Analysis
- max time kernel
148s - max time network
156s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 05:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_0b9b58bd89ec1b6537eca0e047e1f0a3_elex_redline-stealer_rhadamanthys_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
18 signatures
150 seconds
General
- Target 2026-09-29_0b9b58bd89ec1b6537eca0e047e1f0a3_elex_redline-stealer_rhadamanthys_stop.exe
- Size 1.3MB
- Sample260930-gd43ds1fre
- SHA256 4c481308ada55ff0a56739e822ac50dd8c26423429944d5b5a2e0b5f82d5b604
- MD5 0b9b58bd89ec1b6537eca0e047e1f0a3
- SHA1 db24e14bd85a655ab57e8148fd9a2e6d29950cc7
- SHA512 1428457ca47f1a3c7b87273d0782db2486021ce15a575e7a312c29114f3b3514ebb91a3b49e24abb477513b58e28d5502811324c455cd83fef8d19a6ec61dcac
- SSDEEP 12288:f68GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:i8nQ/tbw/2Mkjy6Fr7g0oC
- TLSH T1F35522647950F473D91B04B54842C6A1AB3F0C913BB5DB8BBB89173F8B383D05A6B389
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 4352 elevation_service.exe 2940 elevation_service.exe 2424 maintenanceservice.exe 3492 OSE.EXE 5716 PerceptionSimulationService.exe 2952 perfhost.exe 5220 ReFsDedupSvc.exe 4936 SensorDataService.exe 2632 ssh-agent.exe 4428 AgentService.exe 4304 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process \??\F:\ elevation_service.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe \??\F:\ elevation_service.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe - Drops file in System32 directory 45 IoCs
description ioc Process File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-09-29_0b9b58bd89ec1b6537eca0e047e1f0a3_elex_redline-stealer_rhadamanthys_stop.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-09-29_0b9b58bd89ec1b6537eca0e047e1f0a3_elex_redline-stealer_rhadamanthys_stop.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-09-29_0b9b58bd89ec1b6537eca0e047e1f0a3_elex_redline-stealer_rhadamanthys_stop.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-09-29_0b9b58bd89ec1b6537eca0e047e1f0a3_elex_redline-stealer_rhadamanthys_stop.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\51d95e1931e6882f.bin elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-09-29_0b9b58bd89ec1b6537eca0e047e1f0a3_elex_redline-stealer_rhadamanthys_stop.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe elevation_service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-09-29_0b9b58bd89ec1b6537eca0e047e1f0a3_elex_redline-stealer_rhadamanthys_stop.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 5172 5060 WerFault.exe 90 - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain elevation_service.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-29_0b9b58bd89ec1b6537eca0e047e1f0a3_elex_redline-stealer_rhadamanthys_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072adabc49e50dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008a8b93869e50dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072c027869e50dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4352 elevation_service.exe 4352 elevation_service.exe 4352 elevation_service.exe 4352 elevation_service.exe 4352 elevation_service.exe 4352 elevation_service.exe 4352 elevation_service.exe 2940 elevation_service.exe 2940 elevation_service.exe 2940 elevation_service.exe 2940 elevation_service.exe 2940 elevation_service.exe 2940 elevation_service.exe 2940 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 812 Process not Found 812 Process not Found - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5060 2026-09-29_0b9b58bd89ec1b6537eca0e047e1f0a3_elex_redline-stealer_rhadamanthys_stop.exe Token: SeTakeOwnershipPrivilege 4352 elevation_service.exe Token: SeBackupPrivilege 5220 ReFsDedupSvc.exe Token: SeRestorePrivilege 5220 