c5ae389c76f424a969e5e0e258244291d91c00bea0b1a74ac96313e70108913b

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 11:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_b25db5ac7567ec87de6da4b9b8da8827_elex_redline-stealer_rhadamanthys_stop.exe
Size 1.3MB
Sample260910-n16ytssenc
SHA256 c5ae389c76f424a969e5e0e258244291d91c00bea0b1a74ac96313e70108913b
MD5 b25db5ac7567ec87de6da4b9b8da8827
SHA1 e529e234e577cd5d0994bee2393bf9a0216cfabe
SHA512 a496b26cfd3112b95cf072c9abf348e5963a3b17a9e820ba2b9758c850648ae85a1b58caea49bce2052c6ec266e98732fc5e2805383d4af1b1843b28c04702dd
SSDEEP 12288:vH1QlrqSvO3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:vVgqS23RsmyOkb/fT63m0JGsI
TLSH
T12255120577805033D5432A72B91CC1758E397A311779EA43B781BF6B7EB22E2DA322D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1616	elevation_service.exe
3248	elevation_service.exe
4344	maintenanceservice.exe
3548	OSE.EXE
4380	PerceptionSimulationService.exe
4476	perfhost.exe
240	ReFsDedupSvc.exe
6016	SensorDataService.exe
3656	ssh-agent.exe
1080	AgentService.exe
1988	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-10_b25db5ac7567ec87de6da4b9b8da8827_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-10_b25db5ac7567ec87de6da4b9b8da8827_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-10_b25db5ac7567ec87de6da4b9b8da8827_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\686c6df7b05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-10_b25db5ac7567ec87de6da4b9b8da8827_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-10_b25db5ac7567ec87de6da4b9b8da8827_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_b25db5ac7567ec87de6da4b9b8da8827_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a3501f61a41dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000005ed27df61a41dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000043a25b361b41dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1616	elevation_service.exe
1616	elevation_service.exe
1616	elevation_service.exe
1616	elevation_service.exe
1616	elevation_service.exe
1616	elevation_service.exe
1616	elevation_service.exe
3248	elevation_service.exe
3248	elevation_service.exe
3248	elevation_service.exe
3248	elevation_service.exe
3248	elevation_service.exe
3248	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1268	2026-09-10_b25db5ac7567ec87de6da4b9b8da8827_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	1616	elevation_service.exe
Token: SeBackupPrivilege	240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	240	ReFsDedupSvc.exe
Token: SeBackupPrivilege	240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	240	ReFsDedupSvc.exe
Token: SeBackupPrivilege	240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	240	ReFsDedupSvc.exe
Token: SeBackupPrivilege	240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	240	ReFsDedupSvc.exe
Token: SeBackupPrivilege	240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	240	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1080	AgentService.exe
Token: 33	1988	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1988	SearchIndexer.exe
Token: SeDebugPrivilege	1616	elevation_service.exe
Token: SeDebugPrivilege	3248	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 4288	1268	2026-09-10_b25db5ac7567ec87de6da4b9b8da8827_elex_redline-stealer_rhadamanthys_stop.exe	92
PID 1988 wrote to memory of 1716	1988	SearchIndexer.exe	102
PID 1988 wrote to memory of 4628	1988	SearchIndexer.exe	103
PID 1988 wrote to memory of 4568	1988	SearchIndexer.exe	104
PID 1988 wrote to memory of 5004	1988	SearchIndexer.exe	105
PID 1988 wrote to memory of 3488	1988	SearchIndexer.exe	109
PID 1988 wrote to memory of 988	1988	SearchIndexer.exe	110
PID 1988 wrote to memory of 816	1988	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-09-10_b25db5ac7567ec87de6da4b9b8da8827_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_b25db5ac7567ec87de6da4b9b8da8827_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /tn "SmadavSecondaryUpdater" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4288

