18C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 61545b66d3d6272bca070035b9e3b2884f84a2af1a1a65b51f27cc8afe670581
MD5 dcabd89aadf83f22478bbf744fcfad26
SHA1 49ed02461248db27dbc1b419931765cac2211909
SHA512 33287345a097885375e7fc996c0c33a785dcafb134d6881a83298d243ae3a887dfd3573679656c2c9be18044866aa90dc65ebf79d0a9d46bb61e9ec484673b7e
SSDEEP 12288:KrgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:Kr7ozX0j52pMkuLoiSJVlIL29mhNq6
TLSH
T1DE6523812E0D4457E76D65B0B5BAD4C1CA39AFEFB62780761F9E87108239BC25FD18C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 c440d80747f70391b854584aabc9bddb2b9b418da3f43065272f48395e917258
MD5 8389d191fa15dd2c783055cb5fe70aec
SHA1 6e5fa0bbdba0145769ac036c3c01f444f4d349c0
SHA512 7b064659ade63f948b48a330d24d2d168ac15e0731efadb4fb11aaed5ef980ca20e48880e358d7f370ac763425941ae2102294983f6cd4b212de680b6b9735c1
SSDEEP 12288:vmgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:vm7ozX0j52pMkuLoiSJVlIL29mhNq6
TLSH
T1D46523812E0D4457E76D65B0B5BAD481CA3DAFEFB62780760F5F87108239BC25FC1898
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 04c2a3674a46b567b48f89ba1fa671b8fa8f3a4911e962af65e71f929d2a01e6
MD5 0abb8fe8ed67c350abe507672b676f94
SHA1 a90c4679b5f17496a17ae075743158ccc9fad0d6
SHA512 77f5be537500ea57ddab9c0b10cd44efb01623e42fba1971ea69de0ef3d01c76540d60f7329faad89b4ac8563034da86dc2798464bb7a1421e1f564f4f1276d7
SSDEEP 12288:r0geKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:r07ozX0j52pMkuLoiSJVlIL29mhNq6
TLSH
T1BA6523812E0D4457E76D65B0B5BB94C1DA39AFEFB62780760F9E87108239BC25FD18C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 45037ae0a4adb908f9fe661791733cd08c2877dfc2a3e089b81b71086a74ad65
MD5 d63e7ae38f16f25558dbe84de3e810de
SHA1 5acaba7104bab12eeda9ac56e5dad90fe9a45c63
SHA512 eec347ed7e46b40058e7d516f04ca488b7688bbcbd1a61b832f8477ded3a5e6ef1c599ea769744ac85684d3542ebcd0aa4e7fea36b817b9445765c2177fce1ad
SSDEEP 24576:qfwvuk9RX6wkyAIy7ozX0j52pMkuLoiSJVlIL29mhNq6:QMnYIj70jIpM3kiSBM29mhNq
TLSH
T1B395D029EBCC04E6E1B7923C99B7460AF6B178691B31C2CF029A536D0E37ED45E39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d5635084bb7159c2b0a03dee0278ecb0f5b64263123d9e8064cd709d478d0a9e
MD5 7c0f7b7b867b91e6ee28acbf61d1ea60
SHA1 caf907c43fc4d6fff64ba3e1bf9b073d27f5f292
SHA512 77b6e6463d9a47030469ed11ff9969ae132b7fb9006297a9f780bc96de3768af6709141b87c4d87268e0dbf70425907d93af71c127bf50c9dca6272ac9e0c91c
SSDEEP 49152:BYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0k70jIpM3kiSBH:pySzPM70uMhSBrkNq
TLSH
T1C1066C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E546935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6135866e375f308ba1a3357f2946f46c9c57319baebf39c04dcd612c0b4269f8
MD5 1837b18eab11927affc022d68bc90f6f
SHA1 ee146506415e7f2558fa5ffe89e9db07936ec9ba
SHA512 68b1ca03a2717d4c41f15f2e0a97e10a3690e5d945f9c80d349a34449af27a1a6e981bd2aa5d02958b15653c2388e9d32f0261bab219969f939efd1f5b154637
SSDEEP 24576:a47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYh7ozX0j52pMkuLoiSJVlIL29mhNq6:a47JUQj1irIhCnDHUPfF/U70jIpM3kiu
TLSH
T1C965AE1EA3EC01E5E1BA927885158A5AEA71742E2F31C6CF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 5a695c82ccb253137176264c863f25b3c21d136aed2b5d91f3064707aad4f267
MD5 f42ddb3d5a73c57a2ec29f6716bbbf50
SHA1 b931b2edcb7c0c9d167b5ea966d97c701345a802
SHA512 4eba0caa37ac369bb51996108a1b5eb4a6ef15708903d467730d861b377ecb867093f60f8ffba4c3fa995e760597971f1644c6d1cbdaf56594e8eec6b203a597
SSDEEP 12288:pjsf+geKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:g+7ozX0j52pMkuLoiSJVlIL29mhNq6
TLSH
T18775F146D24801EAC16E6275C7668A41F3377D6AA3E2D3CB17D0F63D0F366809EE5A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 d8ea759eb77f710a813e76994be5ce094ed4d2385272ccc185d376eb0dbe618e
MD5 2b3fc70e86959419d9803dc4b251bb22
SHA1 f89d316c28a6b1e61b195a7796242437ba31af5c
SHA512 9bf9b37ab92f46adf103dbb350e68b3e18805602d2c17dffa6851752bcd2b1c93490ab0be7e686d63b466a7d7123b99661e63f9ee5be1c0bc45cae903254a4bb
SSDEEP 12288:YjS0wy5n5cD2vTTSmR3RrzrQh23cYk4KaRMEOV7s8L:YfwpD2vTTScrQh2TvKaRMEg
TLSH
T111452811762BD75FC6A940325E33D5CCAB707D01EE45AB0372C8872FC576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 25cb89d0ce0301ba7400aeb8c639590cc2f4e9e1504ffbb62c80d5d3f10191e1
MD5 674f6cce107c3242912ac6334e1fffaf
