412c579ca72a87e107d3248af20f3ebe3d021d976a34e1f2b666c08bf37061b9

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 23:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_7a474a54c2016da2404bb35451ed1150_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 1.3MB
Sample260809-3xd6za1vd1
SHA256 412c579ca72a87e107d3248af20f3ebe3d021d976a34e1f2b666c08bf37061b9
MD5 7a474a54c2016da2404bb35451ed1150
SHA1 d76710660699812c2e244ebf1a4e594c65f9cb11
SHA512 707d3d1c6484c872aecd2dca590d20b9c89cb68b753ca2f13fbeac051a2b5fc2239db92dfea4246449f6c751c87c7e0919b7f01db459a2a67de394673e507755
SSDEEP 12288:x1iyAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:yyAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1C25523177488F0BBDC67D4360C77D2F4979A7C7843859197398A27AF6F3A184C1A8E28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2452	elevation_service.exe
5900	elevation_service.exe
3924	maintenanceservice.exe
1608	OSE.EXE
4756	PerceptionSimulationService.exe
3804	perfhost.exe
3188	ReFsDedupSvc.exe
880	SensorDataService.exe
4420	ssh-agent.exe
4408	AgentService.exe
1500	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_7a474a54c2016da2404bb35451ed1150_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_7a474a54c2016da2404bb35451ed1150_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_7a474a54c2016da2404bb35451ed1150_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_7a474a54c2016da2404bb35451ed1150_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_7a474a54c2016da2404bb35451ed1150_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\55536fc6b05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_7a474a54c2016da2404bb35451ed1150_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_7a474a54c2016da2404bb35451ed1150_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_7a474a54c2016da2404bb35451ed1150_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000002f5184c5a28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c4b6e4a5a28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2452	elevation_service.exe
2452	elevation_service.exe
2452	elevation_service.exe
2452	elevation_service.exe
2452	elevation_service.exe
2452	elevation_service.exe
2452	elevation_service.exe
5900	elevation_service.exe
5900	elevation_service.exe
5900	elevation_service.exe
5900	elevation_service.exe
5900	elevation_service.exe
5900	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5932	2026-08-09_7a474a54c2016da2404bb35451ed1150_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Token: SeTakeOwnershipPrivilege	2452	elevation_service.exe
Token: SeBackupPrivilege	3188	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3188	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3188	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3188	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3188	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3188	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3188	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3188	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3188	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3188	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4408	AgentService.exe
Token: 33	1500	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1500	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1500	SearchIndexer.exe
Token: SeDebugPrivilege	2452	elevation_service.exe
Token: SeDebugPrivilege	5900	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 4792	1500	SearchIndexer.exe	100
PID 1500 wrote to memory of 1168	1500	SearchIndexer.exe	101
PID 1500 wrote to memory of 4212	1500	SearchIndexer.exe	102
PID 1500 wrote to memory of 1316	1500	SearchIndexer.exe	103
PID 1500 wrote to memory of 3936	1500	SearchIndexer.exe	105
PID 1500 wrote to memory of 5888	1500	SearchIndexer.exe	106
PID 1500 wrote to memory of 4700	1500	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-09_7a474a54c2016da2404bb35451ed1150_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_7a474a54c2016da2404bb35451ed1150_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5932

