01377f7ec784d696c0f4ed408987e6e42eb85d7c7ee31540bdc1fab8a2527efb

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_a9182aa3abe12eea67cafac7355919a9_elex_redline-stealer_rhadamanthys_stop.exe
Size 1.3MB
Sample260809-ae8nms1sav
SHA256 01377f7ec784d696c0f4ed408987e6e42eb85d7c7ee31540bdc1fab8a2527efb
MD5 a9182aa3abe12eea67cafac7355919a9
SHA1 831f6eea23643cbe55326a9c30a387f985d44bac
SHA512 e0b1830cc8f8ac65da9621e989b26f7c67a29ddda256c0798945ac5f1f474ca704dfbe38ec4cc038747a5ddf6765b4d536d35226d4355c95bef1cd5831fa8eed
SSDEEP 12288:xVh0Sbh1SNfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SF:f6k1SNfJ4yL/tNCJPXUQrPa
TLSH
T120551257B180D037C9036AB4361CD150CB2ABC611739E183BB416E6B7FF66E65B2A3D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4684	elevation_service.exe
4912	elevation_service.exe
5484	maintenanceservice.exe
3248	OSE.EXE
2376	PerceptionSimulationService.exe
1056	perfhost.exe
3500	ReFsDedupSvc.exe
5216	SensorDataService.exe
5476	ssh-agent.exe
3508	AgentService.exe
4344	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_a9182aa3abe12eea67cafac7355919a9_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_a9182aa3abe12eea67cafac7355919a9_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\494e9238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_a9182aa3abe12eea67cafac7355919a9_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_a9182aa3abe12eea67cafac7355919a9_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_a9182aa3abe12eea67cafac7355919a9_elex_redline-stealer_rhadamanthys_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_a9182aa3abe12eea67cafac7355919a9_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000b8d77469327dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006cdb8e479327dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d80b3479327dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f7ee96459327dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001daaf2499327dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e6b77a889327dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4684	elevation_service.exe
4684	elevation_service.exe
4684	elevation_service.exe
4684	elevation_service.exe
4684	elevation_service.exe
4684	elevation_service.exe
4684	elevation_service.exe
4912	elevation_service.exe
4912	elevation_service.exe
4912	elevation_service.exe
4912	elevation_service.exe
4912	elevation_service.exe
4912	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1420	2026-08-08_a9182aa3abe12eea67cafac7355919a9_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	4684	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3508	AgentService.exe
Token: SeBackupPrivilege	3500	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3500	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3500	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3500	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3500	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3500	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3500	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3500	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3500	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3500	ReFsDedupSvc.exe
Token: 33	4344	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4344	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4344	SearchIndexer.exe
Token: SeDebugPrivilege	4684	elevation_service.exe
Token: SeDebugPrivilege	4912	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 5264	1420	2026-08-08_a9182aa3abe12eea67cafac7355919a9_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 4344 wrote to memory of 1952	4344	SearchIndexer.exe	102
PID 4344 wrote to memory of 4780	4344	SearchIndexer.exe	103
PID 4344 wrote to memory of 4324	4344	SearchIndexer.exe	104
PID 4344 wrote to memory of 4892	4344	SearchIndexer.exe	105
PID 4344 wrote to memory of 1212	4344	SearchIndexer.exe	111
PID 4344 wrote to memory of 2408	4344	SearchIndexer.exe	112
PID 4344 wrote to memory of 3140	4344	SearchIndexer.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-08_a9182aa3abe12eea67cafac7355919a9_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_a9182aa3abe12eea67cafac7355919a9_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /tn "SmadavSecondaryUpdater" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4912