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 4428 AgentService.exe Token: SeBackupPrivilege 5220 ReFsDedupSvc.exe Token: SeRestorePrivilege 5220 ReFsDedupSvc.exe Token: SeBackupPrivilege 5220 ReFsDedupSvc.exe Token: SeRestorePrivilege 5220 ReFsDedupSvc.exe Token: SeBackupPrivilege 5220 ReFsDedupSvc.exe Token: SeRestorePrivilege 5220 ReFsDedupSvc.exe Token: SeBackupPrivilege 5220 ReFsDedupSvc.exe Token: SeRestorePrivilege 5220 ReFsDedupSvc.exe Token: 33 4304 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4304 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4304 SearchIndexer.exe Token: SeDebugPrivilege 4352 elevation_service.exe Token: SeDebugPrivilege 2940 elevation_service.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4304 wrote to memory of 4932 4304 SearchIndexer.exe 106 PID 4304 wrote to memory of 4196 4304 SearchIndexer.exe 107 PID 4304 wrote to memory of 2000 4304 SearchIndexer.exe 108 PID 4304 wrote to memory of 1564 4304 SearchIndexer.exe 109 PID 4304 wrote to memory of 4156 4304 SearchIndexer.exe 111 PID 4304 wrote to memory of 1256 4304 SearchIndexer.exe 112 PID 4304 wrote to memory of 5808 4304 SearchIndexer.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_0b9b58bd89ec1b6537eca0e047e1f0a3_elex_redline-stealer_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_0b9b58bd89ec1b6537eca0e047e1f0a3_elex_redline-stealer_rhadamanthys_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5060 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 4962⤵
- Program crash
PID:5172
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4352
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 5060 -ip 50601⤵PID:5232
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2940
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2424
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3492
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:5716
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2952
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5220
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4936
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2632
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4428
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4932
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:4196
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3000 2996 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:2000
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3032 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:1564
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4156
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3000 2996 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:1256
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3032 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:5808
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 d1e7c8588c5fc1b42b047227007279e15a2a6c39ad4c3a72d1f939b236662d5a
- MD5 e4eb8a9f4d9c5a4f9ff9f223387b35e8
- SHA1 030ce1f014686e86dc9e2ebacc0e647b7c9d4bc4
- SHA512 938d4603b44b0ade210555d259603455d077f9dbcf3a9be2bd2721905550f7dbc4121176a0b75bb2efd6ac9be5d460c0de42574dc2debcf818149710acdd2671
- SSDEEP 49152:nb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnUQ/lFTjN4:V3q6HjBsLm
- TLSH T1ACD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 6df571f9dd55824215e223b5ad7a7fd52469e66d1de9dd37bad4c53f4e023b5d
- MD5 c7eb950ed7bcc30abe419ea972b5919a
- SHA1 c29db80026581cd148500242e493e09ed2512867
- SHA512 8e979dbe756bcced3f63cec824544fadab3369b3aa3670b7e638aac0fed0512654c420750353ff4ba144404fdf88bebc105d31a39011cd9e04a8303aa8c36ebf
- SSDEEP 12288:n1XLsswWkxy2lRq2czAzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:1XYfDtczAjnQ/tbw/2Mkjy6Fr7g0ob