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5900

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3924

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1608

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4756

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3804

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3188

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:880

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4420

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4408

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4792
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1168
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4212
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2980 2988 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1316
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3936
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5888
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2980 2988 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 df5b0f7e19cb593f876a2de50618db2d8b0f698c403fcf8ec8eb7aab13d2d897
MD5 979f2790880b805075a419a11d2415de
SHA1 956dfd3914265dbead466d7dd1ee3aaa3fd7fddf
SHA512 8f0320ed27e1a1c6622827fa363bb3e16f109be34784903303490d5acf51d5c164fbcdb63b49427828567f8a6e0273ebbbdad2a0e8fdbbf344048004e97afa72
SSDEEP 49152:qb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnxAQgAT76sQuE:c3q6sjBRqGsQr
TLSH
T1CDD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 b01c9ab29f0f79fbe7cb7568344108811588fa8ebf88d0324c1104f4c5073724
MD5 5670209415c90cf19aa5fdd764c8d09f
SHA1 1229f0c1048387d18a935a69d12159d3ee3017f1
SHA512 b3c7534d21146d332da3b55e68b6cafb4276f6382fa762ddd01c454fba84ca44e40ea482226b50ad290cfb8a03172457d0ac932e48464c17b27873a9dcc9ec27
SSDEEP 24576:gXYfDtczAQAfYLH8AcevDN0FImbwQuq3Wia7gD:Xtc3AQgAT76sQuE
TLSH
T1C475F12963D408F9EC67813DCCB28521E673B8954360E7DB03A49A6A1F332D85E7EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 7a395fd7ea3c3100ccc9f3735ae811775e59519acca23b9ae88604a375593033
MD5 4db3fde819522e23d55a3048cb4d78fa
SHA1 a6509f75b4fbe66240dfae06cfbc4d80031d78f2
SHA512 f81009766cc9ee1e95b76a8e6ccc4c636679885ff9385cc8449b8d84f60c3158bdb3b3b5b0539407ad815c56ca66d310738db3f0812c9bbd6878cae1a40f4e56
SSDEEP 24576:l0Le5ji0hmxxrMMAfYLH8AcevDN0FImbwQuq3Wia7gD:lPji0AjzAQgAT76sQuE
TLSH
T10B85AE16F6748335D073C0B9C5D2A69EEA71308657308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e0f8063c2cc285152915e05d509803a760a97a0a54cfd7d83aab29558363912a
MD5 9ca47ebd781dad7610aa8f84c8945520
SHA1 82dd0f46bb5c676f2066f36de82f81b47a5a10f4
SHA512 f9ea894278e3af1e514a19670391c49bda28e0fdd2faa8f3ed036033d7fe923290b862ecba4bcc9693df0c9ad9fd2fe9c157a3f582954c66772af590a716ac0c
SSDEEP 24576:ma7/ezSC6vUyD/aqgrvWn6q8wyu2AfYLH8AcevDN0FImbwQuq3Wia7gD:x/ezSC6vUzPveHjyfAQgAT76sQuE
TLSH
T121755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b2ac4ad97c269ee78054049cdf1a9953029c0bdb7c2c59f83e1caf9545656069
MD5 986ce8683fca592a4ff21184972c10cf
SHA1 5cddb2d2be6685238d1f926e58fb767c2c51bbce
SHA512 53691b1d58778121da5f9cdac54249eea6ccd8a102245d989005aaa38fa0aec1f5dec4eb8672f8f1041662c4a93e2ac8023232de5d800cce26a7a202875ab7ac
SSDEEP 24576:6VbqPb88hv/l+YRAfYLH8AcevDN0FImbwQuq3Wia7gD:6VO88hXl+eAQgAT76sQuE
TLSH
T171559E66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C3E676E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2d791c932a95199046ab32fef6893abc34c01327475921641df9260a4924c324
MD5 7727e9b235522bd878ec4f2b07edbf99
SHA1 78f3ec59973a2fab2edde8d82c2e33bd73d41cf2
SHA512 dd7142ae4a819cf75833c54f5a0fa24c9f0b36a7d28794d3b15b4cdf8d5c532b65dcbf8e5453d6e71cfaf0bfe49a45427c96fd7dfb1a8a5d83fa382bd4f6860b
SSDEEP 12288:fLQAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:fLQAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T11D55235B864C30EAFEBBD1369CBBA5B963D1BCBC8245979604063BCA793D408D1E4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 8c5cef6fa24c2612c10bd22e1c790945fa967647c54e03ea9a52bc5389ff71ed
MD5 04540c15c0c6b6ba40e307b404d7ad7d
SHA1 6d421e8ed8fa63c65532ed349eae179c1bed905e
SHA512 e5bc39a861e5c046c5ecf824d2f137280e36fdc3fca2afbfa5552fb06733bd7e2a8bdc8913066e454378e43f2221f2bb19945b9bf2ede3d228daa44021315796
SSDEEP 24576:+JIUpAfYLH8AcevDN0FImbwQuq3Wia7gD:+JIUpAQgAT76sQuE
TLSH
T1F675CF3BEE28FCE2C67E8D795A918600D7B278704B51A3CBD165830EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8a9706a8e63105999787f00a62ba78499eee7be62733150b4ae28407f2f05b87
MD5 2d3d6e36ba212fdfbfd1a2c6a30bc2e5
SHA1 3c5f7b2d4d6d24a3810b09fe007edaed2fb986d5
SHA512 49c901bb54cf805bcbd60f3c410f5255a7f27e6aa81ee3811ee821f1fbee43df15ea87384a63ca5844b52edafe253378f9eb3678c89044d655d89ed2bbb8a097
SSDEEP 49152:NQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THS:NQvGAdlCEL8c/DRNw5CfqGsQr
TLSH
