ec4ca3849ec27581a5fbd20cb14523e9ec2a912dce9095fea743cce1a976653c

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 00:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_3c9f9bad4e170ea1c458473b7f26230f_elex_redline-stealer_rhadamanthys_stop.exe
Size 632KB
Sample260803-awk9nsvdqh
SHA256 ec4ca3849ec27581a5fbd20cb14523e9ec2a912dce9095fea743cce1a976653c
MD5 3c9f9bad4e170ea1c458473b7f26230f
SHA1 8be4253d1ed20537230c5759283c822a31311299
SHA512 b37991b7ffe3c814e5e35908df04632c4d1a1c545a177d7df2dc265fa3b17a7eab54bb6e7a2e03cb6030fdddc949ac93f32481281ddf723b7a1f8dc681d61860
SSDEEP 12288:35SZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:pSj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T1AED423707602C0F1D92A61354925D2A28F2F7D7273754D87768B2ABB9E38353CB227A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4248	elevation_service.exe
4028	elevation_service.exe
1432	maintenanceservice.exe
2584	OSE.EXE
6108	PerceptionSimulationService.exe
1448	perfhost.exe
4336	ReFsDedupSvc.exe
5532	SensorDataService.exe
4648	ssh-agent.exe
4172	AgentService.exe
1828	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-02_3c9f9bad4e170ea1c458473b7f26230f_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-02_3c9f9bad4e170ea1c458473b7f26230f_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-02_3c9f9bad4e170ea1c458473b7f26230f_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-02_3c9f9bad4e170ea1c458473b7f26230f_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-02_3c9f9bad4e170ea1c458473b7f26230f_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-02_3c9f9bad4e170ea1c458473b7f26230f_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2f8ad0fbe62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-02_3c9f9bad4e170ea1c458473b7f26230f_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2348	5564	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_3c9f9bad4e170ea1c458473b7f26230f_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001af8f6cedf22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000097f3f8ccdf22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e89c830de022dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f7df0618e022dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000428903cbdf22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000765e500de022dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000326174cadf22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4248	elevation_service.exe
4248	elevation_service.exe
4248	elevation_service.exe
4248	elevation_service.exe
4248	elevation_service.exe
4248	elevation_service.exe
4248	elevation_service.exe
4028	elevation_service.exe
4028	elevation_service.exe
4028	elevation_service.exe
4028	elevation_service.exe
4028	elevation_service.exe
4028	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5564	2026-08-02_3c9f9bad4e170ea1c458473b7f26230f_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	4248	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4172	AgentService.exe
Token: SeBackupPrivilege	4336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4336	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4336	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4336	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4336	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4336	ReFsDedupSvc.exe
Token: 33	1828	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1828	SearchIndexer.exe
Token: SeDebugPrivilege	4248	elevation_service.exe
Token: SeDebugPrivilege	4028	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 4392	1828	SearchIndexer.exe	102
PID 1828 wrote to memory of 2812	1828	SearchIndexer.exe	103
PID 1828 wrote to memory of 5892	1828	SearchIndexer.exe	104
PID 1828 wrote to memory of 4876	1828	SearchIndexer.exe	105
PID 1828 wrote to memory of 1840	1828	SearchIndexer.exe	107
PID 1828 wrote to memory of 5924	1828	SearchIndexer.exe	108
PID 1828 wrote to memory of 924	1828	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-02_3c9f9bad4e170ea1c458473b7f26230f_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_3c9f9bad4e170ea1c458473b7f26230f_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5564 -s 476
  2⤵
  - Program crash
  PID:2348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5564 -ip 5564
1⤵
PID:5680