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3248

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4344

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3548

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4380

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4476

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:240

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6016

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3656

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1080

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1716
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4628
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2756 2708 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4568
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5004
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3488
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2756 2708 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:988
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 434c43266aad0ad655daf52bd52b423afc1d396125fb180fe06144b5630c5fb2
MD5 11c6d2da399cfe6fad34db1b0c9728fc
SHA1 d3a58b4b0439ca2489753c64e0b3c7bb53649742
SHA512 388093fddefab410d99d16b3c5fbfdd13cdc7625fdab7163c115fee4e2f4dc50dbc5e8b6c5aa9cff3993616efad907f703725b771e24675baae1dfa19334f66a
SSDEEP 49152:Fb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn3s1Lb/fm3i:b3q6HjBeWLb/fm
TLSH
T1A8D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 e3958a7096d3dfc69e7b1e1c2b9cf45473af3a627640108eeb589adcb25969cc
MD5 d521493d566bc708d8dffaa908269b6d
SHA1 e933feb9d49276813623fbdc119ddbc883e03645
SHA512 29b3ae83cf6a840affa7d66d41ce12a3c71f4a5d3accf3937124fc9182f0154f937f83b15c5de2a2831d0d60080c8ff47f3ebab5c148053ab08f9f019eefc853
SSDEEP 12288:E1XLsswWkxy2lRq2czAbO3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:CXYfDtczAS3RsmyOkb/fT63m0JGsI
TLSH
T1F275012867D009F9ED67827DCCA18512EA727C554760E79F03E4EA250F332D8AE3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 08f5726853a906e1d5ca2ff23d315d5082bfc6baf187e777fa0f374bdbab1d02
MD5 f224b626f6b0dcb7206d4620d486399c
SHA1 5be58a46209739f7f8c08db905ff54e0434ea938
SHA512 58a4f485248881957214a024dd35e690785ca8409105f00d5c6eab7efe51f9ee5bfec8431b2dcc534dbb4fdbd66f4243fbb0d7ad22b61e108a9229900edb7e6c
SSDEEP 24576:h0Le5ji0hmxirMj3RsmyOkb/fT63m0JGsI:hPji0Acus1Lb/fm3i
TLSH
T104859D16F6748331D073C0B9C5D2A69EED7130865B308ACB4286D77C6E67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c69dbf2a22c7eec0bddd202fcac0557b8e478503540e88a5bbcabed65d46915d
MD5 dfdb60c278ccfdf6ff925a295f00a92f
SHA1 348ed52bb8dde68e13d66a7b2abf7e6ccb4cd867
SHA512 ea23ea68ad2b1a66d72061e2c4613591cd077c00f1b210690a2269b395ce3b0d1cd7bf786abd9cfd1f840a17897ef551c70cb24d40309cfb5225ddacfb270445
SSDEEP 24576:1a7/ezSC6vUyD/aqgrvWE6q8wyuF3RsmyOkb/fT63m0JGsI:8/ezSC6vUzPvxHjyys1Lb/fm3i
TLSH
T12A755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3a2531d065417f40f7b5add9f7b9fd1bc1af71061f1e97b5650c4c5582f9ce02
MD5 1b29d4bf0499c027ba912b1e5a10f13d
SHA1 76b610bbfba86e541f2a95230a2492d7cd80429b
SHA512 12adaaf309fcd21addaa8be080f107de2d17e6b1359d69ee09f63f42222722718b5db9b18d333d24fba46177912bc9a49636e497bf85928812613f41be205c34
SSDEEP 24576:iVbqPb88hv/l+6s3RsmyOkb/fT63m0JGsI:iVO88hXl+Bs1Lb/fm3i
TLSH
T11C55AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 0ee5383a2368ee5767ee55d490e3efec036f942cbed41ca563954bf495225cd2
MD5 88058e3f441df631a44e43d8a269f71d
SHA1 aa1093adcd50e4ade13a07040719bc57bf50ace1
SHA512 7519fd8e5a5ab1e0cc0603d9831800cbb6ee3d02070494b2033e492a6c99c897b15bb5b556bf41d7f424ae1e3db96d20a6235ad8c84fd819be8515b028682f0a
SSDEEP 12288:dR4O3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:dRP3RsmyOkb/fT63m0JGsI
TLSH
T1C95523450B5416B6FBD30BB28EC0A17A98B04F49B46A7F2F1AE3F6598C74052F53346B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 1ccf362a29115d993cd66201071281beeb2dc9dcd03eb45ed7dda22a26a301c5
MD5 237436d7b2799268f22300581d72f8b8
SHA1 9a466bd59422cfcb49bce6b1bf9754f727ece138
SHA512 3707d674a99c9bc855359207fcc516ca13f341368b4c48a3383758073365f3406ae7ed1a94b192391615115dc5e12cadd166af19395c0f691dd628925023e877
SSDEEP 12288:ReBNUbTVO86URO3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:RJIUk3RsmyOkb/fT63m0JGsI
TLSH
T1D675C03BAE28FCE2C27A4DB95A91C200D77278704B62A3CBD165D30EDE235D15E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 34b603afdaf491440c1f145c409843399601992eae85e72b6dd08838c19d195e
MD5 84ea0e3e6797f8f74da3d1058debffaf
SHA1 50fc903cdc6484d917507b0efdbfb736f59e93e3
SHA512 deae3e96c92f9e6a54b1c16b0c181bf013dac5b25ea39a83fadbea72890b3b70089745eb4cbfb9b7ded3a24864b5eb52e7e1190d18981399ade48747ab50eb54
SSDEEP 49152:qQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THN:qQvGAdlCEL8c/yRNw5CTWLb/fm
TLSH
T1A2267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 f52caf90ecfe76c7b64b05c9030b679a7812a360e1e818ebae20bbb3d5249050