T1E6266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 1ad9374d1fd8ff79db1c0601c073561ab0eb0b92ed315835af2b779819aabf7e
MD5 b7204cf09342688b6087a4bc235dd2e1
SHA1 c729acd2a104e7471a2e6dffb72507a8071e3f25
SHA512 e7b8dc4271b6ca6e112d95e560181cef1db7450a061f2c5c1258853db41e7bdebf8ae7d935cad82b44cbc360e7c47b331a605a4537b1580ca90cc1c58fbbd044
SSDEEP 24576:10ewsAjDAfYLH8AcevDN0FImbwQuq3Wia7gD:OljDAQgAT76sQuE
TLSH
T18975E031FE74E036C6BF0DB21B36C716146CB9604B511AC3E3A85E9E59342D263B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f2b01669d3d74128961a3ba94e740fc9ace68257c884694d84bd437c1234e106
MD5 207ee74959e76daab2e6f251dcf14302
SHA1 a33388c5f7c0db4d6eefe1151fc591d8df7e688a
SHA512 0533fecb6e43e348568f780abc77ce22d5d274bb14e7401b84f6d5dd8f1db9505ce2837228118f9c6f7cd5c5060ff3b410018d3337c820bf827f55d4ecfee92f
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHij:kUEtQevvqc2W1cpV2tI32
TLSH
T153474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1952a39cd6d7c94c55f41858eeed63eb41c992452e6766b304285241c2b4e4c7
MD5 f43001d68b3e0f7dbf38aea616fe5863
SHA1 4e69c2d94586bf9b5029bbe3c88aba3228a10696
SHA512 0b55f7c0a56d9af9b4353b555aa4bce363f739102b870eef92c6a6578d0941acc6f81cb5ce0e11ce6e4f6e768c08e88fadf21c2d73e6c3868d1efe87640fa1ed
SSDEEP 49152:kCbRquA/m2yL5zTfFiV+XenmE3/zjAQgAT76sQuE:toquVjnmrqGsQr
TLSH
T1E2D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 19925cc7f5f027398795d1c70109da3ff097e363abb0bc8fc7c05d7685d2b63e
MD5 6abf18fb0036bf220f50476da79276c4
SHA1 162d6fd3b4e88893bfa8597416cfbcc5d1897959
SHA512 7364eeb354e3b30d4ccdbd5128008475f5c4a43649899dcb74038c3fb320b114524f568056ce40c76449f024da18f5e3c1dbe8328857ba73b7b533dabef8c63e
SSDEEP 24576:IAhGL3IFoiwtA5l7S53SAfYLH8AcevDN0FImbwQuq3Wia7gD:IAMUFoiq5CAQgAT76sQuE
TLSH
T1E5359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D20F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 13f0ca15e7eefee8988e2348f403107b7e15fd9355c5963e1c6792e84cfaf122
MD5 874467080b28f28004674330fcc2e442
SHA1 3155f4739f6b331c6d62ffa86107a2b2c4f132c5
SHA512 18c92f1216f829fbd19814e76834a7415150448b8cb23ceb92898e6b6ff17e15d410b523ad686b7b401800fe09ab6ef522106cb378c2cc930b923ed4257b2a2b
SSDEEP 24576:Zwu4OWeAfYLH8AcevDN0FImbwQuq3Wia7gD:ZwvOPAQgAT76sQuE
TLSH
T15365F14A76A81CF9E9A781398597C136F7F2BC152A21D71F0360C75B6F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a832a88d3c712411c37f6ef39c21b613df7c5d195d251e545e83856778faba3d
MD5 84226a21b29ebb64df1fa0078cfe4b9e
SHA1 c7ae04c65010642eee8c9e71fcb7a96c3cce310d
SHA512 9165b4bf86192949a782630e0b0a2b7fb025bb96185228106743f97f7a82b3550cdadb6dcb6a12be8fa832ae03e31073d487467181fd4907d434c9720bbc6d1c
SSDEEP 24576:1ZuEAfYLH8AcevDN0FImbwQuq3Wia7gD:lAQgAT76sQuE
TLSH
T19655125B239830FAE5A7C239CCF25655E3B278A6532283CF0115079A2F37AC59D79B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8d042d8dc8c10f55661e068bdcfd98c469d856403c52d161541f27c48a938f14
MD5 1ee53a4dd1314e0c3df5fac322f6f03a
SHA1 54adfc31bdfedce6c6063f3a65cd59e1e3ffd799
SHA512 a92a24c1cacf304e29895565acf59c0268b05bfb059d90b0f658df75ebfdee93621c2f154788c0920f87da1f2d9f9b9512327e70dfc86d31d5e2bdc6c5fa426f
SSDEEP 49152:uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UW:dQRQyi36YOcPbLvw2gAf+PN3uqGsQr
TLSH
T1E1667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1d70b1eee9eefc1a13dd347a00d21eb3b4daafb81a804675cac91fbc9b4bbd6f
MD5 e29883b2f4677c4ec23a621d85b86b05
SHA1 53b62285e9ec6e5bcd30a9ec6d1790417e0c2542
SHA512 57da500bb1e6c57609ffde5cc241c7ed85a4bb6a0c860e24a23d5a586024f767ebd65cccac28c8c3cae9741d167216caed0470b427fa95753ed2905697a8685e
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UW:kQRQyi36YOcPbLvw2gAf+PN3uqGsQr
TLSH
T17E667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fc3c437008f23cb1dd02814747d2f45d8b95d8388ca8a0e248dad51064dfa974
MD5 9e4dcf6f430b286273451ba0da170ec5
SHA1 d775943a1b130382a5b922b4d3d4f2bcd090aa2b
SHA512 7c42c78155fb376e46753f874e7cf1618bebea4bfb45cfe1929947f99d7426b27165792e3864f20d04606057859429d1cb089f0133b11bc2d26839e9a2613b54
SSDEEP 24576:ZwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL00AfYLH8AcevDN0Z:F68Qg55nhceWu7PNU3/zAQgAT76sQuE
TLSH
T1D0B54933B2F600A9C44DE1769F4A873196D17C758FE1E3DB8505720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 78f8a59dace03572f797edbe190202177081ef926eef8fffe436b2863e27e73e
MD5 bca2d90289cdb7ce4952808fb6a83227
SHA1 8e64d737874f8c12468ce9c86bc1423dc3dcdac0
SHA512 4a6f58dd5b5ebc9826b5f423654f00b2000003a365107dc7e0f3d4d1755ef8d6d8fc6d18b47a4438d61445e663628226d836b2b2074a1c499aa3f34bd40c04af
SSDEEP 49152:y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99o:Ty5112gYy5azzVvt69nLKnhZFqGsQr
TLSH
T1A7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 95938838eb3133e1e289cc17ef935e8ec80c7b40ed0ee49ad2b88cd2305f3a3a
MD5 d92de2d1073d73d4dff25c9e8a006d42
SHA1 430b83c5dc6359ffc4848e5c10b52179c6de8220