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4028

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1432

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2584

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6108

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1448

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4336

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5532

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4648

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4172

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4392
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2812
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2836 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5892
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2888 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4876
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1840
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2888 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5924
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2836 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 26cbdde29c2f372144804ae7454bfd5847fdc4912cbb526beea63fb37cab2e08
MD5 45821425846a77652d9115a3b492649b
SHA1 77072cc532f97082efbb95778855a7f15cdbd8e7
SHA512 e3c026dd04335b17305e05b7e8fe3a54c31a90fc8c20bd13224c27d74dec9e13dbdf6374ec59c46d8560f6075acc3693dd4ef41049da0b2b42f81d6bd7dd2e25
SSDEEP 49152:fb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnIj9Fl19CKIaFzErn4:d3q6sjBH9n19ChaFQ4
TLSH
T196D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 6e472e43f43d46777d77a6b97c485116f21cefef3c3a57c0164aa3007b06fea7
MD5 d26bfec807410954df69e1826b524f1e
SHA1 d80dbbb0d3d73418186086d69a87332bdd06ea70
SHA512 29255147999fa26e33b9e518f2cac9e7bda3a7d2ac643a9d9c0da1ba6a6c90871b4180dbb0379bd5e7435b62708fc06ec9e6fca2c6147989beda145a7271fa47
SSDEEP 24576:dXYfDtczAnj9FWM170KLX1GbKIaFzErn2Jg:ItcGj9Fl19CKIaFzErn4
TLSH
T1FA05F12477A509F8ED678238CDA28502DA3378564360EBCB03E499651F337D95E3EFA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 0b5a475941d9dfbb0ace8390b1c7962bc9cbfca3116fd3386b1cbafe2787fb55
MD5 c2e088dc63efef295111aa839c18a9b4
SHA1 8e52f39306cd5f793f6ab0db3d39aaa86f2b59f5
SHA512 3af18ce48bb25203278b19c5cea3ec7c80e7bcd9b0a29ac0899a7d3e2dd92e8f96971aaa8b310a8f72f63f441e14b3ea8baa129f0f5f2b72265fa2d26bc77850
SSDEEP 24576:P0Le5ji0hmxxrMVj9FWM170KLX1GbKIaFzErn2Jg:PPji0Ajwj9Fl19CKIaFzErn4
TLSH
T15635AE26F6748371D073C0B9C5D2A68AED72308657308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 01e2912d7f77f6683230b3e35289add6bf59b100bb1333789fe0620d8159be00
MD5 3d79bd3d30db5d99971a8706c4bcca1a
SHA1 f0fe40d31b1cd85ce408c48863785589b2d0991a
SHA512 cfa26806a118d007120957c9018fa740abbe3546b57ded34a066e97af490c9c9f0a7ab4fdd108a344ad7e9460f40c27f9e989047c8caf3002c207e444df492ad
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWn6q8wyuvj9FWM170KLX1GbKIaFzErn2Jg:D/ezSC6vUzPveHjyMj9Fl19CKIaFzEr4
TLSH
T159755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 91d59894ac39706435b1c14515866f9f90ffa95dd3c0af34de731ca67ec4e8a0
MD5 fb33702967f3202754ee12778803f220
SHA1 3d5a709414c357555eb864b3021a74ba00fe8233
SHA512 bf3d7a7357305b984b6bb7a08823ebba14cc33afa6dbe810a15f9c72c6e58dad2093b65ec4ca48eb49d775ce67717b917b0de1bf895a7fc90ee42b18bfbe7fe2
SSDEEP 24576:dVbqPb88hv/l+Yej9FWM170KLX1GbKIaFzErn2Jg:dVO88hXl+3j9Fl19CKIaFzErn4
TLSH
T1CA559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 5a5b74984565182b8fa7b63ab2a1a89b784b835f352cf9c39b6295b4f980192a
MD5 6c7d6855c771ef5c9e91599340978e02
SHA1 2633e11e70166a87bf287f1d5bcdc05e3fd3c7b6
SHA512 27eb2ad27434ce7eae5b4c77137339a6e579abf2adbb65c2e42c01ceacc6c1f3c0a534b3ac6674dc333367e141b3211ef675c0e0c7fdc6f9f4a1f09eeae89612
SSDEEP 12288:ELpZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:ELpj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T1D4C42371472A81E4FF3A633099717483CE2A7EBBF3641E4D019B7985587C91BCA91EB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 01a7c66ac5730f8f3061ef4e906643c134ad893e030fd8ad3614df38a3b95385
MD5 0e37dfa804f493d222657ff07b80e750
SHA1 b42d2208e745fe6e28a951ef77f0a3f9ff8821b0
SHA512 68d199a7d6469474253d7e20ae694775a27ec744cc6a0cb51f58b4d18728481aed787accdebd6bbc1f7b99458e688f850137c500c3d123fa33f4de9eff86fe4f
SSDEEP 12288:weBNUbTVO86U2Z52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvS:wJIU2j9FWM170KLX1GbKIaFzErn2Jg
TLSH
T1E405DF3BEE28FCE1C27E9D785B918200D77278718B62A3CBD165820EDE235E54E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 98a8e4f849fbb5620693e115c7c461c17f5fccb21a5e7aa3b940bdf9e1a8ed4a
MD5 8c199d4c1130106226858e0fb0785fdd
SHA1 a1f8ed0a67b74c97d7f5b88022b73abd4d2b5cde
SHA512 8c4a82497c4f57606a19a715ad266e9a3e401c0a231f6285465b4ea064f41a8b50644fbf0c5a3371cec4b608fa2deaecb404599a2a1c3700f49fa78f6fc2a307
SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THk:WQvGAdlCEL8c/DRNw5Cr9n19ChaFQ4
TLSH