MD5 d69f8f45275151915d1e7f1a32c8b6b1
SHA1 075b20e1795b6a4b09076a864b8b7824c5f9058b
SHA512 a4f46ad99f62fa7e08d41e3e7b69402b22ff2e96578d68f7df30079f6961b7b856cb3cec48ad5e2b8f792ac6b9bda64c9a7691e1298a307342613afeb353ecbc
SSDEEP 12288:lAwSfxL/2Dc34DLLmt0LDQewsAjnO3RnzomyOitl8FMaFQn/frKk63HZOVMxJSIn:GdewsAjO3RsmyOkb/fT63m0JGsI
TLSH
T16875E031FE74E036C3BB0DB21B25C716547C6A204B622AC3E3E8AE9D59701D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7f9d3286f3fa383524fe33a1fdb4fadf34b2e3c5fe8a85ea11f7eda25c49ad16
MD5 e6c9171f61256b74948b40280a3f3c9c
SHA1 3143dcc7414609a74b2de968f02ed8fe491fd27b
SHA512 96bae7576e37083bcb8103d107ce287718e0a935d0730892221db7a681fad150147e66843ccebd7ac05153d3c9c18a70d2f04fc9eb3879882a07882b068b7d40
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH2e:hUEtQevvqc2W1cpV2EI32
TLSH
T1DB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 73b733c2917569e4a7f0db9072c89acd02d8c822b863b2d0bb8f09db4110e854
MD5 6818f5c1c6aadc3c4e12ccc5391016c1
SHA1 f77b839ba9a7e088978fabd6e8e32d99ed29932c
SHA512 f26e29c47c83bf6934ebeb1bbb830385f7fbf43393fbc4f02e31b72063b79d226047bfa356a74971d207f0093965587073222547700ea87d07b70b78d2611603
SSDEEP 49152:xCbRquA/m2yL5zifFiV+XenmE3/zes1Lb/fm3i:+oqHVjnmnWLb/fm
TLSH
T103D58E0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7037a5d12de83b1d994bae6b45a968008a1b6b18b5636a05e16993ae61eb2f08
MD5 c4c9305161a75da0edb2e043b4ad65e7
SHA1 06c466c15b6e50ba6593c58c59b28f75b5797249
SHA512 0d8833e1463586b2539a02af6a94614e1b151a8aa05d77926f9527133d70a621f4fb8cf2e8803b5788027fe226456a3568f2974c000b6e1c3c65492d2acfaa6a
SSDEEP 24576:HAhGLJIFoiwtA5l7S53Z3RsmyOkb/fT63m0JGsI:HAMyFoiq53s1Lb/fm3i
TLSH
T1BD359D80E7F915D4F5B3AAB899B69171EA76BCAA5E31D20F2150D11F0E33A40DD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 04037a415f25b9b5efbeece1ae7eae72cbbff5f06df1ca326580e87334721372
MD5 bb001ef8520d7339bf2b89daab7a89c2
SHA1 21291853d4257116fea591d58f98a8306224dd8a
SHA512 cc88126f7ceac0fc2f13dd6900e8a77e01a9e456d719f69899db48819745f6a3997ec973376a50f689a75fe226068475b641fe49a0087837ec056b4854a7ef93
SSDEEP 12288:Xmw5HEjsChNVBFgl0WDm+CKO3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:2wuoOWC3RsmyOkb/fT63m0JGsI
TLSH
T16365F14537A41CF9E9A74639C987C136F7F2BC022A25DB1F1760D65B5F33221AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 3ee3f10f7399fa0d516590f86e88c9ad712269025eb8f3cfaee1eb5078a0a0c7
MD5 0c97ab5e0ec8c17341e21149a951adfd
SHA1 d227f1d607314fe2581d18bfaffa42fc83816025
SHA512 a369ba46314bcbdbc915afe37fcfa682afec75fa7c3b841040a1f6dbec47e340a073a98184d50bf1788e8ed05083346c88295b621efc88992638eaa9ab4117e0
SSDEEP 12288:fBZ1Iy3O3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:pZu73RsmyOkb/fT63m0JGsI
TLSH
T13755124923E421F9E2934279CDD09209D7B17D56233653CF1662B2695F33AC2EE3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b053c02438ae7f4954fa4edc0286340855e15329a53d6661e8edf4e98f87146f
MD5 faac3e28ae1a332a272417cbef8031f4
SHA1 41fc007bb48a9e025b49c1660e09de1104fd7a80
SHA512 c01e09348fb4f4c8a12c54a8c28e1fa0c40c06567cd3d223ede1cd1c7bdf503bb97f75b90feb2aaa4e659ee0b2c018e4e0e298e9fd2df5b33b28e353df2e8f88
SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UR:gQRQyi36YOcPQLvw2gAf+PN3kWLb/fm
TLSH
T1E0667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0c39906d3093d9d8e040aa5f5a317728ad534630d65d0b1ba93eb75e58a576a9
MD5 d5b32ab28bfe9411fac1a93e520c2d46
SHA1 893936e166da57fdbb9c2aa81f653c1e02d8de70
SHA512 c6950f6a46bb894d8019910f07a9c02ec04c01057a0621834b91e3b8a81e72251f38e46335d150e073d5d7e8337bcf76d2c6fa75d3bbfd3a9a7712cec8df9cdc
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UR:cQRQyi36YOcPQLvw2gAf+PN3kWLb/fm
TLSH
T154667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9bb89d0cd50a50cffcb959a871944632165bbb2db1e1f8e3c3c8922ef71af14f
MD5 3a2eac0a24627fee25f5a3f696b1267a
SHA1 62f5ad686f6881e1c983b3bfb6323a37e6291fb4
SHA512 2e5d17396d971eef780b516f2abc0ed61452b7337c8e283528737846437bf954e70a88e2e0c32fc6624e1e68ad0d6f06df469e6670b9ef34246f78850f6c70e0
SSDEEP 24576:vwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0r3RsmyOkb/fT63i:368Qg55nhheWu7PNU3/us1Lb/fm3i
TLSH
T1FBB54933B2F600A9C44DE1769F4A873196E17C758FE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 462dbe9183dc0899261f56a173e7f078d100bdf7c3c65b78fe03c6b708d47a84
MD5 9502f4d139b52c0a02365a5ad61a778d
SHA1 68990c69a0acc3c155fe62f823342009e3690668
SHA512 7be2cacaefb2ea8a01f243bfc3475dd60b33dfa50e20cfdfe51f9f2004b0e7b5f160a17c07c235bbd3ccf690c535f20af110e60a00647c272d428be52c41d91a
SSDEEP 49152:c3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99z:Zy5112gYy5azzVvL69nLKnhZZWLb/fm
TLSH
T116167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 30efe5a42fcabce1ec351f219917a6774f4df4d867a9ab1c5eb393adc1b164b4
MD5 7896f0f537678b8d8b38eabe8a7fe12f
SHA1 240589f859abc2edb14fac59f4d50995bddf2de6