SHA512 dfecaf8672ea18c988bac5545328297fd9d5f3071bfc5fa72bbc94c78830320da2eb8f0ae607691c34392d608353f6fe3c791b8ab575d401f0f8715e4ae26fc7
SSDEEP 49152:7B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glAAQgAT76sQuE:tu6Jmdxd2dVqGsQr
TLSH
T125D59D13F1D901E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e0a1f93e30258765b8d51ba141edf5bcdb226873919b563eaf2c797f08676890
MD5 6d5393c06b92ec764368886aa4ccd6e7
SHA1 05ec642092784c1cdfef877d85757287ec571a8a
SHA512 d459e96675ac3a661a23edfb66a7f0d47a5bff2d4f59ff3c237c09727e50a982bc7df60c93c35e420d74785f913889a213403fb97d0483f785d1e9bfe2cf8ea8
SSDEEP 49152:c1hpsNoJpF1A63U44CwH7R4xJAQgAT76sQuE:cmifPWRrqGsQr
TLSH
T10EB5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A9077962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3bbacf3a167fdd4b062027e5d371aea199b78d34e5f2e57fcc9943dbab22f4ea
MD5 b7f78a9591877aa0ca7ad93fac4ec487
SHA1 113d44e6aca8134bcd0d8082d7c843330d2b3827
SHA512 5aed991b3da3848fe8a2096c503fc4e9864a9ddf51c112f505c944dbec47e65850bd74b3b9c9d1cb3a5e3cd18e5a9116d472f8d1b0d2ff30c31f8d6ae8e748c7
SSDEEP 49152:8SuZQIY0Be2KcRVtOnks6NMHqEAQgAT76sQuE:+5dKii61JqGsQr
TLSH
T194C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3134c1215e68ae81b0b3c7d35fcb88219cbabba3e33e1989d75a33b446c4ebc8
MD5 5b622959b812d632b067a4fede756b88
SHA1 2b30745a4ee8af8192343f0d85e8a4bce102d2c2
SHA512 7013e26f78ed10a7b27d1643bfc6f29aabdecb1ca51d98fd43cbd3c65e1e8c64d2efb8d0cf8da461b08f0906b7204b6f9bb4cce19287dd48f6a737b4820cac95
SSDEEP 49152:ShtSn8EApI0fig3giDn0AP5wtAQgAT76sQuE:TX2imphHqGsQr
TLSH
T1DD95BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1c949bf5c55409602022f029ab1631b367cbaf0d26e2e32b497452a9a4563ba0
MD5 860ba120eced854594c997c6633b9ad2
SHA1 aad397245f1f85612bc0224bfad790a6ba2968d1
SHA512 b784e2ad131e115411aeeb1acb1fabc86c2369724db7a42471536dbdff7ba13225760c634bd919a1af898f415f47c22f073272252f22fe2459e486a8b97e2cbd
SSDEEP 12288:woAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:woAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T12055235B594C30EFFCBAD1368CB7A1B9A3D07CBDD346939A110A268A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 4e799b3faca0b889865d147c9cc02a0f7b0ce3f06c39c7f11e664ba78af4f277
MD5 7e54fb031bf9bb451e5b7347945772f5
SHA1 57bd4a768be0a956e1678e6fd516e3f4e346860e
SHA512 11704c78dea12ea07cdea83c5d3b9f71cdd53f0ca2a6fb13fba29d0d85ece5a234fc0c459dd5e25bc5ac7f4485e8a2bc7b9af1cec3884910bd3f6f49b5ccd234
SSDEEP 12288:sHAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:sHAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1B355235B594C30EFFCBAD1328CB791B8A3D07CBED346939A150A2A867A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f1d600240cabc669527160dbc41cec701714fd3db180ad55018941a50f15117a
MD5 79a3fb029c4519d9bf629130402bc452
SHA1 0186d6f26fdba840e5ab28e4d31c66444cc6a0e4
SHA512 1e015cc38326b36ad9136db85fd57621a46946d1fa728903b6defd6663cd20288da33d766ff4dc60c62e35db7f83aa460dc72532a4116148138be669fd0741c2
SSDEEP 12288:9BAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:9BAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1BE55235B594C30EFFCBAD1368CB791B8A3D07CBED346939A150A2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 b7747b9ab5b3ca6e4486295b2c8151914b2bd99154a9d8ad69729684fba10951
MD5 17f26668d267a8636bf999fa49126c3a
SHA1 b304bc493b9060dbfb279375d84a6090b044ce15
SHA512 dbdc05a0158960d409cd305ec3504ff0acad8bdce9ce00181103de53b3e68139428fd2d3609508694500fb867cea20dab94818ceba2f949e910887e3dc5e6a36
SSDEEP 12288:QVyAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:JAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1A8552357169C20EAECBBD135CCB39175E3E1BCB9931293DF06011A8A2E3A24891F4E70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 6e2c8319fcd7df9ad6ea310ba854edda937987ef24366144ea7ba192c04b82b5
MD5 c706ea27ef567658f8d39daae573cb9e
SHA1 fb3ce8e5e3fac9cec915db8bae01eaa322943484
SHA512 96f12db4365cfec2b0d144d1b2e2dafe6b9ae52a307cb83a0458a3bd211458ba500371512a6e45c8460897c7df8adb53c949093735daa1121108ef6d1bb9394c
SSDEEP 12288:+aAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:+aAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1C655235B594C30EFFCBAD1368CB791F8A3D07CBE9346939A150A26897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f8dcd4969c89d076c558871dcd69fdb314e398eeb4f471499a2f859aec2de680
MD5 143a7382501a697ff6479d7e48aaab89
SHA1 a81443f4688d88143c8ae5ba289646aefe858e34
SHA512 d86ff7361f5a289d29b0cedc1d1a736e37f41aa97f9c1c83157140e14cb1415d7781c33cfa34d01962feca7035b5d0c089c5f3ffcf9beaa7bb14f6f458376242
SSDEEP 12288:2bAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:2bAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T11755235B594C30EFFCBAD1328CB791B8A3D07CBED346939A110A26867A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 a003b5ca817528346ecffc32579bbbec1eef98a71d3833c8ab02bb0662cd4cb2
MD5 b6bdf6386790146782d47b2187648382
SHA1 21688e5cc6cef73106e2c2a81a25d0742c76e5fa