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5484

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3248

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2376

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1056

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3500

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5216

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5476

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3508

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1952
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4780
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 2808 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4324
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4892
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1212
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2408
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 2808 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b7fb51a711c1fa28297cbc2f0807efae79ce514a0efde27f4e225f5e4a907890
MD5 fd6053a26b8d11ddfa52fd4c0cc4cc85
SHA1 0cde4e918c720e1600969a85a90908b6e7ed4285
SHA512 195cc3687de0b6c4a2187496b7423d453ef5381d2d00c757560bc738bbef7559568cfaa94f2a89e2fa58374e8c3878092988b1e5a8669e3920e80d268c26be27
SSDEEP 49152:wb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnUfJ4klKXno:a3q6sjBrfJ4k
TLSH
T11FD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 0486370bf0444ff9554827a9a3271beda9362c4addc20de7a44f42aa9a11256c
MD5 1fdeac95493c770921b1e920884d045a
SHA1 954399bde625500ab8f27d2191319fde59780153
SHA512 ac524fa012a9ac0834f42811652dc04fd9af2d4638bafbf6a7e5c9dba71f3be52f2192321da107ae202fd5316253502df9e11f1e93c974f9aed23a575005fac9
SSDEEP 12288:71XLsswWkxy2lRq2czAOfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S+:BXYfDtczAOfJ4yL/tNCJPXUQrPr
TLSH
T17465F12963E008F9ED67827CC9A1C101EB32BC954764E7DB03A099662F776D81E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 e9742c0d54da8b5460d1acf8dccb483614505e2bbcf2f28855a86e1221c09d29
MD5 23b358d2522afc68d5b43a065e6db5f6
SHA1 b285d35bb9b2497db59aad87a8c7ed138e378b25
SHA512 078de9513fe344f1aed9c32b5ee376960b46c3b6b54464858fd966f765ed13fe769e2c4c9d9e8045c45bfb29a6536893cfe019781c61470c6703ad2ca3436a3c
SSDEEP 24576:60Le5ji0hmxxrMdfJ4yL/tNCJPXUQrPA:6Pji0AjYfJ4klKXnI
TLSH
T12E85AE66F5748335D073C0B9C5D2A68AEA71308617308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 cc31b724588d23026d5122a27d8c768d340385229a297de3c20a67385b9d6bf4
MD5 c941e2fd3197fea2dfa60920e08de38b
SHA1 d7fbdca6e863fe4b910077bbed6aeed4decfea34
SHA512 1591f3362315813d55dd850de7b3239ee8bcd5e40e64fbef6d775fbb74bfa22702f357d2ec30b722b268ddb971f415c73b1b9cea83733abbe77baec88ba340a3
SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWn6q8wyu7fJ4yL/tNCJPXUQrPr:C/ezSC6vUzPveHjycfJ4klKXnz
TLSH
T198756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 215869abc912fe6189c7c9b836ba47c529cbb89ae097a3e9567530d9a99a13a8
MD5 e1af1b595dadcc05fef4896f6d32696d
SHA1 6e3682845a029623d8dbee2acb447e2f880f4401
SHA512 2a163350e509d744c1126fa8b67982f721a27835b20a88c3d76bfa4bd68ed7b24ae52057f9d1b02076adbeb0faa314dea1baf643733a70bf055a35c1a75968ca
SSDEEP 24576:GVbqPb88hv/l+YKfJ4yL/tNCJPXUQrPE:GVO88hXl+jfJ4klKXns
TLSH
T145559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 866c848e0938da6bfa35d93b375a9173def834beb5b73852a207f291ccec2089
MD5 c3c7b4c0934a99269c8d328fde645451
SHA1 47fcba10646bdf1a4719a37a9d3e1eabab3fdb47
SHA512 f3521ee0efe1c5210d88103b8446ddc97cb7fcf3e1f5164aae4eaa2e68d65cace0cc3e6179ab89a1927cafa68e80ebd06b3aab37f4147a676384e2e430bf7bc5
SSDEEP 12288:ZLpfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SE:ZLpfJ4yL/tNCJPXUQrP3
TLSH
T1204523EB51809486DF6687F82B88F001C715BEC5162FA2F2DE43B8853FFD91A559C362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 15d0ee1ba4b288b032d876aa7f40671ee1030159659c1d1aa8dd0e73ba48f7de
MD5 e10a3f7ec742c86325f78ab783d96f8c
SHA1 7b6ac537debc8ed0b98e0158875d81f1436e524f
SHA512 c5c7933c50d5c1b043fb4a4e496de1d6db1b343d41480aa79110426d8390066675fdf4b4bdf5d5bf13517e387931c8a22ab058d78e0ab1ce5e85856c3d499b4c
SSDEEP 12288:jeBNUbTVO86UifJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:jJIUifJ4yL/tNCJPXUQrPv
TLSH
T14E65C07BAE28FCD2C67A8DB85B90C200D77278704B22A3CBD165C20EDE275E15D79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ec1c1a4f328ed8e718a90ce03a4e08d6371a94f0f3976770c9ab165956a0e26b
MD5 c49c313171893220c6c0d52eef0346df
SHA1 b1cdfe9f5d596a1f68d69f93c1ba87a23ae564d0
SHA512 da70d136c8fccc119ab1f1abe5d0ddb58da231797c384ba414386c8d5b37fdf4506bf3a38754951ae8e995765ef4e92e731a606187c15b8ca6cb5e349d368482
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THg:UQvGAdlCEL8c/DRNw5CLfJ4k
TLSH
T12D266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 10c73b31ad508ff8a8042fd1d6695742877c8e4f9769a1cbe00a93f47e74904e