SHA512 56dc888880f606563d56e8c9f77e3017cae3815859783dc4e4fb7e35530d6f984869348417aca10dc71c6d385e027f2898fb320dd3c6d4839b9d1ec826e8bee5
SSDEEP 49152:MB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glSs1Lb/fm3i:Gu6JmVxd2dSWLb/fm
TLSH
T1D8D59D13F1DA01E8D05ED478974A9233E962BC490B35B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c013404ffad35c28c1d6b1548e6569fc095d602e8c53f3e9d61050cfa774f23e
MD5 01ac9499b1b0eb916a081ad4b886f9a4
SHA1 60b79a2aa368ab5e522b89cfb94ac82054f071ec
SHA512 11ab6407e7877faca6e2cdea335ca87bf59718a400f34f34e5ecf86b34fbf91749cdde5259d037161441c6b660f177ca25f10de913ef53570a27e41d935e2502
SSDEEP 49152:z1hpsNoJpF1A6UU44CwH7R4xQs1Lb/fm3i:zmifPbRnWLb/fm
TLSH
T1BDB5BE13F2D801E8D05ED17887569232EA72BC460B35B6DF0A90B7961F7BAE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ae043fd6cb0ddf1219532d919a1fd6a1b6a75bb9ec7a5e6df0819ace0673c0ad
MD5 789446ee798105829f55fa0b7e68f149
SHA1 1638c3ff1408dd53dcfb924cd5e4cbbc924a1d0d
SHA512 28ee55d6f14d36989b208d6b02bb20b8ecf8d15e5db83c20ce7dff189697a67d5f31d1fbc7b8537a14eae74e9f047a1b40bd71d27aaf62663da22f990c381afe
SSDEEP 49152:tSuZQIY0Be2KRRVtOnks6NMHqVs1Lb/fm3i:j5dKTi61VWLb/fm
TLSH
T156C5BF03F2E901E8E0BED6748B659236EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f0e2a03939679440863e09d3c2adcbb309d57ad534feae5c11c75217a8832ebd
MD5 2f8716c28e8e40ae80f6a807741d879d
SHA1 f2c321539a87dfce365bb2d0cb05e1d5c1f1b211
SHA512 38d9833a14ca0b0809cd64ea32d3b57715926b48e76207b195206399342238c20438466c214994be1a0f5c1951d5e5495a345f5a81defb73d1c0a49f8ce7276b
SSDEEP 49152:1htSn8EApI0figngiDn0AP5w8s1Lb/fm3i:EX2iyphrWLb/fm
TLSH
T1C795BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 205b9a1fd415058f1b6bcc92ca0659a009d8c336985158396e50df784e0c4343
MD5 4fd6697b4d6e72062b934ab13864edca
SHA1 70ba5bd770cd45fda431cd9fac8f87815f03396d
SHA512 41f683a74f0423f82310059c32cbd61fd3e50388d925ba543ff332523396d978b99d1d08b916aaeb0b9d56a6c6f0fcb731bc78d75c2e0264dc88b4ee773808db
SSDEEP 12288:0QO3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:0n3RsmyOkb/fT63m0JGsI
TLSH
T1B55523440A5517BAF6830BB2CEC0A16998B44F8FB567376F2BA7F1158DB0052F5328BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 45ae492d8e5ff9b3b723aad0e5946a8c297b520ecaf075ae5ad559ed563ecf1f
MD5 fb204cda7cfa693ab732cdc5f2ffcaa5
SHA1 76ddd0fa40441e4e59bff2d02c6793aec3073338
SHA512 3a9da62f3147fd931099a4ee5d05e3b49b5cff4b714a87f437e2ba823f2474cd615c8c6cf517b67de99a2f17429383578b518aab809ee3e33b2c0cc6fb4bc59b
SSDEEP 12288:czO3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:cK3RsmyOkb/fT63m0JGsI
TLSH
T18D5523081A5417BAF6830BB2CEC0A16998B44F4BB567376F2BA7F1159DB0052F5328BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 9761c6a96829bbf733a7ae5e9ae572202f197e161301fb7a41b68601920fca7e
MD5 19fdea6d090abd99bb3e8ac9503d7920
SHA1 3468b5062adfa7b3ace79b3d240c164de22e4bed
SHA512 7ce76b674d29c632515b3a3101fc685b2bedeaa490b60aecbe88b9049c90445ca388985047c583ebdcea9248bbfbe2135b837b17b5a47e909b5267d6fd189b55
SSDEEP 12288:DpO3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:Dc3RsmyOkb/fT63m0JGsI
TLSH
T1715523040A5517BAF6830BB28EC0A17998B44F8FB567376F2BA7F1159DB0052F5328BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 12eb5a471a427f212ca88c986d74de41d44978b66526a14304c000fe71a018aa
MD5 350f4b9d16ffe4c8af40cc3955a33372
SHA1 e805ea969e7b54908fabed714882fde573e560e7
SHA512 1571ea2d45d5ac2eedd62813189e33d6fae24b8250c8f9faac3f690ef46872fd3ab05fdeb65c55e1d8be032c4b75ad3389ae406d020d30e325e0b833c405b0e5
SSDEEP 12288:TV+O3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:T3RsmyOkb/fT63m0JGsI
TLSH
T16E5523041B5802F6E99387B1CDC09129E4B07F8AB63377AF1B93B5194E70291F932E79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 1dd1574f967fc21ab9d93aa9d6e2dbbbb677ae7845772de7d5926007827f2484
MD5 6461d359f321e1a69faf51a1b4d7380d
SHA1 fac8120848e805243c8d5308bf652edbf8208e6f
SHA512 caea5d9fef9e34e314bdf8a1fb5d269528df7bc2b00520502dede5f24337f2be11b3709275a1eed43cd0fe0faedc18989f019269824378ed829c36dfdd8a2d0a
SSDEEP 12288:emO3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:eB3RsmyOkb/fT63m0JGsI
TLSH
T13A5523041A5517BAF6830BB28EC0A17998B44F8FB567376F2BA7F1158DB0052F5328BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a19b9ed3531116e7e7ddbe4f0bca95745797fa414d6f437f968a4651b02cc7a4
MD5 4815a9683cea5988061288368971aa46
SHA1 82ba964669d720c8fc1509c2d05a4a4866bfb979
SHA512 a6c15303d59ebaac6d2abbef20d0eab67d648d725fb7c48b36700006126d63e9fcb8c485f2756dd8d48b24c83a93982ffe085a4d1c9ac0e84dae2038bcea709b
SSDEEP 12288:8fO3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:8m3RsmyOkb/fT63m0JGsI
TLSH
T13E5523041A5417BAF6830BB2CEC0A16998B44F8FB567376F2BA7F1159DB0052F5328BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 73fde4197a0c8a88de461f2b5cf0343523c6c183cd7930e08e53c8f0a0bb205b
MD5 d278d8917fd40e1f66dde388efb36a5b
SHA1 6499f196646c33dd53abbe23e85dda6fcf4b93cf