SHA512 c9e51b9060d00e137e9d4829b930c28088fe7839b71f4d56bf0200f917b2ab09487d70c678c041512ab274ecfe954d641bdb073ffba1b79ee785c86fbfcfe7ac
SSDEEP 12288:8vAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:8vAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13455235B594C30EFFCBAC1368C7791B8A3D07CBED346939A150A2A867A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 cab20e2ae6e080c6db910997e97b056bf426ce606cb91dd8a2417d755ad07dce
MD5 4df867d116b6136cd7fe5bfc0305d5fe
SHA1 7565ef896b0b6e8d702d6a3ea820892ef7017425
SHA512 416b5b19fa688fc467c70438c416348541cfc2589f436e66ce4e3fd2a331c638989c1a021c2db639fa98e230c4b49abafe59b4e9c9956b7f200dbf4cf698ff30
SSDEEP 24576:iZMRzFVSOnAfYLH8AcevDN0FImbwQuq3Wia7gD:iZMRzfrAQgAT76sQuE
TLSH
T17F750195B39018F8EC67813ECC668916D2B27C6A0760C65F03A4366B6F373A15C3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b047cf722158d2091ea2f0b9534de5fc9ad9fd02f25bff9a6294e957a0bfd814
MD5 16b039efcb9c93f57116d529e13ec320
SHA1 71d6d4b649f157a64229dc31023f9df7d8e378dd
SHA512 797abe9a9cf52dfb44b98df1f29975b917093f8ce2faf1548485dbd4b2bdbf16dbdcb93f547b177e92f5707d2563d5eeffa0d954c33092464fdc526929a68d86
SSDEEP 12288:vUAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:vUAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17255235B554C30EFFCBAC1368CB791B8A3D47CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a8282884032ff08058dba74ea1b72062f2f4431bca185bebffe968e626895b00
MD5 3e5f83863384eac503553b40852bedc1
SHA1 ece852b8cc06a8a891c18ced48b5c15fa94dd987
SHA512 7c5bc7b2e596979622e6c45e6f3b1404991ea6859602ce34d7c9d3727b2bc2a81648a25df5c0af7fa13abcd212da072125fb4ece8722d48b015eedfdd88bf906
SSDEEP 12288:qgAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:qgAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T11655235B554C30EFFCBAC1368CB791B8A3D07CBE9346939A150E2A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 5bdc89d8d3541cb3dadc74feaa692e0649135f705bdc003845b08c52b5f4dbff
MD5 1cf223466358aa4153db1a590d2425ef
SHA1 6fbaaaca4f03758a2d7b0d2d51c0259eb4f2779b
SHA512 1f61654a6890caa1cf11fba9e8456d5d94b63face9780c7d8591ea5eea38da6ec5f6a1aad4082b2e0617a1df2d42a497669dfde3f0d0ddc436878d63ec2ce12e
SSDEEP 24576:lzyTAfYLH8AcevDN0FImbwQuq3Wia7gD:luAQgAT76sQuE
TLSH
T1A365020763A530F9E577C239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ea3f7ecc1ac481c65020e04f3a0cd335ead38439a613f2ed882f1b2a0703112d
MD5 97ed37c3c340a649ed8bdd4473d7f696
SHA1 fb284460e88a34f8797acf676eebb84934f5d5bf
SHA512 cbeeb9f50ce61fc4f60ac95549698667556601a824b92a76047d1ab8a1661fde0be66ca7c71d566785927446be3db374e2dd1850be406c86b577be3aff4c1798
SSDEEP 12288:kUAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:kUAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T16655235B554C30EFFCBAC1368CB791B8A3D47CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 475dd58aa3e180b3e2b58a2d030957a084876454b73b998dce322b763c959af3
MD5 7ab32efec24cd864a618b8eb68bf7f10
SHA1 e9bb9153b093b88e3ae643c987b567bd37c75642
SHA512 70d6358f2233fb72d6678ae34142312b8b59ca729068b1daffc0fc9626373dcd1b6ca696f735492db3cea3e5a27067d5f32c10ed3478996417bda74a65d394ad
SSDEEP 12288:nUAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:nUAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13355235B554C30EFFCBAC1368CB791B8A3D47CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 58fcda72fa4e10b87faef02a95ea01cbe8ed29819cf6391c3451a0b663d095e9
MD5 15f901760cca0c875a15647859edd2d0
SHA1 1d7dfffd7bc80e8b4277289589c25e3eae5447e0
SHA512 02ab9527d3dde917d267bb985c0d3b60757a8a9ec023ef22f4cd4a528e6ee3354da03a7ec80fc63925fac601776e2920c611a6861b7cfac9c10bd84cc545d5b4
SSDEEP 24576:dzyTAfYLH8AcevDN0FImbwQuq3Wia7gD:duAQgAT76sQuE
TLSH
T15465010763A530F9E577C239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 a2e557798758b14d22e8a44371356bd88b0487274dca6eb236e111c3ec5ba093
MD5 4c1cb1d726fe8ed8a52dbfa3756a5010
SHA1 8cd99930a2b50c9241785c27e9ea33cd7fcd1875
SHA512 783d66cffee875dd491270848394509ab7d50420e09d797e0cd06d407b71cb56c1569ae9c61656e5c50389b1e691a23c941f03d144e714b06af0b7e1335f9ee2
SSDEEP 24576:TTDaLl3z0zDxAfYLH8AcevDN0FImbwQuq3Wia7gD:TTuLlj2AQgAT76sQuE
TLSH
T14F7501A5B35018F8EC67813ECC668916D2F27C6A0760C65F03A8366B5F373A05C6DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 9a58f6eae1596c3f8d0bcd2113f8b1570dbb44b3b65eebb261a03b2dc9596f8a
MD5 b7faa5f69fc46efa891aaf54bf44cbda
SHA1 1655fd493edb26937ff3356351a0d707189d0666
SHA512 a2d5d4fbaf5e4d2e2f5e27b7b8539438528eedf621ffff21a6862dda16bed4174567e497a1d8ab9a6bdc00e7a725ec75a0a82277e637b6ebe8c31da30659fa27
SSDEEP 24576:l3vd9CHKy7GZFAfYLH8AcevDN0FImbwQuq3Wia7gD:Fvd9CHKyarAQgAT76sQuE
TLSH
T11D85CF91F3E810E8F0B7DA358D765511DAB67CA91B21DA8F03A4265A1F336D18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 da44ba0c13c662dd70a8679092197cc7e42a128dd226ee96c0d9a57964428dff
MD5 269ee3f5b8334957b1c02cf297a48189