MD5 a9153f457aded4cac942f818d30e5244
SHA1 239461ffacb2058cc949eb12f7f0f1dcf6027f22
SHA512 ee8de1624248add722fb47fe8ccb5c8f5a07fc034ce7fa075b1f29207ac419f36acab6192135625b85c9843c9e04df8c298cfb0e7f069ffc4c7516a794f73fc6
SSDEEP 12288:uAwSfxL/2Dc3RDLLmt0LDQewsAjofJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWb:T0ewsAjofJ4yL/tNCJPXUQrPx
TLSH
T17875E031FA74E036C77F0DB51B25D306542CBA604B621AC3E3E89D8E5A742D2277AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 67d3480837913b5e77e6c8ab28b0d8af55da411a728c7c9f081e8eed05d6eaf4
MD5 34ab0c147969d9e364b6a498e2a4c53e
SHA1 5b6f8c763f7d9b0604d5407b4fdea13c62b7bc4d
SHA512 419031864f88c61f202ed9970be3707f7daf1f0ce3e62f5f3c4e028085ced1827a92320ef8070010001714ca6b3bf2bcf998515f8ba606c1cb3da182da275afa
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHQfJ4:jUEtQevvqc2W1cpV2tI32Q
TLSH
T199474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c92218cb975409ae2cc00797fc1f93372d042a38219102d88f09f565c82dcf2b
MD5 584931ae3bc533460d163c264076ee68
SHA1 04c833c27cd6555d0553e484181a6135c6fd9996
SHA512 695354edea1b16653469b9d83d1d461b8aae37ba4588240b13982b60f37a3c6324ed938f3a395211f184c7a2aeb5625c4856f6778a787603e9aa8220ec232a7e
SSDEEP 49152:RCbRquA/m2yL5zTfFiV+XenmE3/zIfJ4klKXnp:eoquVjnmffJ4k
TLSH
T13DD58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3d1397c4702720dc07cf20859d98efcc7bb7f75a759071f483333f1caaa069a0
MD5 22c5ea1553887c1753cab4e42f27fcaf
SHA1 fb8532bc1cd482a89ab6e6a6d89a8bd6c8010747
SHA512 33fdbba8be5388c7c658cbe955bae8f24c23559c15af3aed22a0f1b4918d89f1ac862dc5ef915861f92cd469417632c1c8ea736fcd285317d786c7235c8d2ef0
SSDEEP 24576:sAhGL3IFoiwtA5l7S53/fJ4yL/tNCJPXUQrPB:sAMUFoiq5vfJ4klKXnJ
TLSH
T18B359D81E7F955D4F5B3AAB899B69170EA76BCAA5E31C20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 9eaed37c89f1a29d86c293e3ec7d51ccc09b63d31b33c7e07c0114ecd52d12a8
MD5 24b6191250d0f100b5ba2ab51e00c168
SHA1 c880865a2663bb7308a538ec828f9052daf5be52
SHA512 1809a345697f116edbfdf46e9a89b9eecf6f18af45200406d5ff8d41c980255951ceb6e3438399ab34193a5fcf152bb6f31641fc868711a42c7ed23e131fe9ca
SSDEEP 12288:Mmw5HEjsChNVBFgl0WDm+CbfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTk:pwu4OW8fJ4yL/tNCJPXUQrPA
TLSH
T1CA65F14A32E40CF9E96782788687D132F7B2BC422A26D71F5760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 7702277ee7e0c666f7e94e5c33b03769520c938bcb9bd23cf3f77f39542fd72c
MD5 0936af8a752b0281f4f0b8cd1786c2ef
SHA1 c163217f7b90714e7148fc4446e1fc5196f20a1e
SHA512 b0a6050ac7848c1c61a4ee0b23bfdb217925d6091cee59cad91d6613e7063233adcf3665809cc291a57ca1d827be7fc968747bd26359dff3765c5b9479c6e058
SSDEEP 12288:WeZ1Iy4fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SG:LZu1fJ4yL/tNCJPXUQrPr
TLSH
T10E55129B22D460F9DAA382BC89D4D101D3317CD2233A53CF5A5195963FB7AD61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 382a1251a54cad340eda1dabf06fc2b420cf67bdbcd25bc3ee93f30e063d8623
MD5 9458f401b7ae7ddeb7495e6e89d4310f
SHA1 fbaff5bf91ddcb36883b21f6131b064d326f17ce
SHA512 8121fce79cfc8094847e29fc753eed21f24cf952c49325ab24b876b1aa6afe7777d9e30299ddfa1d5f069b36835cfb69d341a20a208c1eeaeae35a73f0d6218b
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U2:LQRQyi36YOcPbLvw2gAf+PN3GfJ4k
TLSH
T110667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 358eb06eda60490cc26e41cbccf9d25a8e60f5b34bdafc48f56d1d8433036ad8
MD5 7d892d7c82c24dc7df776bf4a84a4864
SHA1 1182eea0844a182c4eb0949414d7e96078d3ec5c
SHA512 da8a8e09e08db10446ae4a42bedbad6cb675bd7e6f8fb021b2c92cc0b0a7a8736f3dbd3101ceed84b3ec288bb02e597f760e458f3a9f8876bfdbc303531142b9
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23US:JQRQyi36YOcPbLvw2gAf+PN3GfJ4k
TLSH
T1E2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7b2c4b3aa41b6ed0312885abb95e7920277b9829660f2a1932e5bb3edfc64386
MD5 20f97ba5d26f1f6ee09dcdd5978a1670
SHA1 27c1a55c8962d1432d1b71926e59c6798a315e43
SHA512 7710fcf72670bf730d61f737e0066fb7fc506c86063f3fa9e356e83986bfee6b1dd18cc4011b1441abffdabf663a4035ee83932799ae13ae35705ec03f97c798
SSDEEP 24576:3wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0lfJ4yL/tNCJPXUv:/68Qg55nhceWu7PNU3/YfJ4klKXnu
TLSH
T1D0B55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 33ccb3ede3bb4e52457c445aa5e11a8c4a8cda3dc5b153128aff83bc56396d35
MD5 702d29f4d58cec071329efe67ccfa5e6
SHA1 48007584f180a48490a2e7ef239aed5cfabc0856
SHA512 5c6da802cdf1ade554a341a1ac255f17a7c7b13364754a9945315923cec475f7b3dfb8a726a9ff9645d40cf04b5d0ee7af1598266727ff74592433cffbae10ab
SSDEEP 49152:e3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99e:fy5112gYy5azzVvt69nLKnhZpfJ4k
TLSH
T108167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5e21adf4a7d868998940c7b2ee5e417a65774390b04ad36f05da25b3bc184875
MD5 fde4ab44578f7b969d528a01d4327594
SHA1 968b694b80098332ce02f74a1e724a0794528d4b