SHA512 6f37e146a4fc829414fc60011b0535ed3c7fed0d8c1740c29ac2bca0277eb6ce390f8122f2373ee0e30db363cca8b2cc321c5037970c139d16b4799f7dc57f33
SSDEEP 12288:j7O3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:jy3RsmyOkb/fT63m0JGsI
TLSH
T1595523040A54177AF6830BB28EC0A17998B44F8FB567776F2BA7F1159DB0052F5328BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 d42d4ecae54b2e62c0528042c1ce3b5b0f5d207f19d7febba8d0adbbaa634ed3
MD5 7decaa83e4418dfea620e3f8df9efab9
SHA1 7c60405f13e8112c75048a317f00f672ae0239ea
SHA512 493ac60efd7749a3e713c4ad97c0a9fa6c8b3cfeb3b4e05182c6e9b1beaafc4ab8cc525700d3f9da6fba01cbd7cde72c9baa11d4ebdb3ece73cd0c839a4047ba
SSDEEP 12288:4iZwb6zzFEoS2cPvyTO3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:7ZMSzFVSOq3RsmyOkb/fT63m0JGsI
TLSH
T1E6750194739018F8ECA3823ECD518916D5B27C5A1B70C61F13E5362A5F333A15D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ad47d278cb10fbd004f28e5e7e5116cf3594c1506c4b156854241a801678d691
MD5 15905d400e3d7fd8279a3693fc132647
SHA1 63230fb3b4cf67068ed7e3daca345d46044c2d14
SHA512 eaed61df89ea44bd79f7ef412600ffe29338839d5ee0f506947f3b3223cc91959dbf60348a31804e3b2d8ba6463ccffdf308df07fb1ffed3df514aa8fc8d9d12
SSDEEP 12288:RkO3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:RL3RsmyOkb/fT63m0JGsI
TLSH
T1F55523480A5417BAF6830BB28EC0A17998B44F8FB567376F2BA7F1159D70052F5328BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a301bd28903b2077bfd523eab2d3ec4554aeb471643aeb06b51a42913ed478d8
MD5 e7a7c73095fd8748708b15853fd2f6b0
SHA1 065ff3c95eb852d870d1b46cfed25395ccd34260
SHA512 0e7bd0c85c0b7e08ffb11e9e09f2b4b6dec4a5cb61f3be57b4845327f6823a70acfc9bd40cfcbd2c6006f6c906a8ecbd89808bd72c53f181c7d470c29c33332b
SSDEEP 12288:DIO3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:Df3RsmyOkb/fT63m0JGsI
TLSH
T11D5523081A5417BAF6430BB28EC0A17998B44F8FB567376F2BA7F2159DB0052F53287D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 587c82b49af920c72c838aaa796e9ba5470f70a888c63c380f52c8d636bcc21e
MD5 cfe643e4e1b70a2ed5e175e792a02a0c
SHA1 5e14f3d4a82ab140b60a36b510cc148310cc0f21
SHA512 6623761013713879b8b17b34d1ed3f923b61f32b5a0662511ca1ca6a45c7c5528aa1e26f7a220ebcc80a58a29e77d915c3eb7bb3ee723c1be1755a1e366a8842
SSDEEP 12288:iyPz5L83O3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:/zye3RsmyOkb/fT63m0JGsI
TLSH
T1E565020723A131F9E1638239CC911A16F771BD3657219BAF17A067761E33291EE3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2b70b68167402a781ffbe8a30f1b08680166ee07b4e99175eee44f42a21831ed
MD5 4bc6b21c852e0ce6bf336ecb1543c71e
SHA1 37290fcfcdd218d44d9e879516f3ce4a7ab86553
SHA512 b18bcdb0b12d70ac0ef6fa6e9e68c94df3f65998ec46b6e9a8983883cf9a7c8a288f94c252f4d1b35d730a4b04eeb1bb9b2c9f670c1246105248553e15161216
SSDEEP 12288:MkO3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:ML3RsmyOkb/fT63m0JGsI
TLSH
T1335523480A5417BAF6830BB28EC0A17998B44F8FB567376F2BA7F1159D70052F5328BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 335f4bb06386c4ca5fb142d1b33cc830c5ee32627906a42306615d4af974e736
MD5 59ee213195f7e5b5fcb8d5c12abc2c79
SHA1 dd5dbd75cda650121fa3e6e15d26f522d0cd5d22
SHA512 4cda6de4162f6077b0920c8c81ca6d35cdca618bc54160b37fe492459bad4dca38006b76f6a666bcd83cb8a9c278570598ab363a9b56c002e95cdfa7dc6c5edd
SSDEEP 12288:/kO3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:/L3RsmyOkb/fT63m0JGsI
TLSH
T15F5523481A5417BAF6830BB28EC0A17998B44F8FB467376F2BA7F1159D70052F5328BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 d10f080b3ccdd162e79379b7f9db5383343db43c60914ca377e5cfc22bfc6a91
MD5 f8f8d1051b909d7c95f39e56e0cb8d39
SHA1 75bb2ce8613d147244355d52696afcffaf2cd2b8
SHA512 968a2bd272530f059520d8e072ba7540acf0594edc940a2aaa8e2e93abde0f8be0cc0b0316ef62b0b65478a848a00814fd17b0700e0e08ff92f10213a293008c
SSDEEP 12288:XyPz5L83O3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:azye3RsmyOkb/fT63m0JGsI
TLSH
T1B565020723A131F9E1638239CC911A16F771BD3657219BAF17A067761E33291EE3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 f91280b05e84ef77947d5098c22b3463da342dc7b21f7f939ff4db7d048556b1
MD5 93257cee43082edf3f2ef408775a136a
SHA1 1ef01fe95eaec1b5a8912c9b0d2e973be03a11cb
SHA512 baf76dddc2bc72a4852881e3861a4a653bbbe9183e8672364f3f29e0c9dc54563c1c34a67f10bce5172403d4ca5f5076c6c7737db99441e4d97736d0157fd425
SSDEEP 12288:XCd9eWYoaLHF3z0z04PDvhZO3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:STHaLl3z0zDM3RsmyOkb/fT63m0JGsI
TLSH
T1DE750194739018F8EC63823ECD518916D6B27C5A1770CA1F03E5366A5F333A15D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 421abd43f5f2bac0801bf0be8c723bccfd6cee23bc91b6b3243c209a37a72ce6
MD5 ef5a064cf07fd4b941283cbae4546435
SHA1 550e3b0be164560fe617781ece5378ad2cbe01f4
SHA512 2ccb915cd8f89f8208e943902697e5add4a83b5f81a564fb46491fa3b4c8e4df1a5aa634df884de06cc37b6b963ee4debdf070efe1b45e06e29fc20c9e22adb7
SSDEEP 24576:237d9CHKy7GZ43RsmyOkb/fT63m0JGsI:Y7d9CHKyaWs1Lb/fm3i