SHA1 66c17ab8dc34faca8212915aa2218e877323e26b
SHA512 58bc8865a567f446e2482b5e61e99c3d441fc782ea825fe855902fe9850c72bc5b54a6c03afc159849e31d69588536cbfa67731aa73ea591dddfc2209c8564d0
SSDEEP 12288:lhAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:lhAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1AF55235B994C30EFFCBAD1368C7791B8A3D07CBE9346939A150A2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 bcfc65b070df6f7d0bf8ef4f5c105cdff634dbe4340a55a70e2735f9ad6ee681
MD5 dd1d20b056283a26018c26409ccf9a57
SHA1 d51fb46d9dbafae9764779aedc9b2bcb9294794c
SHA512 36bd7e937000956ebb67628b7300efe750634b7ac7dc94f6da7a6f8ccc2140a446c4e39ccef208ddaf39f8fc7e7d2cb08045c1ebc1f2090cc284207f72ee27f7
SSDEEP 12288:azAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:azAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17655235B594C30EFFCBAC1368CB791B8A3D07CBDD346939A254A2A867A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 b2f27bfee6b91f27e64759da66d7960662edc533c423325f9206c214fa074607
MD5 3ca85ea35eb982a7516c8b783cce8520
SHA1 0b16d68a03308ac8ae1b34edf0dca8333756dd13
SHA512 4b980b0b23dcbcb59acccec0c586b7a2d6097df781240bb7ca8fe5503f02e5d2333e555dd70116f25f727941b95162680df6eabd51466affd24de67d8dd58df6
SSDEEP 12288:9+AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:9+AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1B955235B554C30EFFCBAC1368CB791B8A3D07CBE9346939B150A2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 62e600874d2471e04e1e5495f79640f450db8e8c9472b8940273af962b6f9a83
MD5 f51e54bdbaabbe58426be530e108f94a
SHA1 d254a2f25a1c863ebaf3353fc52b7e900a2e1da0
SHA512 299cdb4a4850724c453dc66a80babc95a9663f5d87c8d5a5cf925c48a74b9e35632604074eff84ed5240bb8afe63f0b4ae96ae94de504212b05f78553b848877
SSDEEP 12288:eUAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:eUAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15255235B554C30EFFCBAC1368CB791B8A3D07CBE9346939A154E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 a442400ce4a039c3e10ec0612ca43ceb8df1f4f027768c2b631d8055e23dbf76
MD5 836a04d578b38ff109415ecd789be8f5
SHA1 67a15246370f9bc59ab5d9cf878f7cd069b29f59
SHA512 7a0480ea3bb1b5cd4bf43f12b2937aadf11abbd590c4a50d53d2e39de6127f832d3669bdef707360488e33260af46fe676c5ba5ef8609f65bf2a5d1d4596f135
SSDEEP 12288:nhAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:nhAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19D55235B594C30EFFCBAC1368C7791B8A3D07CBE9346939A150E2A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 43e076665c4dd72999880b75f7e1640e2b706d6c22e75ea2717a3aed2bcd2ee8
MD5 9f303be9dbabafd327b60b87fd51762d
SHA1 ff0cdbb3e0d7c06412f0ea70f97e93640be04774
SHA512 abb70e7e2a21ec106897e2b7c9f01160c37353663ddfb1eb154d8866cde1c8eb55312748d3805f242b55d7f1ea1aa149ec56a7ad0e026660e1a78ef6dbc8d5eb
SSDEEP 12288:C8AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:C8AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1FC55235B594C20EFFCBAC1368CB791B8A3D47CBDD346939A150A2B8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 40d5d778065d84ea7652d41b83a1e54c71afb7cb7668ac68ea870ddeb9815493
MD5 59ec965975921f19f339a2130be60275
SHA1 3e2d079215ffcdb8af76cef7dbf8da2597e10b77
SHA512 b28dbb945562255735d29641dda008255c05b5acf5d68e0825077eef73b8a914742fa59a000b5a47444206606a3386ac98fec852370b642739c0a183d7a43cbf
SSDEEP 12288:jaAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:jaAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19155235B594C30EFFCBAC1368CB791B8A3D07CBE9346939A110A26897A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 27c24933bccbc60c2a1bfb56835f2e657f7143d2d5d4c315dbc0707e4e209ca7
MD5 7897f3a57b4b65408dc3478e6405c742
SHA1 cad8129048eff2ebaba13f500893b288c05aaa2b
SHA512 2cc0b407bd7c8538eeddd91925f6d91c712da127f39e38b131141e2fbd50c7cd30606187b3816fe08dc541e582f24d3f6389bd8774b843b37d1c7ed88cce850e
SSDEEP 24576:ufwvUk9RX6wkyAIwAfYLH8AcevDN0FImbwQuq3Wia7gD:2MnYIwAQgAT76sQuE
TLSH
T19F85CF2AEBDC44E5E1B7913C89B7460AF6B178691B31C2CF025A53AD0E37ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a13f54b4e089e18f1a8bcdc1eee9d325c5635405d484b6528d1fd3144d8b8d11
MD5 d81c8ffc1f4a4a51811c1321564caafa
SHA1 5d4a9657e90d3f9a2fee2a0d4bf5cc626b78264a
SHA512 d96f5df93c24ebab18a1bbf28749ae41c356459bbd472880792da8c667783681e1e01ca61e454897853b5741d66206dc7107058046c973107545874ef5b6665a
SSDEEP 49152:jYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0NAQgAT76sQuE:WySzPOqGsQr
TLSH
T1D2066C96A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 20ec73bf72adb0263b18dbe27c6a0b762b798be1fb45cf3fec4b9d41a14c74a6
MD5 fbdbe6848ae4b50cd0690419a5564a20
SHA1 63c3f4a38d47db95970824bcf4a590461b8ace2d
SHA512 b4a05a3de393b21f61a753120f7b0f24cf9068697c1b2dea3d710eacc15acc2fa3535d8496cc9b6c7d46bac79ac29632a7668964406cd10a390ea91340e781a9
SSDEEP 24576:W47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY3AfYLH8AcevDN0FImbwQuq3Wia7gD:W47JUQjTirIhCnDHUPfF/dAQgAT76sQr