SHA512 8c45f18609b68228263a4586a499ae05987d1429a970d1d293db1917404ff33db1e01fa5c7d8d484dc5b8d9fa5886d9f782c69d9171de925fb3b6107509e046a
SSDEEP 49152:7B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glffJ4klKXnA:tu6Jmdxd2dffJ4k
TLSH
T19ED59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 81bc4700ef9d4d622422db3bccbed589bc1f30fb8d3f8632c082dd8c02f75448
MD5 d0d4ba7b1437f6aa2926b8ac3732d39a
SHA1 aa19c80529f815c1f6a3bb551c0d417c743d0038
SHA512 1c6a74b5c51139e8a308199aa02680c8f208c3ec66c25b0672f0acbb3063351b816bf9ee3f9fcc4bc2388af2e04309ef09d0b95f242cc7e8aff4e6ae885f7aaf
SSDEEP 49152:L1hpsNoJpF1A63U44CwH7R4xCfJ4klKXn8:LmifPWRffJ4k
TLSH
T12FB5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8512c2b6bf984b00afbf2748ba8a7057862df13aa12bf636626b34d3a1f0ab9a
MD5 8006205837fdd666cc4354371ee13438
SHA1 ddeff4ff71f7d3e99cf85eb45e26b828e110dcec
SHA512 5ab99150f56a4cc7fb3ff8beeec446192c4b5974e6b3c37f32e014127620ad8f41dd80fe9d9b6d044ab8e205960750d3457db378e06d805d42d9ccead004088a
SSDEEP 49152:vSuZQIY0Be2KcRVtOnks6NMHq1fJ4klKXnt:V5dKii611fJ4k
TLSH
T1A1C5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 51a2f60c57af1379a2252fa15c9d5d575f6add2ab064c895c6c8bc901de646c0
MD5 17f67e8ed2f1a0086409f86c8b66bd8c
SHA1 af47fb283875a6c4a56c5e85e5d6a3153ccc7c49
SHA512 6cca33d1af32f01d97a998e2046edd65910efaab17bfb8d3c0bd1762f813abdd8e50ca9b23ba9438f77d26f629c8b1678f7eaa9db3058650d86ca8ecbeff90f6
SSDEEP 49152:fhtSn8EApI0fig3giDn0AP5wOfJ4klKXni:OX2imphzfJ4k
TLSH
T1BB95BF13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 bd8a3d75490e79a193d018f3f891b1ff11be7c4f4b1ef51a2ea26fa75481bbcd
MD5 2221d0f55327d7376b912a9f7b0199a2
SHA1 bead2e69ee139d5041f5a6a0d9864a3dba39cba9
SHA512 cebf25194e1e76df270d0ae1a35f7f153d9dfbb793fd1cda42bb7b30cb8dd9ea523dfffc2ed3f13c2fb69b1ff758e2ef43d5a9d7515be506ccd00abb317b89fa
SSDEEP 12288:wBfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SR:wBfJ4yL/tNCJPXUQrP0
TLSH
T1EE4523AB60D5948ADE1587F81B88E001C7087EC6672F62F6EF43B4427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b0c092de4deddcf5a4dbd32a7e1fa400c543031d65378af4add31d262d6dcdc4
MD5 b5ff693a5b3c9a3d6984e4a640cb7acf
SHA1 2e6c361fdfd2d8c95cd7046a8507491cdfff570c
SHA512 2fcdc943f91982a13557c442b512b42f11015bec45065b5dcd1f15313aa8375f7364c332de0d01b9d49c03cb997ca689cb2f784e546eb35c8c4e14cce954e8fd
SSDEEP 12288:m0kfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sl:VkfJ4yL/tNCJPXUQrPA
TLSH
T1874523AB60D58486DE1587F81B88E001C7087EC6672F62F6EF43B4427FFD92A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 1e1020c8541d88496ad3017a28fc31446c103c7f2abfa2f63f17b646f0dd81f3
MD5 405068090a63916ceac95d705fe745d0
SHA1 6438b708703acb2dfa50465e2af39d62bd017d56
SHA512 144cab14143da1e709789d11ec856381dda77919daf6f2015f347b6cc88366cce2157e18fe408dcb518872d568ee00316ce3192b866105cb76dd1b3b4230623e
SSDEEP 12288:t6fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sl:t6fJ4yL/tNCJPXUQrPA
TLSH
T1694523AB60D5948ADE1587F81B88E001C7087EC6672F62F6EF83B4417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 476b5522290211a29e28b2091020e67bbcebed00dc2056f516d334152c58d19a
MD5 6be8e8ef1f093a998c3d256d738ed5ca
SHA1 0bf3b9bb40ec7a242145ecf7ad7d30e7f706cdc2
SHA512 a438790bb8d54980b2f2a6fa7a9fbd7a7daed8cb90692ed19d4cce2c1dcf084c0be5faa9d77327760f238b3647d1cab865954247eaa66448062f008eb300ab64
SSDEEP 12288:nVffJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sh:xfJ4yL/tNCJPXUQrP4
TLSH
T10E4523AB219540C6DD66C3F88A84E001D325BDC6673BA3EFDF0268863FF9655297C361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 51d13b24b2820ed24ef711c096ca404b7b79b69192d5ed1b70be62856b6acb47
MD5 4b94c420e5273f3eac31011cdee29c7d
SHA1 0b9a6493075b00f41d85ea0c4c7025f5391fae6e
SHA512 a453ec7a2d3d58f333a11837c5019e6af29c405c548278d71dd2a10fc1ff82579e9b16a9d109a32c707a6f37e0b94807a41063d9d64152aea041a623a5b0bc66
SSDEEP 12288:RHfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sg:RHfJ4yL/tNCJPXUQrPZ
TLSH
T16C4523AB60D5948ADE1587F81B88E001C7087EC6672F62F6EF83B4417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d9661306b1cf4aeea714e1012e2c6ab3ecc8b36ae85987441409896875ed9cb4
MD5 acfd1e65614be5dff1d315787bb8c3ff
SHA1 e295ec4190b04fc1238f906a7aa3398881f03f81
SHA512 06bbf2420bfc5e39ae0b6200a4428d79e31c7e5b3048eacc5b03552b4a85c63e642274db5c42d6a1fcd3919214db5b0fb5bd98456e4c6648f3ca3c9a96ccb467
SSDEEP 12288:TgfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sg:TgfJ4yL/tNCJPXUQrPZ
TLSH
T1594523AB60D5948ADE1587F81B88E001C7087EC6672F62F6EF43B4417FFD92A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 9176e3755486e8eb4fdd36e08cd7dd192909639e5399ad45c62e4954475617b6
MD5 cb727f59087ea38f3ecfca7ee3ec90ac
SHA1 7c68f74b5a5c5da89cf5b79830523bee92078663
SHA512 37e1531a3e44c609acf6a82771cbde15a96ade435a2652ff5be643967649d7cee019daad6d829f29966e405dda8c655bdf386ec322ec27c802e85ddb7a992202