SHA1 64df3c137bdf06d6f49dd2f4229b6a99037feb88
SHA512 e8d0d308ac9153bf561e6f18efb43e8d1e24532a86658d34e45a013850bd0db424693e3fc4af83f92367d77d29981e153ee1c1f2973705115b54e448cbba6f18
SSDEEP 24576:3gGC8UtaKm7U00EZPkT5PygN8fHHldkWn39+p5:BaO+j
TLSH
T1E755C741513BE3CFD1F76072072AAF4DAB64EC0677096F266388053AD86E725A0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 95988c467ec7b50c30d634e8919cb9c2fc405ef04eae4b353c4fa1a3a37e4aca
MD5 f06396511bf663219e08fe4ab7475646
SHA1 841b8c3e3d56d9b0fbef75935bf98413babdaa3e
SHA512 d7f2c56dc5ee5bcaf44e5b338522567a2f039d60654bf318f6964ad87a2ab0fbac4a8e63eec1d3dd6c81b2c53d8fd647124733d642e7476d116476d3b10d6672
SSDEEP 12288:b+7WgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:GW7ozX0j52pMkuLoiSJVlIL29mhNq6
TLSH
T10A6523426B0C4807F67D66B065BED041963EBBFFBB26C0E75A5A83509135BC29FF0948
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e3d2b212271c59c3afa0958ba181c543b6039c258a8cd41f1bc846d475ef745c
MD5 5425b1e95559fabc5a31db0bfaf1e1ab
SHA1 07c5964cdd3c13548f7d2d7e1809ebc551547421
SHA512 357afaae4d07deb5ee64f3b376230cb6026d06f9d2e377374e77179b16463d6f88f5dbba149ec0fe90c526c9b73232c62734a44054184bfa092694e39b11853c
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bYY7ozX0j52pMkuLoiSJVlIL29mhNq6:/gb4mBIBhGFa70jIpM3kiSBM29mhNq
TLSH
T1AE65AE1E22EC02F5E0F9E2B8DDAA4417D6B278161732D2DF1151422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 4be63aa07f7ba69df89da93a8a740e491d5072d63dfac450eb5bcecf625f13c3
MD5 6bd87ca1c8684ee106ab0714ba66d9f5
SHA1 b54345b9b004e2d3781c264995d05abf41dd90fa
SHA512 f7aa09769d7d81ca8bfd6a37181cb3f2f71df1c160e9267edb3aeb6bc865eb8525d0ae3bf5ee1c56755edafca7f3f02c18dc8f7e0dfeddaade5636bba10a65cb
SSDEEP 24576:CG88u8FpJqH1Rzria7/mR7ozX0j52pMkuLoiSJVlIL29mhNq6:Z7ZFPqVYa7/970jIpM3kiSBM29mhNq
TLSH
T15295F15177E501F1D47BD13889964663F6B2B8261324EBEF0BAC8B511F23AD14B7EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 f2f764eb5cd0ba7b587ef2118262ea1fa9fc9c01637491cacf2ab34f730945ca
MD5 00a910b84880a33ea7136009ed8c8c10
SHA1 c175a61a0efa52237218fe0e7205c8dee68bbb2c
SHA512 890b652e1e5634beb8151b6734e096486f9881ed49872de4fc58c35d4d8e456b209386dbafea60b690e9835bce041d6834fbe97aa9490f49e14b6af59436cce8
SSDEEP 24576:yPUr+NQN7ozX0j52pMkuLoiSJVlIL29mhNq6:yJQG70jIpM3kiSBM29mhNq
TLSH
T1CD85F11F269C18E5E67AE17C89968609F771B8621312D2DF02E1817E4F37ED8BD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4357f66b638f8248a370ed86f2b2ce9c0025f58565caed87d67d309d4c0b76aa
MD5 d5348496b3da1cb3c7ffedb665e212ab
SHA1 08661cebc152ff7d6fb285c03e9746bcd592c1de
SHA512 8a5c93130f6ae4765f9a846cd7234bd1d3cfd46382e4b43e0451926efb4772c14aeb9c9e3ef2441a9a6d911aa45af5765418006167b409454705e76bda819681
SSDEEP 49152:zBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjW70jIpM3kiSBM29ma:cG05lO43bb70uMhSBrkNq
TLSH
T1B8D5C06A62EC11F9D1BBD07CDAC6860BEBB23415033556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b253639b7c617f206df42ac6f65502176ce1b48c2a07010e68d7ba188bc986af
MD5 23b07c9b746a839374d8da9db7be7126
SHA1 7ad9d5cf32f22f46418bf384e547384a7f2a15ca
SHA512 ddc569078ffd7deed349d07ea683b25202ff064e5bad4c56628477bcf5883c6e7c6f702590985a23ae529caa3522843d702775b8c26d68f69ac4f19ae0da2c91
SSDEEP 24576:cfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnf7ozX0j52pMkuLoiSJVlIL29mhNL:Ea5POZ3+Jt2pasx2+m+70jIpM3kiSBM8
TLSH
T1EA65BF5EA7FC00D5D579D17DC583861AF5B1342653329ACB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c0ef96284f7191ed3511e2e3d7139614ff43c5721a0d4a8616b6d0bacf4696cf
MD5 7bf1dc280811d20592460cb7baa0303c
SHA1 2ffce9673fc5636f6b99933682da85c60ff0b2ce
SHA512 7e1c978b2c1e5258a92e434ea754ea929ca257a52ba48b32d136d90a968cceacc23806f1ccb14d63a57766d372464894ca72f8a1d291f324d60c32a08f2f5a99
SSDEEP 24576:WNcwHdjbyQ4nLC18lb/EOjowL7Fk57ozX0j52pMkuLoiSJVlIL29mhNq6:WNc/zEOVHFd70jIpM3kiSBM29mhNq
TLSH
T18D858B1623E901E4F5BBE1BE897B9546FA717869533086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 937797dc35892ed05b11cafc931c6e98d51ecac8cce33478b493e3f283328dd3
MD5 9900dab504683ca5e5cda6a8109f9f15
SHA1 cabc4717a7f4ed441a3e2029641d961598f2173f
SHA512 6a175b7d7ce2059a679e459caf1036988357b3c2b9786fdc8da7c17f9449e124e873d04aeca70a1e0139800be1b0d731778d5f9747087fc98ece35d26d73491f
SSDEEP 24576:U8kNvNnaFeYhJNtmZBmq7ozX0j52pMkuLoiSJVlIL29mhNq6:U8MwBtOmb70jIpM3kiSBM29mhNq