TLSH
T1B7659D1EA3EC01E5E1BA923885154A5AEA71782D1B31CACF1270437D6F23ED49F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 41fea6f93336704a3a5dc9ee7e9121698e540fabab3bf6b8ea921f57985ab401
MD5 c132d150024a95f62f823a89515a69a5
SHA1 38fb6c032430bbd23849b314a5661073d02c0217
SHA512 941a95fc70cf237bf165bd2e37fcb88533223e381bd2580e54c7fec70cb6b3d3e5aca16697267c6c9de29c0d0cb7de148954d6d9daee12b20524deec0d1dbcef
SSDEEP 12288:UbsfEAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:LEAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1AC65011AD29811E9D46EA139CB664650F3737C6983E1D3CB12C0F57E2F3A6809DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 ea26555fdc56be443ee645b9da7bf7d0c1aea91187fb012ace738442779e2fb9
MD5 247cc5f0f422a77bcd17f677e704742e
SHA1 cbd8689001843beb4a8cb6bd3f5c83fd0206c4f0
SHA512 7d156df5d79579c737c471a31aaf45504783e63df79d08da09d3289ce2cab87d0646ea3ff2cace50fbf7067cf2688bd128cec39149377e841119ab8f9a3a5f85
SSDEEP 12288:A8xQTXKiU3feSYPvMvcJ4DvlsKLUkgEcE9UdFwd8:AiCX9UPerJYvJQbEb9UW
TLSH
T1DF452840766AD75FC6A940321E32D2CCA7707C11EE45AF0373C98B3F9576669BAF2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 aeed40f9687d7aa437455198b9388e4b6eb7aa3797670dfd7e8e9c60bbe720aa
MD5 a653ec71c4063abfb07d7ad1104dd1ce
SHA1 7ab703aba5b6c3f0bfa346265b38d7844a6b09fd
SHA512 e98221a1448a2f93a3347dcf662314354a319c384b497a664b8f3dec23419cd4d504537a26a09ec2e0795816b85865831f5a7fd50d15940d2f7027544df8a33d
SSDEEP 6144:2EOxx3buFmoykQH/PLOP+1UDYZ6dS2Py0Xo9c4VSPZNOC3tMxuC3tMxoNjKSfJYb:2EOxxrCmnH/PLOP+1UXI9sIZy+0
TLSH
T19E65E8819137A3CFD1FB503203295B8DB764EC56B7456F26B3C8483AD866B25A0BD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 da51e402d99f09b1d3ff5ff017a0f96d43da1bcbe24597dd8a6e555b7032336d
MD5 8e9f815c930b35cfcc42413a4423b640
SHA1 aad36548aee8dd7ccf30081776d70adc7c8dec04
SHA512 6a97b1e555bd2b533dfaf3b88b3c7c8e6131ee92b2b71bcd14a04c258d8aa06fcbb6f393d574cd049b6981aeed40f2fcfb27017323a10e63ef084b1c7edac605
SSDEEP 12288:r07sAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:AsAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1E5552357878C74DAFCBAD135487B91386399BCBC870492D7640A27CA793D8C8D9F4E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b7dd8bb236e30efd09dda650affb50e5b1ed87e8529bdc401259beafd303112e
MD5 291ad265ee8cb5519be4672c67dba24a
SHA1 45c5fc0e7ef5197d82374dee55fcfff530639145
SHA512 484487e9a9fb4a149da9099eabac49f9ec3277c3ee64d45276d74e85c4df409b1ef11c0c94728e9e477b76ab009c5759f1403f313a49011c945047b2753675a8
SSDEEP 24576:0gb6bmBIi49WNNFpg1rSvFv7bY2AfYLH8AcevDN0FImbwQuq3Wia7gD:0gb4mBIBhGF3AQgAT76sQuE
TLSH
T1D665AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 3398c26ed10cdaf8a0223e18ce0cacd7900e7113317ad601528fb0e981c45e05
MD5 077bd426760b5c9027e8a64c51cd47a2
SHA1 973e3700a12459260ea767d6e0bfd6fa0a59520d
SHA512 16d2a7a4924a7e3a48808986cb56346459ca4259f5e18305f81cd76738b9a87ddda0449f67af37eb57b7e83cbc7dffb7b8ecac807840f1d1e8898e345c4a37b0
SSDEEP 24576:WG88u8FpJqH1bzria7/mnAfYLH8AcevDN0FImbwQuq3Wia7gD:97ZFPqVea7/eAQgAT76sQuE
TLSH
T10385F16677E401F1D47BD13889924663F6B2B8250364EBDF06A88B551F33AE44B7EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 63c870b0d50966830d2b05391dd881071a50281efafdfe1b42b0e08cf2d6e573
MD5 3360d04988b40133cc97e0040e5bd70d
SHA1 45e2e6fe9626f834b997f4c4d5ab8c6c5ecb914f
SHA512 4cefb3aad36aadf7ca2f4279d9b8e291f4f9a84e2168f5e1a98e477f161372534bbf35f1b7d89cb83c23621d1d7a8e0cd127cde72dcb10d645f7ff6ad1140ce7
SSDEEP 24576:zPUr+NQrAfYLH8AcevDN0FImbwQuq3Wia7gD:zJQrAQgAT76sQuE
TLSH
T11665E12F22AC18E5E676E13D89968619F771B866031292CF0291417E5F37DD8BD3DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 0872380f930afd10b74be62520048b4d266b88025713dead3e6b44cc27e15714
MD5 f4e7ba1da849fc31763b4498a75f767b
SHA1 edce2e1ffe2ecd0c23f270fa653f4bf983b692c2
SHA512 138a86c888ce87269f44a960dcf2f02b91a474e1fb09ae38010d715f2eaabb24bcb3a07c32ff605f9dc787ced58a475d2ea617a8458f5f261dcce286d8b22477
SSDEEP 49152:eBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjbAQgAT76sQuE:hG05lO43bNqGsQr
TLSH
T185D5CF6E62EC11F9D0BBD17CD9C64A0BEBB23825032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4a0653a958df8f2a8d2f46c23bc1fb416d7f2833a9f4bd0e1776d5b77c6323c6
MD5 05b653040a4fe21731bfbcbd82bc4bdc
SHA1 92687fd4adfbd7372289c52d8dcb9f5f8170093a
SHA512 45f335b116abca4a83f44dff121d6ef9baa61a557a96bdd4795531fe4abd96d86ab60a088790eca6269b1229d50b06a6b4232e38d2702d35361dde16fba163d5
SSDEEP 24576:jfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnNAfYLH8AcevDN0FImbwQuq3Wia7E:ba5POZ3BJt2pasx2+mzAQgAT76sQuE
TLSH
T1F565AF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d6b7ec4e8bf130ffc11625baec1fa08ced703bd54b57c8bab039ff963bf4fbe9
MD5 e00332731292152fd3f0c4edeab38667
SHA1 edf1e8d5894a458d36608a6e89d2fc5b4c28b85e