SSDEEP 12288:PsfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SK:PsfJ4yL/tNCJPXUQrP3
TLSH
T19F4523AB60D5948ADE1587F81B48E001C7087EC6672F62F6EF43B4817FFD92A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 70dec956648f2fa4809d441778a5bdf491eff85d14cf9423ba926544b72b8a19
MD5 481551fde5a4fc9721d1e9116e083316
SHA1 7a824b9edf481bffeb23ffce59983003484bcc21
SHA512 5e6120bf51fedee26cb618e3e9bf2ca423d17ea40c2b6cf193e64dc3064a486456dc99caeb14497510a3f98606d55eab95df5e7888e1492bbffc161d14b8ed0f
SSDEEP 12288:jiZwbVzzFEoS2cPvyEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S8:OZMRzFVSOEfJ4yL/tNCJPXUQrPB
TLSH
T15C6501A5739018F8EC67827DC9549902D3B27C9A0B70C25F07A436676F773A11C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 cfd49fc58c55e0a280b00f9e9a98c2563347af81361335930952c1c013c18614
MD5 7f4d4f3640c5293917f5fb72717cf200
SHA1 14424058372c7cc2e22884f1521cdb6258acf2bb
SHA512 43415f48e9bdde22073408daa29a24f533f89adfef7da27584d1f34ffe7daaf8b9359ed59e79d0e5f3e8677369e812baeb1ef89c18c03009c2dc605a96003abb
SSDEEP 12288:JFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Su:JFfJ4yL/tNCJPXUQrPr
TLSH
T1344523EB6095948ADE1587F81B88E001C7087EC6772F62E6EF83B4417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 00c55dd23c88e334166b67c70f697b9accd1e1946f5c25b3b515b175caed0163
MD5 e19ff7bbe770e6e1ef2ea34eb374dcf5
SHA1 7225d01f70a3a100f9c66838e7e61d3282622b23
SHA512 9f3532b9d380a7e030e929309a35cb7840cd6d54db13087911d32aef869077b96e04ad47b248559f1210003bb26c6c3ecb4610bbc0c5a8caa6ff092dd38e4b4f
SSDEEP 12288:Y5fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sz:Y5fJ4yL/tNCJPXUQrPy
TLSH
T1C44523AB60D5848ADE1587F81B88E001C7087EC6772F62E6EF43B4417FFD92A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 4bbe472da66f4162c984cdc38a8d362d96e08e01fed5406a26fc3da0178aab78
MD5 0e143232a5fa9c5570aaad4a7f0676d9
SHA1 9a75a233f57c48cb5b9af97c95f9e90246f65637
SHA512 1401144800754868d8f7913f230710e21543d5e869fb4e93cbd4dfe9d6248d9b173d5a1868f0c12921c1cd6ee761c52097994428b99d434f1aa18947ec891199
SSDEEP 12288:wyPz5L84fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SF:Bzy4fJ4yL/tNCJPXUQrPE
TLSH
T16A55125B32A130F9D536827889909502F332BCB2072587EF5B9056763FBB6A15E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 fff1ba12fe73b83582c2a2fa3e82333dd1e70662fc0bab4eb2cb3f69ae823c3f
MD5 94c085a1ddc2880facc1f4b86eb25478
SHA1 97f35f3f7eef94c0749b89c0188012cd6989f88f
SHA512 09e6c06b1e36c592c2ca981787db93ddee26e49ef10e99313aa5d989562424fcf22ab76f085871f3fc28b9d05dbfed5fb14010eacf66a76b73f8a648734067ce
SSDEEP 12288:eFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SB:eFfJ4yL/tNCJPXUQrP4
TLSH
T17C4523EB6095948ADE1587F81B88E001C7087EC6772F62E6EF83B4417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 60e65a6cc6e7071d25a05d200b03b4ebeedeef40f67be331916c187a23a2d3b7
MD5 4ade0776615dbbb2aca641daebf58502
SHA1 2c3e9f9c3415a610eb64e2d5fc9a7edab11ccada
SHA512 37d146a61ce232671df5200c626f50e96b969147917d01116465b8527a21a879ac72b4cf5f526e0f05b1b6bbbacdcdfe63cf6b046c5961d9e4d94f4f1df77232
SSDEEP 12288:OFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SB:OFfJ4yL/tNCJPXUQrP4
TLSH
T1DE4523EB6095948ADE1587F81B88E001C7087EC6772F62E6EF83B4417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 d44c4bd3f71133e6512907d31f7d162b9e68208e2c1e6ecc1a13921e449a7b10
MD5 30055f9b5ebb11ac0c65b7d0ac880623
SHA1 45a4d138d72e3137684112d5e5716d6ef8cfcc91
SHA512 585586a390ff165469667987ddb3db471623d423686dd3a0b87df2a821ea651173d28b8f5ca80306b2908b8e562cc0d2f0a665176a847e9b936049f114a80a30
SSDEEP 12288:9yPz5L84fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sr:0zy4fJ4yL/tNCJPXUQrPS
TLSH
T12655125B32A130F9D536827889909502F332BCB2072587EF5B9056763FBB6A15E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 33b204cf96e9aae957533e1c51f95c6af02b300841e8703299286b6f35126567
MD5 9de04db344a5ab960d6dfbdcc0f70bf6
SHA1 e24dfa3b9b9f817a027cbd96e12fdfba1aa1933d
SHA512 9f151346a5c037cdda94552bc6afc99855abbb619384ff73df4ec1a77eacd11f4a782e57f40a77e710db5632fb8ef0cca89317609f16d00514b2ed501f187a30
SSDEEP 12288:KCd9CWYoaLHF3z0z04PDvhqfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTX:7TDaLl3z0zDqfJ4yL/tNCJPXUQrPj
TLSH
T1CE6501A9B39018F8EC67827ECD549502D3B27C9A0770C25F07A436676F773A11C2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 e370856b6bcafc0d49368d3b536ff3a5aa7761b09e22dcdc4ae85abb13917fa8
MD5 67d7e60cfbfaa9a2077819508f05b84e
SHA1 fd18c18db4dfbe2d32b4fb06325367471bdf428e
SHA512 b4270233b598f79018f989396ba93d12742a311bcb58c587869a0461dced68bc41f4284ec6977edbbdd2ddfbe49a2102ad53df936f00dcb32bd9f1db42b635c7
SSDEEP 12288:Mi4e7KRdTfgwCHKy7GLbbdIvDfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGI:M3vd9CHKy7GZmfJ4yL/tNCJPXUQrPB
TLSH