TLSH
T15C55AF6EBAB805E4D1FEC6B4DD238512EA727461173293CB5390C13E0E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 8d736deb98d3db8a78c5607c49dabd209061acf84fe9bb31b971e2adabb80b02
MD5 1386cdc1b9f6b7ed4d4710626db9b9a5
SHA1 90bbe94e332ac660b28c0d1b351fe8c935a54d8e
SHA512 bbb001ad2ea2308c1ab07975d901ce74504c3ff856984f290929b63ada948fbdef2a66825a149fc909a1df365bfb57f18d7a33f897433cad044a4d458a92f149
SSDEEP 24576:fD3FHshBIYQgA67ozX0j52pMkuLoiSJVlIL29mhNq6:fDVHeBIAAL70jIpM3kiSBM29mhNq
TLSH
T1B595E16EEB5C04E5E57BD1BCDA638A06E77138AD032255DB02D481B51F2BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/856-71-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/856-69-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/856-77-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/856-291-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/1724-131-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1724-122-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1724-123-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1724-129-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1724-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2100-309-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/2100-118-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/2100-110-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2100-116-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2264-307-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2264-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2264-85-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2264-329-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2264-91-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2264-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2428-121-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2428-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2428-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2428-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2428-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3548-65-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3548-268-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/3548-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3548-58-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/3940-140-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3940-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3940-146-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3940-313-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4244-43-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4244-42-0x0000000140000000-0x00000001401B4000-memory.dmp

Download

memory/4244-49-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4244-56-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4244-55-0x0000000140000000-0x00000001401B4000-memory.dmp

Download

memory/4448-413-0x00000220095D0000-0x000002200961D000-memory.dmp

Download

memory/4448-314-0x00000220095D0000-0x000002200961D000-memory.dmp

Download

memory/5012-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5012-96-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5012-14-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/5012-22-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/5424-97-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5424-104-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5424-98-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5424-310-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5424-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5424-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5560-414-0x0000028D671A0000-0x0000028D671ED000-memory.dmp

Download

memory/5780-325-0x0000023961430000-0x00000239615FA000-memory.dmp

Download

memory/5844-41-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/5844-7-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/5844-6-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/5844-1-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/5844-0-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/5984-81-0x0000000000400000-0x0000000000576000-memory.dmp

Download

memory/5984-306-0x0000000000400000-0x0000000000576000-memory.dmp

Download