SHA512 e8b63c486489f7c31a4f064c7461f9f098f0664a242c9aee10ab72f934c9b3844df26934bb592f1f847d3356b8a6a997889aa9f619c8fdd5578fca328398e2f1
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7FkfAfYLH8AcevDN0FImbwQuq3Wia7gD:ENc/zEOVHF+AQgAT76sQuE
TLSH
T1CE857B1623E901E4F5BBE1BE89779546FAB17869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 51cbbf7ebfa1ef5fe1e45997e59203eb92304a8a4770db1caa722a135b06d5be
MD5 ac26166a70ae84fa24474fd205d13b7e
SHA1 804073ad2981d621110bc8056fa50738c038701b
SHA512 557401904ac7424663b9c5735a1a5a57596eb40d5ad0a74b6695011b3e9b0434c9e6df1c64b7cd7686684abafeb4f4ab87425a336cac208de9861e2261fd0cff
SSDEEP 24576:YTkNvNnaFeYhJNtmZBm0AfYLH8AcevDN0FImbwQuq3Wia7gD:YTMwBtOm0AQgAT76sQuE
TLSH
T15955AF6EBAB805E4E1FEC675CD238512E6727861073293CB5290C13F1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 cdf0803a8e6cc957d13ce2a50fbf40ea95845bdc91e8efc3d2c6937ec634dd2d
MD5 14c7ca77064e557f8ee693f33429d272
SHA1 41942bd6dda7d2fc62bf783b6fd8d13a76a1c152
SHA512 b19cbe9ab1f04ea9b86756b6a59567a141203b0bc45b376fa603c244f55603a7bfcc8c82ac0c9e1c0d885938a17b2e629ca7dfaf7b6b9634d081d3eb45241cfc
SSDEEP 24576:+D3FHshBIYQgAIAfYLH8AcevDN0FImbwQuq3Wia7gD:+DVHeBIAAIAQgAT76sQuE
TLSH
T18575E17EE65C04E4E57BD17CCA638606E7B138AD032256DB029481BA1F7BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/880-97-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/880-308-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/880-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/880-104-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/880-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/880-98-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1316-322-0x00000237A1450000-0x00000237A16DB000-memory.dmp

Download

memory/1500-140-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1500-311-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1500-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1500-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1608-171-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1608-54-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1608-61-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1608-53-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2452-20-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2452-21-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2452-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2452-81-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2452-13-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3188-326-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3188-85-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3188-92-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3188-86-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3188-305-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3188-324-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3804-303-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3804-82-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3924-37-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3924-38-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/3924-45-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/3924-49-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/3924-51-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3924-44-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/4408-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4408-130-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4408-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4408-132-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4408-124-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4420-112-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4420-110-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4420-307-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4420-118-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4756-77-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4756-286-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4756-69-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4756-71-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5888-399-0x00000296ADFF0000-0x00000296AE21D000-memory.dmp

Download

memory/5900-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5900-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5900-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5900-109-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5932-0-0x0000000000400000-0x00000000005F3000-memory.dmp

Download

memory/5932-66-0x0000000000400000-0x00000000005F3000-memory.dmp

Download

memory/5932-7-0x00000000023B0000-0x0000000002416000-memory.dmp

Download

memory/5932-6-0x00000000023B0000-0x0000000002416000-memory.dmp

Download

memory/5932-1-0x00000000023B0000-0x0000000002416000-memory.dmp

Download