TLSH
T1E485CF90F3E414E8F1B78A35CD629512DAB67C5A1B31DE8F03A4661A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3a6c4e881696b85a67e8701512192541341b6479b44e209e6d239dcd0f9121bd
MD5 1d63f39c15e3b3bc15e141b6c698593a
SHA1 075d751271340a9d80384dad64233d149a3d806b
SHA512 cda5aafefe738026aed3fc1669aaf0dc014d0311c16d3a99f81bf80c773cf58c53faadbc4387f0e583f8bda734af67b0c6a82d95f200d19d3480c171c32e89e4
SSDEEP 12288:WJO3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:W83RsmyOkb/fT63m0JGsI
TLSH
T1745523041A5517BAF6830BB2CEC0A17998B44F8BB567376F2BA7F1158DB0052F5328BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 5d458d648b6541bbb33ce72e99ae754aa1d796a2edcd3cb584d69911c218af87
MD5 fecbcdd0f4624400c610999a555b9ad3
SHA1 ae60602b5f7ea348fa97a4a25158d8f249b9354e
SHA512 08f17dfd0e0e5caa63239729163da8df4b746f5c9f4c2d396aa0c475916b8cd91e1fa9cc217e31de331f8a93ec2174b7564622e1b7a77118ec85c4f72fcecd9b
SSDEEP 12288:tXO3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:t+3RsmyOkb/fT63m0JGsI
TLSH
T1CD5523481A5417BAF6830BF28EC0916998B44F4BB467776F2BE7F1158DB0052F53287E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 7f6fc50831d6d16d3c5954a3e9f1b943bbb048ca85d2db98c8f6e33abe7b3370
MD5 d8f6905da692517a55e5fc6a0725fb36
SHA1 a2d09f82f6653f7f75d83266a4a82c14b503108c
SHA512 3e91552124fb9053aed2355ef2c97d4b6e8afef88657a9eb668aa313fa32410954f8c920eabd231dcd092495546af1301a568982ec86cd177e6582940c1bc5c7
SSDEEP 12288:iyO3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:it3RsmyOkb/fT63m0JGsI
TLSH
T1595523040A5417BAF6830BB28EC0A17998B44F8FB467376F2BA7F1159DB0052F5328BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 7541fdcccddf290c4ef745d077309d26ea14337d646e647d2e7001bcc2260fe5
MD5 a738b43fc5a48031bc859125dc54d5fd
SHA1 b65fc9abde0f202ebc5165874cd68d2295f9b3f3
SHA512 5c9293bc49a909101da4e435db59238f964be57d23bbd3b97810325890c2e1216a99ff28525edef2060b7e28a878df9aa6244c34dfe8466a96288cd6e06c373d
SSDEEP 12288:ekO3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:eL3RsmyOkb/fT63m0JGsI
TLSH
T1365523481A5417BAF6830BB28EC0A17988B44F8FB567376F2BA7F1159D70052F5328BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 d1f18eaf74aec00db1303696e11b7023de703d7290506a187fd113da4e1ee4d2
MD5 7cf1f4492b0974d28fe05e49345a14b6
SHA1 7f6c28454a80d7ca3fade4dac2ff8ccb939a79f6
SHA512 9219641686dd517cbc5cab116591111d00c56704cd49bcfdfc52f54a1112837eb792485c215826d2336e1ab3a77964fb51a8a154f729ddf1150e6b1bbf5b1b90
SSDEEP 12288:5JO3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:583RsmyOkb/fT63m0JGsI
TLSH
T1EC5523041A5517BAF6830BB28EC0A17998B44F8FB567376F2BA7F1158DB0052F5328BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 eaa6ecf136b961f972fceeda7a50850df1677123f74e4f853d5d761b73836f28
MD5 0a5d201ccd2274d9470e8648f5f69df0
SHA1 931f987b33545fe41f03214edd45210caf4b8a1e
SHA512 9d2c69ae29655aa6dfb692cb75bef8df6541152d2a572b71cf06f704157c1d116a2a269f6b60e231cec2a33809189ef93a314106985ee991787e45f220b91b1f
SSDEEP 12288:3MO3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:3T3RsmyOkb/fT63m0JGsI
TLSH
T1605523081A5417BAF6830BB28EC0917998B44F8BB467776F2BA7F2159E70053F53287D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 91b4ce6a3670324aee676052411a04acb9004b5105eb5ec1da32066b6a7a88e9
MD5 b4b7411dec154c72dfbc91da2fc173d1
SHA1 60cc3f0116da79f13898c69aba2624ad6d5d4ce7
SHA512 fba68518960f0d1496af91ffe3f46f32dbdf744adb0d599a673925ad7ac255786c6ac30b330f7642c1b67c4924ec37ee028b181320243ff518ef6a67cf914301
SSDEEP 12288:3mO3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:3B3RsmyOkb/fT63m0JGsI
TLSH
T1DF5523041A5517BAF6830BB2CEC0A17998B44F8BB567376F2BA7F1158DB0052F5328BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 f2aa1a509f12990b9e83bb64dcef446e8856b5fcbadfd9742877a389123621d4
MD5 0ec48e302b476b05c27408e1e558f4a5
SHA1 81225950d8fd1016baab9b61d45c912f41cfa070
SHA512 df31853297dfabe74c402a86cc819d4acff948a79a7ea4b854c183eaf01f2135a7d8de1effad55ce70b81a7a73434d450eb7ebb79084407f8a5923dd858f8832
SSDEEP 24576:gfwvok9RX6wkyAIv3RsmyOkb/fT63m0JGsI:oMnYI5s1Lb/fm3i
TLSH
T17185D029EBDC04E5E1B7923C8DA3460AF6B178591B31C6CF129A636D0E37ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 06ac80fb10819da9908860d68668b539c015b0b216c875e37a50458d449c4436
MD5 a7439129e2ed0f2ce307e775cde56755
SHA1 80fc51abb6be7ad79e5add24dbe23a64df43ce50
SHA512 8336291a41be9b29e1db8b793bc2bafb5804a93f616fdc9f60a97816326c262ade5dbfa1d7bc3879fb9fd4084dbfbba95b8f2d74d57fbb05ffbc4dba2a0f577f
SSDEEP 49152:HYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0cs1Lb/fm3i:jySzPEWLb/fm
TLSH
T1D0066C56A16801D5C1B9C1B98F0BCC1BFAB134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 58ee4544986dc75088a23d354114c62840787d6a10b8c3b3c2b844abfa5144bd
MD5 5db71cad9ccb9404d52f3ffcfcec1111
SHA1 5f9e2785d7a68f1a76eb0d9dde6a06c014a97c4a
SHA512 65604c16f8de930420392cbce91a97c1bcd980c0d4645388a837f597c2b149f7050db854646ba8e09bcb99b6a4c473d49045dba71cd473f4d373443a74aae7f5