T1DE266C656BF880F5E0B7E138897A85B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 7953881fb0db05e591739f93f93b093b41b9b540d437a422425e8c5bde328610
MD5 5a8b5ce2bcaaef7fffde7d8f6f2e4494
SHA1 527e34e425b9dc64fbff538ee9910eab57926810
SHA512 86fa59ea963eb0dbb8fed962b588c989f557b95477513e5646299cfef0e0df213fc6c6418af020d35ce0216828d3b0fb85d917185ec6699986b92b18fce7da9f
SSDEEP 24576:N0ewsAjAj9FWM170KLX1GbKIaFzErn2Jg:WljAj9Fl19CKIaFzErn4
TLSH
T1CE15E031FA75E036C77F0DB21B36D706583D7A204B611AC3E3A88D8E59342D26776E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 694ddce0f630b351c923115b1236cb916110046aa34347002b2aac85eb6710cb
MD5 55f424ead88cbc0e05b2ee7ee608f36c
SHA1 75d36930a1ecf90a15d604a1139bf5d4dd288664
SHA512 377e06314bd5103411d7531e1bb8ada32f7e03fcd029a8e197a8de5a7afb831661d2dd54c9be77f284e053ce8ef528dbbd9ccbe7f80ff8863b6659eecce3e4e2
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHhEq:YUEtQevvqc2W1cpV2tI32N
TLSH
T168474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d518b510c812f9ebcb7c334441b93f1d5c24fc08f3974692243d7d665775f7d6
MD5 9e151a47c08e6fdd459eb0863e0f3790
SHA1 e0fcfa01b65959ac5cab0933d20b57b2eb38fe78
SHA512 96ea1f49682df0dbe21929b5ff256d3e17d90dcbe6ccc5d3ab974ebf78a5d42630d50c6a7b9d2afbf8455cc630c7cb3a2a13a31ed0396e0436bc7febf8dbe4bc
SSDEEP 49152:JCbRquA/m2yL5zLfFiV+XenmE3/zgj9Fl19CKIaFzErn4:Goq2Vjnmv9n19ChaFQ4
TLSH
T11AD58D1976B8C1E4D1F6C37886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 428f8c9fb4b2524d750366015028b255366ae68a50421fdc3217200aef31fde7
MD5 05812bdc274802d4f4fc392fb5774796
SHA1 c8036247f747247e92fa24f5b1c1bf4d945bf12d
SHA512 d973b6ca403ce484d2b91ba670cc9f1c41e21001637b071bcbcfee19d4c871eeb9a561f065db4157d84b50c677142f33d2e70ed80c17658bcb2d76c79cb11407
SSDEEP 24576:9AhGL3IFoiwtA5l7S53bj9FWM170KLX1GbKIaFzErn2Jg:9AMUFoiq5Lj9Fl19CKIaFzErn4
TLSH
T1F735AD81E7F945D4F5B3AA7899B69171EA76BCAA5E31C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 716c502ac4d1e10b3df4e21c33e6d6652060ae88e2df1aa54d995eae92010f12
MD5 58c040d465e6e37e9759f269dbd58b2e
SHA1 b7c2656f95572be381534770dd00195442adbae1
SHA512 3600df753da4c51dc3814cf8a731cc94f320507447a36bd344e28f2743433b450214759e0bfab9fa40d8f8be826ec96e26199a8d97434f7d81105beda2f1ee7e
SSDEEP 24576:owu4OWlj9FWM170KLX1GbKIaFzErn2Jg:owvOuj9Fl19CKIaFzErn4
TLSH
T1F805F15677A90CF8E9679238C557D132E7B2BC123A21DB1F1360C65B5F37321AE29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 0c5add9fb35bdc149842ee264f47f52b91e42e1478026ccc6880017965791840
MD5 fa417f612adfe1b1ea074cb1dd925663
SHA1 9814657a562020a46f272a998655e0677b828e72
SHA512 31a1c308325f094237c3286fc43ddc2aea77ff8f3e4d1d1da2c31a8d7fab69c6024f4ece985c2e1c923dbd8b5f721161baad26ea6b81a7dfb5597646a8f5ee70
SSDEEP 12288:ueZ1IyQZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:zZuNj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T1CAE412A623A860F8E6779238CDF16642CB727867733107CF1165469A1F37AC68E35B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a6ee15b47899c10f7d5733ede1dcfdf3b48e5b419ce2fbe9f911d65d8e2fabd1
MD5 867e359b01bb7aa16f1a44c3cbaff49a
SHA1 a9a52b26541e252b3bfae1dd618a5f0b712ba554
SHA512 5d9ca7abcc8f65df9338dc04ddbd2c3ad7d1bad08e882c632314449e87a576f51d3c7ea6659ad89cabde0106cadbf2851a626f8502afcad11f4a2cdaebe7c2ed
SSDEEP 98304:CQRQyi36YOcPbLvw2gAf+PN389n19ChaFQ4:ZQyiKa/X+PNPEq
TLSH
T19C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 30796a2d2c622a8ee8768d5cc7666618ec149ea8c70797e517c5a379a9e4f65c
MD5 fcf0864b60119d34024139c6fb08132d
SHA1 87fbf678db820b33f6e638df4b22cc405cd77c51
SHA512 8ec880aa20500aa52d1fe3e437a84f9bac7f77436c3ec8c7a16ccf78ebfbfee791ff5e18df4ff8a8f624ee0bffb7fec4714ee9aaf0d0df42545446d5cb051cbc
SSDEEP 98304:fQRQyi36YOcPbLvw2gAf+PN389n19ChaFQ4:uQyiKa/X+PNPEq
TLSH
T16E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d40f3189b1b000394db0a0ce91e9ccc5e3af2098fd3d9613e5c406d891518622
MD5 6b070352836a00d40988828c4ce2a23c
SHA1 f5d27de83bc84bc39fc32bd6ee938b03c2493607
SHA512 9241df62dfd8e2a995e533b7f01a2d3c713a5783d93d2d14b7f6275deb524fbbbcf9a0c8ca06bc713e5ae6f6ead8642d8ba14b13bce53947580b33bcb8321d7b
SSDEEP 49152:K68Qg55nhceWu7PNU3/wj9Fl19CKIaFzErn4:4thLRc/u9n19ChaFQ4
TLSH
T15DB55933B2F600A9C44DE1769F4A972196D27C75CFE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 15f95313ba355ebd560aca6d5ca36e4f9d58ed96b5389c30d687d39eff285ffb
MD5 f21936a912877f0591ce4ab6b66c163c
SHA1 2520333e61b0c56e9386e9468c8f15003429d97c
SHA512 98c706dac05b6f8bbf3eeaa69dbbc4b45f41b120e3f895fe87ba9ee8b626196dae0865310533dd30b2f32cfea24c1d82c90ea061887f61bd9566ccb74013a6c4
SSDEEP 98304:Cy5112gYy5azzVvt69nLKnhZp9n19ChaFQ4:LLIHEWhkEq
TLSH
T148167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2921f6add7b01db1717356305e57fc2c5e60ce4e894f6d64e0d579654a495665
MD5 906e9029721eaa12377bcdf64c2210f5
SHA1 293cad889683a8fe28cbaff1fae28a672d44cca2
SHA512 107714fe4377fe65614bfc0d6e3d469a504aa71baeadc7d803f8745ff305669324d8145cfc534bd693e2569a571c946a4db2ad2ce4cdc368eb1112f5b496929e