T1C375CF91F3E410E8F0B7CA758D659502DA767C9A1B31DA8F03A4655A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 2b1da5a5d98f4d986f7704b27e7deef86215a1b79993401aa57f65b5e051ab29
MD5 50c8f6786e94ae88f9bac3d0f6dd3541
SHA1 7afaa443d80485d7e63ef9b955932b44b8a1f901
SHA512 673ec1155e012fbbf1505821cb65bda5d66e3fd02ef3f4e8cfbbca41b25bda07f108cad282facd3cd57de270710b19e7f3baf9e783b027f06101d26eb4485dee
SSDEEP 12288:fafJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Su:fafJ4yL/tNCJPXUQrPP
TLSH
T1374523AB6095948ADE1587F81B48E001C7087EC6672F62F6EF43B4417FFE91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 07a0081c959f026a2ff3134757c580dfe92c7547d746f518ac5f698b2676eb83
MD5 62099ee7d240892662b269ca0e56d50c
SHA1 4488982533794461e99f591dd9885889b39168c5
SHA512 a2b5efd9e10bbb76f7ce0bbe21ad20363b313900f74e9ee9dc68824c68545d1aa9fa5cdc88f10dfaaeba8043c29940d0338f471492e55e8b1b12334e9a0e9e1d
SSDEEP 12288:zYfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SW:zYfJ4yL/tNCJPXUQrPX
TLSH
T1064523EB20D5949ADE1587F81B88E001C7087EC6672F62E6EF83B4417FFD91A159C361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 7577187765c92842d794d052cebfbec17f9c54ee5dab8b7f925416f32108010c
MD5 1bb195665dc0c3b36eddc1930dbe643d
SHA1 4fc92817fff10b061de469d8e6bc134a5add9754
SHA512 e503a9d539923bd6dc904b43b0bb28238c003a849711ee85c527597026a392e518037259b9bd2ce699fdbb929778c115598db9186e99efecdfd4889428ce0fbe
SSDEEP 12288:5DfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SJ:5DfJ4yL/tNCJPXUQrPQ
TLSH
T1C64523EB6095948ADE1587F81B88E001C7087EC6672F62E7EF83B4417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 be6a18fccb5c411294a39404c44853b3ee5f03e4c5b689680b898e0157ad9293
MD5 63b2fe8e5592ef205737258b040d27ee
SHA1 6ea814895e014fddcaf79d3857283f859a1f7da0
SHA512 411121d8aa89ce0621eb3fa6c67c2a5a188493d64921c6860548e3d3461e922639fa3f90ebdcddbc9d550988854b9844c79d1cb1a3e37fe9dd6052fef1477280
SSDEEP 12288:ZFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SJ:ZFfJ4yL/tNCJPXUQrPQ
TLSH
T1624523EB6095948ADE1587F81B88E001C7087EC6772F62E6EF83B4417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 570b055e27f5d9bb46e54e665b4e8063dfc8d75e647c64573875fb6b05ecd85d
MD5 782fb87df70df7d594bbbce576f0740e
SHA1 82e80a79ae5bbffa946ff1a56ee93a7049c64793
SHA512 4d53f99f7d7707c5198a6dacc888c8c4c4f8bf43c4f2f08fdaa57087aed4d824480c02c30c42560d362c9d768749a70f480a866cbe8beae91e76a9bf7c66d9f8
SSDEEP 12288:NafJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SV:NafJ4yL/tNCJPXUQrPc
TLSH
T1FE4523EB6095948ADE1587F81B88E001C7087EC6672F62F6EF43B4417FFD92A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 7abaabfcaa86742a738484926c74864810ad6a53b9fdf6fe92f1a37372000971
MD5 97d0d89d7a215cbda171f4e25d1627e2
SHA1 667d2a0b6be994ca7414f3c1d4bed6c2666c1fb7
SHA512 f1fb56516eeb07d1578ee5e225142a08b7330690200c97c98949bbb7fac3af7c25e116a3a743f2f58c2b6c011ca9b84d6b1c3c4f70be1da3b97f3e4fbabcdc5b
SSDEEP 12288:nNfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SZ:nNfJ4yL/tNCJPXUQrPA
TLSH
T1874523AB60D5948ADE1587F81B88E001C7087EC6672F62E6EF43B4427FFD92A159C361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 4e5791880b184cea50104d36cd7c20cfc8c6c69c43677beb807af05be65bac86
MD5 5b440c4f2c695e9edc1b01dafbaacfb1
SHA1 1740e17a1c634edcbc1c684e31010bde3872c058
SHA512 e36f15224ebbda07bb0f36e5804647b4a48c4c57095a3991a862c9321cf0ad215e3a266878ad0bc079d059e7fcd5e2ffd56a2dbac6ad331731ee88e2c3ffe7d5
SSDEEP 12288:cHfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7St:cHfJ4yL/tNCJPXUQrPE
TLSH
T17C4523AB6095948ADE1587F81B88E001C7087EC7672F62F6EF83B4417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 a38d83e4fe892907bad11436735efd6f4301c45e06dbe9af70c308ab025293a8
MD5 fd47ee0718ad02ed6f41216b5d72c284
SHA1 6c585b9a398fd6abee6e9d8905972d23f3543403
SHA512 7076b2ad2d4bb28208d0cdba0895685b2701ade59787774997c0c611fdb59a1dc170e370fe63b60d361c7af9ca8dbdf1868ef327acabdbd411af64dc58e52cc1
SSDEEP 24576:JfwvUk9RX6wkyAIJfJ4yL/tNCJPXUQrPw:DMnYIJfJ4klKXnY
TLSH
T10A85D02AEBDC44E5E177923C89A7860AF3B178591B31C2CF029A53AD1E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2d75a3eb44523bd46bff6f77f004e0436a2ea9efed6a2d9333e3d42e578584eb
MD5 b2b9b7c335e7942799ac8f5311aff51b
SHA1 a0e224af76af70ddc6a3cacd7a0a8690a8eb0355
SHA512 2c12d894d7f3e515d885a857af6d92b6bb36efba2804326a90d53b96dbfba4e3e8bde2b4b7f7f123b8f63992afbe71e2c51d0b6db2831375225622a01a2c141f
SSDEEP 49152:aYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ufJ4klKXn5:hySzPmfJ4k
TLSH
T17F066C96A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 283059116158c7b3a37dc69d8bedef46916251c303d425d5de7d95fb9c022501
MD5 03bd850a7e280484112881d730cf2d81
SHA1 27456b6cbd09ac20a7126ec24bb0c32f5dc898e0
SHA512 fac32a965140ee945dad84fb592f62368a639435759a9ce18ee3f6fe548b47cba08301518ee5da21ada613c7196ede59dfa8168a5b03ee0821878aecadf44ba0