- TLSH T1D665F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 0b754d0ac0d890deec0a50388350b49fac8b7f90a56897f0f9c95c8a8e70bfa7
- MD5 b5f871f16e59d1be85cfd8d2fdb190f5
- SHA1 82c9735b74fc4616c7cb2d5df11af05c9ab7b6e8
- SHA512 d6a7249d57b20fa4c3cb103d47598db1690e81f6a7dd43d8078f6064633799d41f90cf3730b0585949d6ec97b77ef00d277fb363471f5a6e8248ef5aac9b1734
- SSDEEP 24576:y0Le5ji0hmxLrMknQ/tbw/2Mkjy6Fr7g0oO:yPji0AlVQ/lFTjN4
- TLSH T120859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 b264da1fa49e049335c471de28d3ecfefa497701aad1505aa06a5760920856a6
- MD5 e0e3b3616c5950362aa40d2f9cf61755
- SHA1 c5dd868cc844261acfcd7ff2227e06ff1fba805e
- SHA512 4e8a9a0ee699d1ebedcb942a0c4a18f03fe1269a2fda9b63a276d77419ad5b9f31cdb470b7663c2204c703a9eadbff15628d5b5010e669f7b3f166179d5eaae0
- SSDEEP 24576:Ka7/ezSC6vUyD/aqgrvWE6q8wyumnQ/tbw/2Mkjy6Fr7g0oc:9/ezSC6vUzPvxHjyhQ/lFTjN4
- TLSH T130755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 5572556f2d415ed614eaddf1b03696cbff4e325f0c4083cb59a9cc81a9bff058
- MD5 8670ebf703d3f7f07ccdb52157525d53
- SHA1 837061178ec9f04fa62d663272115f1116bee276
- SHA512 9068304a3e4caad5f459163ab1d550b62c908cb65d66009e4e02bea05ac35ed671ba13f0449c1983ac8f0159a73faac46c26b2cc15a40260e569e09669304434
- SSDEEP 24576:iVbqPb88hv/l+6TnQ/tbw/2Mkjy6Fr7g0oy:iVO88hXl+gQ/lFTjN4
- TLSH T156559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 a2bbbc64625226b85c83daac9c50a927e37f6e225f9443c28829d25891c2a8d5
- MD5 ce370512c7ca5c7804246a562f4bf693
- SHA1 badc9a8b48bcd225be3f40b8669212885634da1f
- SHA512 1a5c9513a90c6af65ef9b3ef6be01ac19fc86db10c381beb3fe9fc2ceda98e700148fc7b02c8e99beb37c035fc7fa56cf58e3c98b5019e5cd012e41cb4cb21e1
- SSDEEP 12288:fzYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:fzYnQ/tbw/2Mkjy6Fr7g0oT
- TLSH T1165523796A24F887FF2B06B15CC284826B7B0EC1BFD4A74E6B44362D857C39446DB381
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 09a843b6fe51c84887194d49d04b8913e4351ddf36d89fb6318adbb6aff4b64a
- MD5 45eebe4392ce2449508c378f58144f3e
- SHA1 fe40f75e5281ea57a6a51949b2f9f1b17c78b96e
- SHA512 3db39c53ef44575f41cd0d37e711877d95825f26e72145c962c6316f423e70c3f1859011a7427985db86ec45380c9ed73613a88bba63bfd1ad475913be5ee0f5
- SSDEEP 12288:qeBNUbTVO86UrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:qJIUbnQ/tbw/2Mkjy6Fr7g0oS
- TLSH T14575CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 7ed99bae0502929a818d28d6eba13bde6ca7686f8edb3e4180d52c71cb581469
- MD5 10b143fe865ecd42b273cd44cf91ec3f
- SHA1 bad62eedf08c21f2ffa7c5a046ddccc29e29ade3
- SHA512 e05da0120940a52ffb1691b429cdb04bb4fb537ab23eae78707ccc960f7c65efe7759eef8a4f6ca528f48eee01f28b86140fd5fab018512b322b592d8977c20c
- SSDEEP 49152:QQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THL:QQvGAdlCEL8c/yRNw5ChLm
- TLSH T128267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 a62c801612bac577864545cd30c6f849f2fb1034a2ecc43709a73c527e341a02
- MD5 d4f2e7be2ecef6c236d5c7041d34dd21
- SHA1 6494fa1e1520075987d7d30071f61b289d5a1432
- SHA512 b2af7f52bd5dc6b747b7184593b5c73c043cc2e79dee3b994fc8626bf6f100799ff494b632297afa11fb17f13ea70b38ac9ea29b27d532e746d72d70e6ce16b5
- SSDEEP 12288:2AwSfxL/2Dc39DLLmt0LDQewsAjlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgT:LQewsAjFnQ/tbw/2Mkjy6Fr7g0oN
- TLSH T17375E031FE74E436C77F0DB21B26C706193D6A604FA11AC3E3A88A9D59342D22776B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 e0f59be1c2ea5c00b7f9c76ec4fba0d2d2e8e254143bb01b2121a046b09a005b
- MD5 7400763fe512a96eb86b36eeb381fb26
- SHA1 9e9b89fcb5de75a73de399c2368798928b5d7086
- SHA512 e89f8c518e9492546ba4250f4f4b3e91a7afde78d6581423c941b6a642c839940431aa7688ebe4ebebc300bd77d4606f8513e70bea6e647537c089fbae354889
- SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHSL:JUEtQevvqc2W1cpV2EI32