SSDEEP 49152:YB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl3j9Fl19CKIaFzErn4:yu6Jmdxd2dT9n19ChaFQ4
TLSH
T1BED5AE13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1dd9a387309ebda6c1371e7a2952e5c44d063b7e625acd6179e2795a1c48e7bd
MD5 d206c0e9973ee00c973ee8e950bdb382
SHA1 9272ba0cf10404a90e15572625c6421e63a87c76
SHA512 8d0773e2006d7c6c837b770e5b8e385fdf7696d1d056720672306e93ab0b4f738e1e7ec8a83fdb5333a72ee45c66eee05ae9fab9d6999b8f28f300c5f300bec6
SSDEEP 49152:r1hpsNoJpF1A63U44CwH7R4xWj9Fl19CKIaFzErn4:rmifPWRv9n19ChaFQ4
TLSH
T1E4B5AE13F29901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4d512bc784ee57c75851a3162640345cc75f9bedb850b13c68d0a43c6d46ffee
MD5 dbbfb7d0d266d465bded0db9e48548cf
SHA1 11c901cdcda259007311d9f55b375304dc1f62e3
SHA512 0b7ae38ee409528eb0079226e80af1503e184cab78228bf8b62d0888ecaf947c38a1c229a9817df3ea7f616e0d5c8e64f97b0a92efc197920bb6b059ab2c36d6
SSDEEP 49152:gSuZQIY0Be2KcRVtOnks6NMHqNj9Fl19CKIaFzErn4:65dKii61F9n19ChaFQ4
TLSH
T1E7C5BF13F2E940E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 959361e54b7e10e598f21aec8b93c747754cf70265cf99b07b89f68a5ee84ec6
MD5 ed1ded8198e209ecb0f050a642eb5a7b
SHA1 278cbe7b2b29be702b61bbc1e20c1c9d4900a8ab
SHA512 8a4709de70ae978d67ce5b5f7d1ceb0f2f49acea7e383eb46cc976db263ed05594c905504d98ad0ddcb12430406f05ae0b71153ca948dec0e2b2da6d51cf7aef
SSDEEP 49152:4htSn8EApI0fig3giDn0AP5waj9Fl19CKIaFzErn4:pX2imphD9n19ChaFQ4
TLSH
T10E95BE13F2D900E8D06ED174C7568632EA62BC160B34AADF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 02e620bd99168f18d7d091ccdda1cda772ab76f155f4fb9f28ae1ee43816a747
MD5 0c2008ff602aec772521ef1908aac9d1
SHA1 0283b4aa5912f90d65cc8a6dea866da41f5891b6
SHA512 cbafdf86bfee79ea275c5134621d73b1b7957c27c04e6ab9b77ed98d5c555df976162ebf6a4448b41278f4155ec440abb64ae985b833232164e0cddb981bdf68
SSDEEP 12288:eBZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:eBj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T16BC42371562B82E8FA39A330C9613183CE2E3EBBF3611D4D119F6445597DA1F8A91EF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 660a18dc5aa5c7849e464a135acce328f668b36be7ce5c64f3fe462e95a77b5e
MD5 8b8cf7491ac59ac2420d62548e4e292d
SHA1 b19bb36b5e97a88d6ea49786e8cbf5146b81e854
SHA512 7de0d9d9b5ee193d322a574836d36e93e69d36b76a10cabdb08dd767b11f8930fdbb4f8dcfb519bc1d00f2c63d74449fc1e9135b94e0e798f0c65509f3948492
SSDEEP 12288:o0Z52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:o0j9FWM170KLX1GbKIaFzErn2Jg
TLSH
T182C42371562B42E4FA39A330CA217183CE2D3EBBF3211D4E119F644559BDA1F8A91EF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 222148fd7343eae060c14dec591e9f1b655e49d59d12e1218b28306f0d696ec2
MD5 aea0ee4d9e344999ac4351389209b1c3
SHA1 f613eda18ecb605a296c707294823cc1aff0e982
SHA512 1641599982f20adccd75be2744065d759e1febfd8e2ddb2a39b35e9356bd4fc8b56bf411fe1adb023dfff95a9f185a377a476d1fc4b8a0f892083314295e2b73
SSDEEP 12288:UOZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:UOj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T1E8C42371562B81E8FA39A330CA213183CE2D3EBBF3611D4E119F6445597DA1F8A91EF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 cfb0136a8d328f6beb40204824c8cf1d09bc0c3a49f35ecb246ac42511214093
MD5 6c0240670f67dec3774557634795bc40
SHA1 c9befaa1922e8b5d58aca35b67829c4516f9d9ef
SHA512 32db3ff698c18fecad1487afd46b36cea52aa5d0c26e2ea0dc2223cd16a7f86f7058edc12bb26b97ea87776f7c29058caa8c0e976e91c3ad8e081a332ee456be
SSDEEP 12288:WV7Z52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:oj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T1E1D42361672A41E4E93AE334C9726143CB7A7DBBF3311A8F125618491D79B1A8E70FB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 94fc64f47cba2845a1e232f327f23602849f21dc3e5045a2bd493e16fe8aad1a
MD5 a365b252fe954f6c368e73b405819bfa
SHA1 576415542cade76ca48086aa2a8cd3230e30149f
SHA512 1daadc291b1f42862f01c4ec384eeb1da38ca8436c82952a22cc95de4ceada8029eb2a166035a93746c61d56bf330961999a94fe754a6247dd7844693a910c6c
SSDEEP 12288:fDZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:fDj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T1D8C42371562B81E8FA39A330CA213183CE2D3EBBF3611D4E119F6445597DA1F8A91EF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 ffaaaf0dcdc2d4dd48e26f01196f74879d888ffa1e4d36edce2137dd84336678
MD5 dc6e9fd210bb35ffdb3589a8a25fcd88
SHA1 a9a1116c47b40315deb4ae640dc7dbee324ddcec
SHA512 17f592c8c98dfad3533b9a7f11fbc4b9c87810d4a31b8ddf262c3006b20b4c1237239f1141cba5be1c0f2ba69157098e537e16b712c0f4dddf89509569831b41
SSDEEP 12288:04Z52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:04j9FWM170KLX1GbKIaFzErn2Jg
TLSH
T112C42371562B41E4FA39A330CA217183CE2D3EBBF3211D4E219F6445597DA1F8A51EF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 a5d6c865f4923e65ac6b0d3547c16c6355ccd0fcd285348ace524a51d3f4f33e
MD5 98f23ec15b56aef127e77f6726b69935
SHA1 4865e3150cf8d3863c86c46884bfe459b4a192e2
SHA512 d7955e87b9ba1563ad0c711b1fcdf76ffd29a9c02762af96b42d18cb90fffe4370c57b5fa2b00f8b4620d782a9d576c33dcacb97f27914417a05a672d173d249