SSDEEP 24576:R47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY63RsmyOkb/fT63m0JGsI:R47JUQj1irIhCnDHUPfF/ss1Lb/fm3i
TLSH
T11A65AE1DA3EC01E5E1BA927885154A1AEA71782E1F31CACF1270937D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 dc26c328bb38c9558cd23eee62eaf2a2fcbe59de3efd8f9ac16535005c3f98f5
MD5 e796bdbc441a09fee5e5daa895b875a0
SHA1 82d3fc6e8eb154ed96f7240b7f43bdc9f5545d5c
SHA512 e6550ff4e6265df019fe6c33f7457bdef8b0e75fdfdaf403d2f2605623a500da202834af153214bc18a3ff80973f2fba66fdb033c51d2412f7ae8ffc5d02bfe3
SSDEEP 12288:dNsfUO3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:y73RsmyOkb/fT63m0JGsI
TLSH
T1F865F009D29802E8D06E6275CB818641B7337D6593E2E3CB17D1F53E0F76291ADFAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1016KB
SHA256 58b801744d03451ce0f75aed349795652f1bf079f03fdee4b1f54ab2293564e6
MD5 9e3171e612809a431d6e687d38564e35
SHA1 2e1f4496f65d94d38db4d4d4e6ecba5835a20e1a
SHA512 96cc33f4445611c12521e66e8e4adf68c49c9e671330395841a5bb1ac2877fafe9f00fd40d77df2d3c1a3106a71fe40d2f36dcf77b24cecc788556a0959194cb
SSDEEP 12288:K3r0QKWU3fr70wBvoinn0F9jzH+JAf1NdMfNbzTK:K3QQhUPr3B10L30AfLdMfZzT
TLSH
T178250800762AD75FC6A940321E72D1CCA7707D51EE05AB0773C98B3FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 c789bb39efec8bb1d061635e3641a62b7c5ad0b04219210d38cecaa5e7c2dc79
MD5 0480c207c8260bb30fb0fb8ec541b750
SHA1 ae0abf6ef5e9941869f99d612eaa7b3eb431079b
SHA512 0a3a3717aea4c067fab87a24a17ffef7e8978e0ca6134621f701577b866c0932fc8072da5521db8994ea3e158217de50e1cd2bc74bf0ac0cdb6a161cf5f800ab
SSDEEP 12288:6MLQSdtDABfVq/gjaZPb4CggQ2ZBHjgBmMAvHRnQYBzQI71M:6MLQyD2cgja9MC7ZNgBmMMH6IzQ4M
TLSH
T17465FA81A537A39FD1F76032072A5B4CA7B8EC03B7455F26A3C8443AD866765B0F93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 9c8218609af9d77d8dddc73884cc64aaf83c8f8df28165df1e386d277dd1b7ae
MD5 6a904e66907d2e77bd0525563e02092b
SHA1 0b60ff42b17d00549c38359348fdf1702c828377
SHA512 f20a5956c0a1b050e1c89b9feff239fcf043980d66010f9dc26e165815df09fc70c869f8567c2f595a6b7b43a2336b727711161c8d6683500766e9b3b58f1ec5
SSDEEP 12288:1z78O3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:tD3RsmyOkb/fT63m0JGsI
TLSH
T13F55230107581B7AF5A30BB18DC0D13964786F5ABB16A6EF7A53F2559C700C2ED3292F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e00edb5a0658cabd6cc48c8f2d16a632ec706076bee9ddf1bf167d17c75acae2
MD5 050a926a9ddc58c3a7e8c0ce1a563384
SHA1 225fb56a6678b251c5be0a2cb41c11703dfde146
SHA512 4f63b16791861d300308f79cb8b828b29b8b8e54582528d065c9687d14932e06ff1ad44ed8606c6432066780d6d100fa9b5d90d7a2eba7cfec0a4983a07eaa5c
SSDEEP 24576:Tgb6bmBIi49WNNFpg1rSvFv7bYF3RsmyOkb/fT63m0JGsI:Tgb4mBIBhGFas1Lb/fm3i
TLSH
T1F465AE1E22EC02F5E0F6D2B8DDA64417D6B278161732D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 428b8553faeb07d043def082012e3609cb76288234eb099c583eddc57005a92d
MD5 c84a3ad4415582589eb045cb3464199a
SHA1 44aaa531546153d4423c742718f30fddadababb8
SHA512 cb3b551e4b3cd479935018b99ca0b7d36c9dc2a332baa2946aaae48327163f1f93d09371f0e23931ba8a63d56d7d61fb59193a053d1157163530b8644c0e506a
SSDEEP 24576:yG88u8FpJqH1bzria7/mq3RsmyOkb/fT63m0JGsI:p7ZFPqVea7/bs1Lb/fm3i
TLSH
T12E85F16567E002F1D477D1388A824663F6B2B8251364EFDF07A89B551F33AE14B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 c52444881b40a3d7cd9a5f85b3758952fa0152447a876fe8e916694fdf34d8fd
MD5 ded3063298359203fa6fecc3cf4212b1
SHA1 21ca6f8150efc9a03d3e72b8aac97e6313b3ca13
SHA512 776c117a0b3fffbf68e712d5cc2e7d6190a21a2b6d6a905c8d5928fbd10f9e5255ccd48af0d84566b77c5d416c59b2ab18f30e011f8f2d02b6ea355515950bb9
SSDEEP 12288:xHvUrBFrEjwaQvO3RnzomyOitl8FMaFQn/frKk63HZOVMxJSICsIe:xPUr+NQ23RsmyOkb/fT63m0JGsI
TLSH
T1BD65E11F22AC18E5E676A17D8981871DF77178621312A2DF02E1917E4F739D8BD3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 060beddfd581c242b4b1e28baed502eaf0195ae9c8ca01ffb4c38ab0cd896bda
MD5 c86d09823f34a2292da530f09a2b9062
SHA1 ee07b2794479d761f69dd32af03f5b2bcaed3179
SHA512 d3cd10fc1849b05837380e8820fc6f0ba54d754ec611f15a5ed9cdb67b68a1f0b67329ed3dd942033a613c3d461e5719500ba2ae744e46c2b0c6f4f27aab3617
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjGs1Lb/fm3i:OG05lO43bRWLb/fm
TLSH
T1ABD5CF6A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4A57E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7901a35f28a69fea716be3a25d9df3be0f3d99a455d733b5a1afbdc3ebd39ffc
MD5 a801143fcfb12aa8abdd2ed43d1d3f1a
SHA1 d1edbc193a4c6e22c167b02ed2768f927a290974
SHA512 2de4e05bb01769c1a19b93dab514af4a2014818285f81c1819a45f80b5571fd2e3f062156bff178fcdd04ae5187ca7c2a2c8900aeed4c44b9a176c350ccd3048
SSDEEP 24576:6fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnA3RsmyOkb/fT63m0JGsI:Sa5POZ3+Jt2pasx2+mus1Lb/fm3i
TLSH
T1B365AF5EA6F801D5D1B5D17DC583861AE5B1342653329BCF022182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f2c252c2be2de5d9a64ceaa9aaf7ba5ea82196dba047db2da1a62f77d2475bc2