SSDEEP 24576:+47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYUfJ4yL/tNCJPXUQrPS:+47JUQjTirIhCnDHUPfF/+fJ4klKXna
TLSH
T1B765AE1EA3EC01E5E1BA82788515861AEA71782E1F32C6CF1270837D6F67ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 dd682faf2d7bb959fc46fb831724a44c4874d41b1e074970f7d9a3c0efc3f981
MD5 2ff99615f4aab9197f7222dd41b5e6df
SHA1 f87f449552457f83dc9150c0073467b4de6bcc6a
SHA512 d2a9cce49cc7de1caea5f5a42ef2478a163405aa09d20b622def212582168b6f98fb9faac62644fee16fac9d9a91fcfb3a4a61265d094998da7d2a7c1fb0ecd9
SSDEEP 12288:xbsf1fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S8:M1fJ4yL/tNCJPXUQrPd
TLSH
T1FD55015AD29401D8C46E92B8CB449601F3237CA593E2E3CB97C1F47E2FBA6905DE9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 8dcd9fce9f280c3ad858b6801084b70b0b42d3bde4679ba6dde18703ac591851
MD5 b1683a63c0383b84a93db1e00b3c4d9e
SHA1 2225c8502bb4ac62c32e7e8a3ffa8bd006d78fc2
SHA512 60a562de0e19222b74f2aecedc2aad7548391973616facc59096e4415bd25cceea526d2c69193784116d48af71d012f10930f42e058c27343ce21328fbc8a595
SSDEEP 12288:ujCh8y5OjuyI/nAkI7z8S6zxUjc2yPtUUZNi2G7zwcAnYDvA+Z+Jp:u+8/lzrOxUc2+UUfi5zwPn90+Jp
TLSH
T18B552841766AC75FC6AD40326E32D2CCAB707D05EE056F0773C88B3F9576568BAE2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 d0c79539b7ac512b55a68ecbd6b36f6290d8456de8093a8ca96677a3b776a63e
MD5 efec5fafcdf63a52fed1a564295bea84
SHA1 a94a342a40a6bf951691fad039f2e75a7f697e4b
SHA512 0274840b3a7ee0338025cbe6a9f5124f1e619a302aab91a8d2f1642248efc77c9eec9a521b8744f8fd75da8a832eb861bb11de80b2cf3e74f5e5d601b700c9b6
SSDEEP 12288:8sH4pOALPMbMHma8mahstlVP09m1QFNNGh+8UAQO:8sHVAQvmWFNIA8UAt
TLSH
T11B65D7415137E39FD1FB50320336AB4DA774EC06B7096F26B388453AD86AB25B4B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b11827b62d456dee33fa2e51ec755f79d7f0706e7ef831e4271dab73882ba54a
MD5 783618dc0d63c90e052e7104020d7b84
SHA1 c7648f85c912d3e9a4d1206bb818f24b61aae55b
SHA512 67c3c4759e1580f6af87d63918e939f49ff3c1f8f76e8e1d7448d2946854d4297adab543e62ccc53f70f2720bcc26e791720fcf6379b322ce40b5ca8bd53948d
SSDEEP 12288:H079fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sr:E9fJ4yL/tNCJPXUQrPc
TLSH
T1AE4523A751D49846ED7687F8168CE000D309BED51B2BA2E3EE42B4853FFD9961DBC312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c41785c967a4ad6e24395004e9d93d9b84f61ecdc6de7302d55a195a1ac6cb91
MD5 161cc018543c62ae5f9f0f2a1294f19a
SHA1 acf0f1d7451cd233948e861cbfbcdb9c0556cb53
SHA512 8c9e50e5519d5767b9def1f58647d8faed8352399a004b6b4488f05f35a20a265a8c89938b843f18a6960de1e57901208f84e705b72f39fc3bc0396f056d2c4b
SSDEEP 24576:6gb6bmBIi49WNNFpg1rSvFv7bY7fJ4yL/tNCJPXUQrP9:6gb4mBIBhGFUfJ4klKXn1
TLSH
T16765AF1E22EC02F5E0F5D2B8DDAA4417D6B278160732D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 a23a6eb52112869039dc4a19e95241b14c8dc914e37429c4ca69c77604abc67b
MD5 b832f4c030308f9dd424e3a8de92185b
SHA1 51ef498a741d2409f9821aca7610c400b6226687
SHA512 f8316430c1cff9a0875b9f347daf2fcbf42331d806db3f1b3a88ceba94d40b81d73bccbb54dabd7d5ff29e3bf3f4731ada4730e4b1d346d1f5afa2484111d915
SSDEEP 24576:fG88u8FpJqH1bzria7/mEfJ4yL/tNCJPXUQrP/:u7ZFPqVea7/jfJ4klKXnn
TLSH
T1D285F16672E101F1D477D1388A868663F771B8151325FBDF0BA88A512F33AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 345b56e5ba7093db6f2d425399848db680bde8b67596838a0aceeb07d2860500
MD5 2efbbd6f7b80b3ff9ba44a4067481e7e
SHA1 d3f08999c5e22729b512ff319d3b83ccc6e3c0b8
SHA512 40c99648a71a38f27724237e51e7412d84947ebc6ffcda30a7da2a0895ccc40c69ea2c85a77a8abb15082845aa4d0aebc08d705a4df600b69c8f3736b45a11d6
SSDEEP 12288:lHvUrBFrEjwaQwfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SO:lPUr+NQwfJ4yL/tNCJPXUQrP3
TLSH
T1C565F16F22E818E5E676E17C8A858209E771B8921312D2DF02D1817E5F77EE87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 aa95c6602fe5c55a24d7a3843737732879d7254b2b7be418b877785971d60b76
MD5 23cba5df4d81b8b6a98a6e76ad5d4e82
SHA1 9c4a6eb6793cae908d9fd11195cd59052168c45c
SHA512 bad6a49e2d36c8660d3f351b0e9579d25fefdc69ec5d02cff88d6ad2f553c2bbddc4ac867bf7681fcd74b4e65c738d122ee1e785146fe61041bdb99ec982c208
SSDEEP 49152:4BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjgfJ4klKXnt:TG05lO43bRfJ4k
TLSH
T128D5CF6E62EC11F9D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a0751b03d2774ace024701a1cec15608753a057b907ceec8ccaffbf54a7a9c9a
MD5 d6223642263deea8ec79f1333c13ae28
SHA1 9d3b0cfb498939d5bc3e10d2a20af8871178537e
SHA512 8019e83aa09800fce373ae207480aa335dabb798703412ca40a4785e41e3a71d0abadd5c68a00e1e0753b358eee837420535cebb79e18548fbab5b622bc38fa8
SSDEEP 24576:Yfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnufJ4yL/tNCJPXUQrPX:ga5POZ3BJt2pasx2+mYfJ4klKXnv
TLSH
T19C65BF5EA2FC01D5D579D17CC583861AF5B1346653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c53b191f1dd31f150d3ee087064becb77baa13ad67f039dbb6e8ea0c54cd14c5
MD5 dd8df32e8eec35514f3bc67f19eda32e
SHA1 095a5769e5a322260fcf9f20adf5f394320a40eb