SSDEEP 12288:ncZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:ncj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T12AC42371562B42E4FA39A330CA217183CE2D3EBBF3651D4E219F644559BDA1F8A50EF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 28d07f0e8ed357d90031a94a15615791581662f3fffe6e2fc477b722b6a4016b
MD5 1935bfb0acede3a9fd37c6c4f193cf5c
SHA1 9055332b4af4eb5e55ff6b0f66859e8208cea450
SHA512 404b07801dc24ad3875f19934562f66896a1a20792bba44e1b669ab630a34f4a85443f3c805da3ab26fb7f521b072844309fbaf5e6bd3dfedf667e0987676120
SSDEEP 24576:rZMRzFVSOUj9FWM170KLX1GbKIaFzErn2Jg:rZMRzfIj9Fl19CKIaFzErn4
TLSH
T1350501A5B35018F8EC77823ECD219906C6B27C6A5770CA0F03A836665F773614D3AFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 b3b093cbdcb205dd65125db4ebc1bb838aea87d9b20f1a6b83b247579e53d659
MD5 adb703304b9a6e0912c63211660d2d90
SHA1 fdfe3694578e277a46262dde8bb41a499f3486f4
SHA512 f00572f72775bcd5d620db2bc0221dfed8745f1fe14c947d41f7c278d5b3a2ff0e7c967b51a4d49b02cc352e1a0682a4fa8c2c682e27c132c128a7e5def18d1e
SSDEEP 12288:vdZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:vdj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T177C42371562B81E8FA39A330CA217183CE2D3EBBF3611E4E119F6445597DA1F8A51EF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 970eb036f50fc3565d82077a7701ee20384fad886ef23aa59db84c6dbdf12ee5
MD5 65f6531a93fd2e25c5944fbbdf13f3e6
SHA1 4dd18f11442f56cb32004f902d5cdbe7a29aaf9a
SHA512 908985c3966d6ed29de56744c968c6dac0a87176850ed10b68be069b1fb721ad2d90b90ff3b4ba8df1a5e25b5104c5a1fb47b4f5b435273f8a72f150d64a9c47
SSDEEP 12288:G5Z52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:G5j9FWM170KLX1GbKIaFzErn2Jg
TLSH
T17FC42371562B41E8FA3963308A217183CE2D3FBBF3611E4E119F6445597DA1F8A91EF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 5d4f5742d9d35695b4d4d1e6017015130ccb7a59f86ece6544534216bd97421e
MD5 2514c9815538a0eadca0be2c5c36df39
SHA1 ba75076d26af57d6bef878a4e51659a5e51f1ec3
SHA512 d772b9dc5cb0c481a3117510b17171a1095b154307db1fbd65055eae17f1ca3b8136a0a33718a6e34ddd8a4993994ea5344ec7c3b83afa2ed08b6435baf365d7
SSDEEP 12288:eyPz5L8QZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:DzyQj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T12CF41253736630F8E5369234CD621A02E776783757308E9F13A446762E376A68E3AF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 4c7c2664cdeb8f37d63a21da87cb9e570f58ee4ae1cd666ed318797631894a60
MD5 1db34c66553e371522a424acc72d2073
SHA1 b4d784274534de78db4e69f6599aeae03ba5dea0
SHA512 75b75641e436e6c0103f9137569f85d5c07a2ac9aeaad67f11e2700ceda1d9fc132759f419f01b3f5c5cd7f33383d1190b5140f650bf995f4fa125136cedb25c
SSDEEP 12288:tdZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:tdj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T1B0C42371562B81E8FA39A330CA217183CE2D3EBBF3611E4E119F6445597DA1F8A51EF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 cb12a2c30fcce253fb86c36d7d743257f5799157e442f2d72fe3b6162196a8b4
MD5 5b65e8c6691f05845687e3a0ec19c6b3
SHA1 5409620a1989c7a4c6833c8c6f450d5b10520e40
SHA512 6fddba7e1fa094f53f5f8bfc7c8dee63555633edcfc4a314d0bf202a2d511cbb6f71565c0e4752be54b51d699643ff962440aeace95d87a7bf9ef917e913bf2d
SSDEEP 12288:ldZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:ldj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T1EDC42371562B81E8FA39A330CA217183CE2D3EBBF3611E4E119F6445597DA1F8A51EF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 5004e0a02ec7ed7831981e62b9d3f29a354318f2c089a25cbb7d97f1fbcaed58
MD5 50211b4debed8b8d5734971b60757c83
SHA1 5afd0c13c71a0ff2c57c5f7d998a6922c186ad86
SHA512 014a0f90ef6960fc090fdb217078419059a66edcaea637cf2623ca4fae3678f0b288a589523a51579d9b5d24954608ab647041dae712bcbf38899af71bacdd0c
SSDEEP 12288:ayPz5L8QZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:HzyQj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T1E8F41253736630F8E5369234CD621A02E776783757308E9F13A446762E376A68E3AF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 6231abd7d78dad273c304ffc9e04f040d4616db60daa4b8577070f46963fb6ee
MD5 782e9b9dfe557eba111d172792d2833f
SHA1 3a1209420b604bc7c87d38ebf7eedf56b14a3f8a
SHA512 5072f3697a78766afe66ac4fd67b9ce0c0894cf4e163cfa03a7f1f16cfafd83052dca11ddce3bd2a6300237d5459c85d73814ff9bee683f9b82c278e5dedd3f6
SSDEEP 24576:gTDaLl3z0zD+j9FWM170KLX1GbKIaFzErn2Jg:gTuLljvj9Fl19CKIaFzErn4
TLSH
T1970501A4B35018F8ED77823ECD219906C6B27C6A5770CA1F03A836665F373614D3AFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 f6a1a25690a3e0e5b028445c2e9286660f03af4afdbad6cbe0edd971d35b9993
MD5 fd12ebfa9bd5707b6dfd351c1683a1f5
SHA1 9bff8448c4914c598c9280d9b6957f269242c167
SHA512 b5897830198d15b53409dadee73838860b6f00a4b3bcb53c66eb9a4e1ee326d7332a4059d34a7142a9131aa928bdb663de4857ce34fa032b9d90bfc54b8c83b0
SSDEEP 24576:63vd9CHKy7GZSj9FWM170KLX1GbKIaFzErn2Jg:cvd9CHKyaIj9Fl19CKIaFzErn4
TLSH
T11625CF90F3E410E8F1779A35C9725512CA767CAA5B31DE8F03A8255A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 4660fa375d9225f8db9c2d26f7a1d707888ba72feef180ba26b44ff088bdef97