MD5 8f369d090a6fdb0cde538f9f20d99dec
SHA1 aec7d606c7b446a9ed27ac32432d88864e92b651
SHA512 48e3522dd5f0b3fda183d73ac4aba608e8907333ad12ee7d3b2b5445233675195cb2d4b5e12990db217587fba420bf81321798a924a92cb68f2fd8722ce710d2
SSDEEP 24576:lNcwHdjbyQ4nLC18lb/EOjowL7Fki3RsmyOkb/fT63m0JGsI:lNc/zEOVHF7s1Lb/fm3i
TLSH
T161858C1623E901E4F5BBE1BE89679546FAB1786553308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d07990c07ef665b301edecb889cd3caaba26ae30fc184009cf2037c38a7335b9
MD5 f94d0fa22cabb0236db4bf28023d76e7
SHA1 2d51f844281a7dc81b1d72eccebfb799c813c58e
SHA512 b3297858305966c2513cda512b85349b9348703fbb2a8f7d3b341cb886169f0a037608a0eaa606e61348b25376432017c89a977fd542d2d7bdb67d8ab9a613ef
SSDEEP 24576:28kNvNnaFeYhJNtmZBmm3RsmyOkb/fT63m0JGsI:28MwBtOmGs1Lb/fm3i
TLSH
T10F55AF2E76B806E4D1FAC6B5CD238512EA727861173293CF5390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 087894fd348c86bdaa770694410f88c95224be554ff9fbf83281fe7fcf386f59
MD5 9bc31f36b3d7ac2581649989ab66a123
SHA1 b43b082febe7380dec501b1e365d4dd27a766f1b
SHA512 ed4efe102017c0b01992b5b1ea04d254ebd4f4c804096dc2a93883edc005daae0f13f8ac71f5e4e9c93928ff338801ae67e86df67d749ffb50abd766ef6a62ae
SSDEEP 24576:OD3FHshBIYQgAH3RsmyOkb/fT63m0JGsI:ODVHeBIAAhs1Lb/fm3i
TLSH
T1A575E03DE69804E4E57BC1BCCA538606E67138A9032266DB02D4D1BA5F7BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/240-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/240-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/240-330-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/240-92-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/240-98-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1080-130-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1080-138-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1080-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1080-136-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1080-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1268-1-0x0000000002380000-0x00000000023E6000-memory.dmp

Download

memory/1268-0-0x0000000000400000-0x0000000000607000-memory.dmp

Download

memory/1268-8-0x0000000002380000-0x00000000023E6000-memory.dmp

Download

memory/1268-7-0x0000000002380000-0x00000000023E6000-memory.dmp

Download

memory/1268-48-0x0000000000400000-0x0000000000607000-memory.dmp

Download

memory/1616-90-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1616-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1616-21-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1616-20-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1616-13-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1988-152-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1988-146-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1988-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1988-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3248-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3248-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3248-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3248-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3248-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3548-238-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3548-64-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3548-58-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3548-57-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3656-115-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3656-123-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/3656-117-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/3656-314-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4344-50-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4344-42-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4344-55-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4344-53-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4344-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4380-70-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4380-307-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4380-68-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4380-76-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4476-86-0x0000000000A10000-0x0000000000A76000-memory.dmp

Download

memory/4476-311-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4476-85-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4476-80-0x0000000000A10000-0x0000000000A76000-memory.dmp

Download

memory/6016-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6016-104-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/6016-315-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/6016-110-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/6016-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6016-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download