- TLSH T1B2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 556df156f0d37e0b3980f7f30a42cd1f84d4bdcdbed1a895527f6bcb9df0f351
- MD5 65270555b4a909dbb8a03b7a1b9e1633
- SHA1 0e555dda0e17f72e136b852a0173c649b1aa90d4
- SHA512 8ee3784267de54a2259a6c533badff4c529f48d86edcf5e762bf4f12752dc69f8771fd90028e91e8c943234888748bcc9c01d54cfccb4561c6eb182d4b0a52ce
- SSDEEP 49152:vCbRquA/m2yL5zQfFiV+XenmE3/zlQ/lFTjN4:ooqtVjnmNLm
- TLSH T13DD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 ff68c6ee432836162699ce5c50f4c5d05d9b71d315e71d414bee0eed8f9869db
- MD5 d8cc85ac654f0da60418ac7c0e916bb9
- SHA1 29df3b58ca6f67b15d32205537031a7f18d6bb3f
- SHA512 0f518440ddf390b18ca44bad0f524436a9f7e4fef7a6fa69a64d85500228298a71a7bdd583be4c3c5278f392a00cd4b2c56f18af8b79efcecb796179547cf64f
- SSDEEP 24576:RAhGLJIFoiwtA5l7S53inQ/tbw/2Mkjy6Fr7g0o3:RAMyFoiq5yQ/lFTjN4
- TLSH T15035AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 d98f368091f3d6c7640c6cd24045caa1b354eb66c06b93542011f81258207fc6
- MD5 e50ea812b713df154dbb751a090da264
- SHA1 357b92ff6288a0ffc485c71f773479cff910863c
- SHA512 328e115b3eda0459243d5e4456838914ed63bb5533644abb68d3071b737609972a929e4e6e45931b0bb49d81762c2fd5bbbacf2ed007175fae9bda623520a7c0
- SSDEEP 12288:Ymw5HEjsChN2BFgl0WDm+CmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMl:VwuHOWBnQ/tbw/2Mkjy6Fr7g0oM
- TLSH T17B65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 65a65c3bc1c0e0a260f4ce4432440d24419b49282899e3c92f8a2331af75f74b
- MD5 86623f91c5b13648afa548d244208723
- SHA1 dc9eb9cdf98945d279c3686df428b8d436c13940
- SHA512 ddec35216d5a919ece520903024bd7eab6cbfa30adb28f2f82569a47b26d19ca72a405bbbc6000275ee00bb181f03dde867942c84ee3f36a464e8f2e81e61217
- SSDEEP 12288:/XZ1IyVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:vZuMnQ/tbw/2Mkjy6Fr7g0oS
- TLSH T1C755126933A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E7A711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 6ec822ca74cb18644e553f2675551364a9abb0c9414acd718b6b60f93127a614
- MD5 b1630791f46e8e7e8c93c454c821227b
- SHA1 51541f98d422a05142d8b5aee546c8ef2be1d60a
- SHA512 61a3e6a0bc8126203263ddc90d8900f010e5ee61cde22a4e0499d9ce3d8a4bdade1f0c32d94439df7f67d3ce9b96ba05bda1726a3cb90a0a02a4972dbd924081
- SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U3:5QRQyi36YOcPQLvw2gAf+PN38Lm
- TLSH T1BE667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 074bb99af5eb1647f33d60f5267f900418e19cfd309968df49c32bad3f9c9c10
- MD5 acff3cda4128e79499fcca29579124cf
- SHA1 4f475d3ca497d67db22b53e6359d7adf0b514a87
- SHA512 1cfce7a817ee3a58c095ae9aae5fb120a7b63531dcd10997a9a42cea34148679459136d9ac4eb26bd2f05d74fedbc9f80ea3e780903465441ba70e139f3adb1f
- SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U3:hQRQyi36YOcPQLvw2gAf+PN38Lm
- TLSH T1E4667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 ac909b3f3dd3c99ecd26eafab91703e67d5e35aa08f0bd3765cc3333bdd302b2
- MD5 e3b1a259930233fa5c1fbb3bb68cf89d
- SHA1 4b7982ef7c3929c3b65921c5d6254c0ec6918c59
- SHA512 be0f566f7f9961bf1c7494607d5acd610f507d9023d9a25f4e4f3c1d1e0ce1b68fea63f80847e3715cc691fdd7be3789d30961033919d09f046a537fab75c235
- SSDEEP 24576:QwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0cnQ/tbw/2Mkjy6t:W68Qg55nhheWu7PNU3/VQ/lFTjN4
- TLSH T1EBB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 1e4fc530a65bbc6c641a30fc40ca1023acf3478aff9dccea1e4a8825d9704ddf
- MD5 8814645f4ac30f4e08265b7c34884188
- SHA1 34fb03e1c27c568ba229d3ce0b1001f3e48a2b34
- SHA512 227cb3e537dc97ed3be57d2d1a366adfad382b68ea37d0bc8918c305c6d2edb8bd3fac12ac2b5330e88b7aced08ba3bd458f6187a3cb42c14198ad176838f1e9
- SSDEEP 49152:S3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99V:zy5112gYy5azzVvL69nLKnhZ7Lm
- TLSH T1F5167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 5e8aae2e2a2118b5f57222e455787ba9e50c80a135c9d898fcde3ae61c35684e