MD5 8f964b4b3b51379f6aca4641c837aabe
SHA1 c9ab03bb2b0644d2bb4a60bf278f33bd63e8a977
SHA512 47762de8ed14da436addec0831fca388429cfdad624f7f7dd08e183d8086d9bcf28d6f1453805229c1c1f070902bd3a824a7eea1dab7dc992581d6e207f335c5
SSDEEP 12288:OuZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:Ouj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T11BC42371562B81E8FA39A330CA217183CE2E3EBBF3611D4E119F6445597DA1F8A51EF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 2f1e69458b19f5a5c2d77c76e473f6a757e0444e807c2d28da5a6b962c44c147
MD5 42a6b287f6c9f7f0ff9cea16a124e528
SHA1 d2674f2feb3017c9ee9be6fc00e0daa518345905
SHA512 103f6466108a4b39309c0381d9b88d09db12d5f3f4ebbcfcfbc74d9933fb5a5df73e655841e5a2da986a786edf6f12c704c769fa95d8355259f84501950d712d
SSDEEP 12288:swZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:swj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T196C42371572B41F8FA39A3318A616183CE2D3EBBF3211E4E219F644159BD91F8A51EF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 253ed79ace381e18d1b3659da9d61cdc5271710068332c305f06e622af169ac6
MD5 2f993d24a695d5a946e2aeda533e4df8
SHA1 3b2f9a2dcab17b045262c6dbe7ca1e06237e9f31
SHA512 3434f28ed7b4ec16fc3e82913fe0fb85807d5024a6d5caa81d74ddfb4fe17057439a3448e9f47cd37ffeb8dc01cf3aeb32d2423e8754e0cc1bf14b84b6565720
SSDEEP 12288:2XZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:2Xj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T173C42371562B81E8FA39A330CA213183CE2D3EBBF3611D4E219F6445597DA1F8A51EF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 67f5bde1327014bac04072c4a1c74bf3aabdc8f385dc9898a1a3821ada27a4ad
MD5 647c3b33aa960988e92d89a2f3ad811b
SHA1 c80744f044b2e43646c57dbc83f913f7254f3f6e
SHA512 87c7c0a04b561999a0c04179c6b12bef4619fb2f89c068ea3b99386d150bf82fcb6b96d175eab0e7ad7e17cc51e3b1b875ac5f1100e222b94da5e99b69bd1458
SSDEEP 12288:7dZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:7dj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T1D6C42371562B41E8FA39A330CA217183CE2D3EBBF3611E4E219F6445597DA1F8A51EF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 a05ca4a3f64d2d9a8d0d1d6350e389cac35060f2347b2f05149c3f022232994d
MD5 8fec570c512d17dbbf6b575c4326c3ec
SHA1 e281e162761ac1c87491af9e75a2ced8c86ac6de
SHA512 0c240c3f76e87350094bf55b7d0b675f5b626274c84f3f408c726cf99e7c97a8eef594b86c0aa4a223667a420386d5640950afdd10bfbabb9f003b57e0d72f97
SSDEEP 12288:nuZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:nuj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T1ADC42371562B81E8FA39A330CA213183CE2D3EBBF3611D4E119F6445597DA1F8A51EF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 197a5c5d0fe40378061554a5f0f76b21c9892598ff26a9231156c1500cbeef18
MD5 c151416cd002727e16a2e308ca4a5e14
SHA1 2e5e1eeda9c2725c401b799820e12640ab0202e3
SHA512 337db80f474d0c047c715631d39d4d7607f26689da0f399140fe0ca70b961405ef33b23f453f25179a1427e8f4831c6ab8724a3b49609efb5e54cbb386fbc3f5
SSDEEP 12288:dFZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:dFj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T107C423715A2B41E8FA39A330CA613183CE2D3FBBF3611E4E119F6445597CA1F8A51EB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 d72b4f75b7ba9404db05277f6b41fca462aab24b4f4033d931036e1a4e1df8c3
MD5 e23f363dc323fc914b8b9b63f32cffdc
SHA1 958b6a663f55bc2360b8e87de41c0a82b4f94e84
SHA512 947fd09c259b3614ce9f069dc650c25e59d03086a9b41f701e5f57e759a510af3b0247dee40b277b9f62a927254e46f46e11a44a5a2f8232266c129017d3a091
SSDEEP 12288:0DZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:0Dj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T19CC42371562B81E4FA39A330CA213183CE2E3EBBF3651D4E119F6445597DA1F8A91EF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 9777aeefefd91c8b2ec35d47d220e9eab44aac74c67cf235f37e75fe4bae2b9f
MD5 b4b5872dc83496e8a306813d2e9c231b
SHA1 d3f30c61aa9b61c3a039ad17f4ff23944d092a0c
SHA512 921e9d838f6e283ce3ac1b771d0966eda47328d1d0386c69d417e4e0b5a0a101f2137735ade92faf8f226a68ec9ba68d73ecae79e2dddb88c6479f02f1c19289
SSDEEP 24576:RfwvUk9RX6wkyAIJj9FWM170KLX1GbKIaFzErn2Jg:LMnYIJj9Fl19CKIaFzErn4
TLSH
T1FC35D029EBDC44E5E177923C89B3460AF6B178691B31C6CF029A53AD0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3452233d3e7492614571e638f4e058d5d9ad1df52c49696b93fbe791d3428cf2
MD5 a4582faf1249cc1b6070e8ceac2f8cd6
SHA1 6ea337a42cee2c033714b4010625dcda64c1b817
SHA512 dc2cdd7fcb91ea987ff4012a2cc48b8f6448472f867d50a49b2042ceb678a7ee1ef70de03f21f278b430becfb5442ca8330b9bb83481c92321942fd1321d0c87
SSDEEP 49152:GYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK06j9Fl19CKIaFr:FySzPc9n19ChaFQ4
TLSH
T179066C96A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 199d157a6e3c3ddf20f09453d07af5058f54bba9e1509816cdaa8a0191ce98d2
MD5 bfe47773f26af8c93147462cc6ddc742
SHA1 b39e07ec15e4880b4ede403eb0b90a72ec1807e0
SHA512 f20dbbe478aa29ce9790a7af18975e87b8824a928dc11a0494d8813262ca209b4c08dd583ecaf143196a4933a77775c2fa6d0e775ff77bfa3c8f720c38d8e445