SHA512 4d258c0ef2dade0dd212e29c8574c244a56afb7912dc18f17acd8b9964fba34730d23094afe3000cbfbc4168caaf1824ba3384434e18969a83bc7ff8b8768d33
SSDEEP 24576:yNcwHdjbyQ4nLC18lb/EOjowL7FkcfJ4yL/tNCJPXUQrPA:yNc/zEOVHFDfJ4klKXn4
TLSH
T1E0858B2623E901E4F5BBE1BE896B9546FA717865133486CF0291811B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a99849bd9751816ea3b390db3bfd41d4823b5f7deb3352f49f53976d59fec2c1
MD5 4b7f726e711929462c7ddcb430247476
SHA1 d992c24466393c9c7f7506f37cea1a1d780b4271
SHA512 444516cc2ed46bcace630c434c7ecaaf8090b7d11c070574b41c670b3e40005d2779f5c1f2fcb857411f49c730e81616188e3674f07450f406bdd74a43d495f0
SSDEEP 24576:/TkNvNnaFeYhJNtmZBmzfJ4yL/tNCJPXUQrPr:/TMwBtOmzfJ4klKXnD
TLSH
T1FD55AF6EB6F845E4D1FAC6B48E238112E6727861073293CB9390C13F1E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 897b9c732dca50f5318c3ebdb568435f3ee3afb45babdce4ee313a3208fb83be
MD5 c5d98501a914c164291f1fec856b3fa9
SHA1 2ff0b72c24bd2228cb02e810810244b3a3fdf786
SHA512 fff00b6990b9e8b3e22b310f0550d9465fb2d8b9f8ac8d6d46110410652c900d5d05fbff27ddd0599901bc6645a9dc507af7f32f652b485b33a3e147784b6089
SSDEEP 12288:WQcMxWDXN1Dp/fshBItT1IQgAhfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+Gi:sD3FHshBIYQgAhfJ4yL/tNCJPXUQrPa
TLSH
T18C75E17EE69C04E4D57BC2BC9A538506E77138E9032266DB06D0D1B62F6BEE42D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1056-79-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1056-304-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1420-29-0x0000000000400000-0x00000000005EC000-memory.dmp

Download

memory/1420-6-0x0000000002370000-0x00000000023D7000-memory.dmp

Download

memory/1420-1-0x0000000002370000-0x00000000023D7000-memory.dmp

Download

memory/1420-0-0x0000000000400000-0x00000000005EC000-memory.dmp

Download

memory/2376-303-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2376-69-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/2376-67-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2376-75-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/3248-288-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3248-57-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3248-63-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3248-56-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3500-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3500-305-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3500-83-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3500-325-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3500-89-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3500-326-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3508-127-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3508-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3508-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3508-129-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3508-121-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4324-392-0x0000016824140000-0x00000168247C0000-memory.dmp

Download

memory/4324-322-0x0000016824140000-0x00000168247C0000-memory.dmp

Download

memory/4344-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4344-311-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4344-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4344-137-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4684-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4684-119-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4684-20-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4684-14-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4684-21-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4912-191-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4912-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4912-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4912-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5216-308-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5216-101-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5216-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5216-95-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5216-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5216-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5476-307-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5476-108-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5476-114-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5476-106-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5484-42-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/5484-48-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/5484-52-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/5484-54-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5484-36-0x0000000140000000-0x0000000140214000-memory.dmp

Download