SSDEEP 24576:T47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYkj9FWM170KLX1GbKIaFzErn2Jg:T47JUQjTirIhCnDHUPfF/Kj9Fl19CKIW
TLSH
T1D565AE1DA3EC01E5E17A927885154A5AEA71782E5B31CACF1270837D6F23ED48F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 ab07cc5e1557bc6d5887998fadac88f2d9e99638166ab195149f1b590392418c
MD5 5f8556c581d053af4ead198235035ed4
SHA1 df10ce3f446d0df4e44c44237931c287567ada28
SHA512 cffe0bcf6254eb6077f47dd9ca3f0cc4258ca7f3168f8bfabe02126ac2f6a6bdb54a0f74a9b58d42d80ab4a42930d81742f8a7c0fa66a82a5f8d93845923d749
SSDEEP 12288:XbsfNZ52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:qNj9FWM170KLX1GbKIaFzErn2Jg
TLSH
T11DE4011AD25802E8D02E6235CB525642F7373C66A3E197CF12C0F43E1F7A6958EE6B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 1bce1ef87a60b11d3c5a0f3ec3ad1c716bf43192390161c288c10dbb884b7d0c
MD5 6b323dd1cd703a1c9f1a1bfeb04c907a
SHA1 00a92a6fb0abd29d4e356943ddaab2c432779b8d
SHA512 9558aaf3ecb8942ffeb2d34ef424b5af153e5baf8f7ce05c32829b6fbb25f03c6eaf586d1e2878e5ad8c3d927735d879a9596eee3597a53ad68327456ef7ca07
SSDEEP 12288:XkEddU3f7J75tHyRPdhjORGV+CsBMUIbA71yKZvka:XkE7UP9jynVzsBMDbeycvk
TLSH
T1E8552741762AC69FC6A940321E36D6CCA7707D01FE056F0773C9873F9476668BAF6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 596f1d1841850c030f630fe3f0bb93fa50faeb84c30752418be70e1711048ff5
MD5 60544249085fd204c4afc917c8926134
SHA1 0e732d3468abe9617434732787908aadeef3c215
SHA512 27260166600fa01ce28e90e78066146ad22cd522cf5c5320eb5f941a56be5751b482310ab6023ec2543414f54a48039d384b24910b69c986a8d266f74681c705
SSDEEP 12288:ZC4aF15zA3QScwz5QIXXRyo3TlTGQ7Kop+jPc0zFhOVEjr:ZC4IHMgdeymTGQ7Kg+j0wFMVWr
TLSH
T13D552A00A5A7E35FC9FE5037463286CDAB746C02BB453B0673848E38987757EB5E2792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 279b0ba204b636d896b65d08ed6c660ab63d91ec80260de3ebb3c96bd1eb2e95
MD5 3249e46de93d8cabd03ef0e681ba74c4
SHA1 824d30502893bc574137ad089acbc1c15a5bbbc5
SHA512 6b41b08352d37c53a0b96c4112f722fa8fd591201ebfab9b8f67cdc5459583df49315ecda37884e24a94b8b2cbb120d692397ef520239f074dabbafb40d412cd
SSDEEP 12288:yF71Z52OFW61fv9HfmwPMKM4qJUjTX16hbxs7krmFnzEUrHe/nTNAvBg:u1j9FWM170KLX1GbKIaFzErn2Jg
TLSH
T1E4D42371572E85E4FA3963308961A1038A2E7E7BF7105DCF604A6585587CE8BCEB0FB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7f8c474ba0b734d7c990b5fe300c5d0856917e5672b2f97c281e30a12fbfd3fe
MD5 ecafba2c5d30e82a9b28bf1e22bb3115
SHA1 c636f03f6cbedb067a55d3f8fe057493e219dc29
SHA512 9de08645cbc682f4504fda8a4c4d973e407e8a07031f55044cdb7154b23348d74880ff4704f1c386f97ec4717cf2183d7cf9595baf9b1f9c7944e15c2104183a
SSDEEP 24576:Xgb6bmBIi49WNNFpg1rSvFv7bYvj9FWM170KLX1GbKIaFzErn2Jg:Xgb4mBIBhGFkj9Fl19CKIaFzErn4
TLSH
T1E165AE1E22EC02F5E0FAE2B8CDA64417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 0f29b11c4cb33920f33b73784f169a63ea80cc5189df56e6d2ab1ee2de2349dc
MD5 38cfa3670f0bd585bbe428d9c7fb38c1
SHA1 dfc4670da9ec1551de6bf437682e161ab8fa2a7b
SHA512 a990eb9a15887380efe6fa7aa7abce6eb7db089b37bdc89e5ef17000efa80de522ff487da705d6c9acf0fa20942412a6c0ebac32a735d4c5483ac0c404668c78
SSDEEP 24576:kG88u8FpJqH1bzria7/mUj9FWM170KLX1GbKIaFzErn2Jg:X7ZFPqVea7/3j9Fl19CKIaFzErn4
TLSH
T1DB35F16167E101F0D47BD13889824663F6B2B8261364EFDF06AC8A551F33AE54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ac81abf51f1f81fc21a3910152c72d7583a38568248aed62e1334be7dac56639
MD5 47141b93ec0661e9c09e151365d0b74b
SHA1 11ad91ae3e940747a9085c21e7aefd2f0aacf995
SHA512 50d1da251d60f007a790dcfdcd4647dcd19f69291e9f1927bc73c21004f684956ac06231b282d69e7d604f9be46df593de36739fc803d5a7df9bbbe706788ee6
SSDEEP 49152:lBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4j9Fl19CKIaFzErn4:uG05lO43bB9n19ChaFQ4
TLSH
T168D5C06A62EC11F8D1BBD17CDAC6460BEBB23425033556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0471068642707dc241b0789bf558ec1d70bb0e7d7dfd1cd44a5b62d8cd47985f
MD5 106631ffa2fefec61dd1df3e304c5628
SHA1 ed737d00e35d0c523bf541d1781fe7d105709286
SHA512 1d476d00b86969f67f78d2602424589359e3768f3668413627bd7cefe4eb574efcbe4fabacf85e1f505d219a94e432e6bc681e883b81ac768d7d89a2d262d213
SSDEEP 24576:Xfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn6j9FWM170KLX1GbKIaFzErn2Jg:va5POZ3BJt2pasx2+mwj9Fl19CKIaFzH
TLSH
T11F65AF5EA6FC01D5E579D17DC583460AE5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c6a5017b0e390ac45294de2316cbcf3d0a92bbc3ac2456e59ad5117a3d05a915
MD5 377b935ec6505809ab8bcf17de13a5a4
SHA1 105972d4fb9c7d220c111015820da2adc0a529af
SHA512 25fa46ee93b0ea5cde22280bba8e128202fd7c41720b5aff4a25f404fc057537539bea32d75a5b3fe472b3dcc2707730ff8c2382369e3ac733e4e69071adad39
SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7FkMj9FWM170KLX1GbKIaFzErn2Jg:PNc/zEOVHFXj9Fl19CKIaFzErn4
TLSH
T1D7858B2623E901E4F5BBE1BE89779546FA71786953308ACF0291811B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6033b874c5ab9577c71a73c0601385dbe043dfcf3a4f5faea99bbfd7fa7905de
MD5 2cf7154dc3aa44dbfa71656da90d3277
SHA1 85b529ebe4f761256e89e95f9e2b5b38c3329100
SHA512 9fc343d0c7063c97b5ef87ae84208ffc32d41aaaa42b122b68f04bcc7b5495911e64589433d1ccb285446719a2b4fcbed463b7c08223734f0333a1d4a223e1f8
SSDEEP 24576:TTkNvNnaFeYhJNtmZBm7j9FWM170KLX1GbKIaFzErn2Jg:TTMwBtOm7j9Fl19CKIaFzErn4
TLSH
T1A555AF2EBAB846E4D1FEC674CD238512EA727461173293CB5290C13F0E679D89E76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 2654b914cefb8d868ec440b88a9bcda82d8e9e633fbcf97b23f7f83054c3c14e
MD5 ccfc44f7f19fe6a8709bc352f447b858
SHA1 a8f17cffd21414245a2039c676225cd2e7ed88cb
SHA512 1d130c9dcd5d951c783d9a61bafb100b7364ff1f20f0885d4347a7d07628a8758bebf7f9e599bfa1842110d0a2047a780eea3e837d18c238407128f6b930f5aa
SSDEEP 24576:KPUr+NQIj9FWM170KLX1GbKIaFzErn2Jg:KJQIj9Fl19CKIaFzErn4
TLSH
T13F05F22F22AD18E4F67AE13D89424709E7717862531196CF02D1817E5F77EE8AD39F20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 0fa9a5d70969c917a8db8ca61dc48975a05a193ed944c89181ad41a3ae0fde8c
MD5 9e58b902700760d8dcdb9fe11e0f9331
SHA1 0c0a0d9d97435e343bbe986705d5b405a9b57cc7
SHA512 54d9093b1da2ef24d8a4f885c47019d1a3acf170e5ff7e8ea62b53df6535367e5e718eda5ceae2834a7c5543df6bb474bf7269ac78cabcfb64e480d8055aca1f
SSDEEP 24576:5D3FHshBIYQgAhj9FWM170KLX1GbKIaFzErn2Jg:5DVHeBIAAhj9Fl19CKIaFzErn4
TLSH
T1F625E17DE75D00E4E57BD27CCA638606E77138A903226ACB02D481B61F6BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1432-49-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/1432-51-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1432-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1432-45-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/1432-46-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/1432-39-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/1448-82-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1448-83-0x00000000006A0000-0x0000000000706000-memory.dmp

Download

memory/1448-313-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1448-88-0x00000000006A0000-0x0000000000706000-memory.dmp

Download

memory/1828-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1828-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1828-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1828-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2584-298-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2584-58-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2584-67-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/2584-60-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/4028-130-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4028-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4028-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4028-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4172-132-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4172-138-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4172-140-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4172-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4172-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4248-13-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4248-20-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4248-92-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4248-21-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4248-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4336-100-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4336-333-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4336-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4336-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4336-94-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4336-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4648-117-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4648-125-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4648-119-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4648-316-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5532-112-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/5532-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5532-317-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/5532-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5532-106-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/5532-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5564-1-0x0000000000600000-0x0000000000666000-memory.dmp

Download

memory/5564-0-0x0000000000400000-0x00000000004A1000-memory.dmp

Download

memory/5564-57-0x0000000000400000-0x00000000004A1000-memory.dmp

Download

memory/5564-7-0x0000000000600000-0x0000000000666000-memory.dmp

Download

memory/5564-6-0x0000000000600000-0x0000000000666000-memory.dmp

Download

memory/6108-312-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6108-70-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6108-72-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/6108-78-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download