- MD5 4e72351e93ea9bf04b3381fc8bb9113a
- SHA1 d8e13c3c89470d026dc18bfa68787ade67731927
- SHA512 0fb8a4c201d6c1e0e6b1c88f2fa76a5d91f2fef6a34b8f08815646175d1015e36d09aaa67e0b353482f9e7bd35602a15ade6a964d9af13692a5b406e0ed3f791
- SSDEEP 49152:wB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glzQ/lFTjN4:qu6JmVxd2dYLm
- TLSH T121D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 6f6c440b72a371f992f4e6986bba9650e67f611a2fc363979b242bed92d49a52
- MD5 ec47786f5770eef51dcdf307a23ae33a
- SHA1 92789035b558797aa233219885e72b6e0006d386
- SHA512 ab8214ff0084144507ca7247e30375c3a4f3e84234a70fe0cf58a19c7f2580187e6e64bbfb297f408f28fede880d2d16a439304d09f8f6fa7cec32847d4f1e88
- SSDEEP 49152:11hpsNoJpF1A6UU44CwH7R4x7Q/lFTjN4:1mifPbRNLm
- TLSH T175B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 15041f8e76c245c943d289db747f3a12c9cfdbc8afbf08c3ca4b8b300401dfb6
- MD5 cd5d3b6cf38ca15fd76fea370b01cf40
- SHA1 955073814b4f3d3b9597079b643408dde45337b9
- SHA512 090a1a41f4244af9685f7ef1c3c270fefc4cfe250d5caa87056f12844ea832b8ab456e794094de056b2a7973e61e1cea377cffcaa2fcb8be472cc50d370b6262
- SSDEEP 49152:CSuZQIY0Be2KRRVtOnks6NMHqMQ/lFTjN4:c5dKTi61vLm
- TLSH T13AC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 ec59bcf69cb6d036498f4620cfe55e3344ad1cd80bd65f7c6cd432888fe5edd9
- MD5 3efe9bbf3a9289a5369270b0a72aff31
- SHA1 8fbc43881a978f24215c7cc0d3f29ba667b106da
- SHA512 412315b82f7084adfe1e72ce8b3b5167237b0a0410e6162718ac5acaa4689593b2039f956d8284ad2eedf2e0453f611558853c5f4943983b989926ffbe958db9
- SSDEEP 49152:jhtSn8EApI0figngiDn0AP5wPQ/lFTjN4:CX2iyphJLm
- TLSH T11595BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 b3c4dff4f3ef0ff032b1513710b0825ee9d4835319948c8b7279f91a3c7d9268
- MD5 f8ecbeb5593581ec1e6624de0dc2e6c7
- SHA1 79451a7e98b6d93342eba9af79b0599cd4f85b2f
- SHA512 d34f3798d52d56f469047699da0fabc0ac08ab36b7f494205ecd1642477dc2c6aa5080826d4a8f1e8741d8f56a7c1fce71760cced99e990c4db876c201a30871
- SSDEEP 12288:IAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:IgnQ/tbw/2Mkjy6Fr7g0or
- TLSH T1135523697965F98BFB1706F18C828182A73B0EC6BFD1938F77482129967D39406CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 2712e1a1a0fa26abfb7bf515b5d17e5de49872d359529df0c9af879f4a1c446a
- MD5 4432f22100028b01fdee0ffe9df5bb86
- SHA1 f2d3cbfba6a32fdaf87cb9fc67cbe4540853d79f
- SHA512 26a797d12e41c18b7870ed1bdd81b164eb99051eca13798821ba16edd8beffd68c75f94a28e88ec72469dd077dce710018bc51a382a52a243dcd231a761671cc
- SSDEEP 12288:UJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:UZnQ/tbw/2Mkjy6Fr7g0oe
- TLSH T1E45523697965F98BFB1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 df71b2a1f20ad01c04c3f7029aaaa4bd10109a2ffdaf4aae53b45edc83d95964
- MD5 e99c87b76e4c57aa4819d1a58b683f41
- SHA1 21c546df479deebc982a71207c36e68f070e16aa
- SHA512 8ebfe96e3f5adb1afb6c6f739974226ea8069fb37e439803f8e7a33cfc07e215e5245216865dd0e701d3942140ce1d3827ca298efbd5477731ff6fd62282be0b
- SSDEEP 12288:jzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:jjnQ/tbw/2Mkjy6Fr7g0oh
- TLSH T1865523697925F98BFB1706F14C8281829B7B0DC6BFD1A38F7B482128967D39406DB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 9b6be67a914aee3fb4efb3d566d19ef50643225e57494e48b591b0b7b89eb55c
- MD5 811c1d762bb26f850c9571d9072d490a
- SHA1 aa1b3c44cefda99808b255f7d57a6619f1da8f33
- SHA512 086e5a3ed59c4c31ee4dd5c1326b51c0e6b71f01809236eb3d2d9f175a03625cf4bf17de3780c795f583f458cb172ca1309f991237372da4388a98236bf8859e
- SSDEEP 12288:VVCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:ynQ/tbw/2Mkjy6Fr7g0oC
- TLSH T1275523693A69F4C7F92742B4CC928142E77B3DC5BBB1A3CF6B04111D4E793D419AAB80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 4c1349bb5df81f13cf8dbc3e1d84ce729aeb34021a3b87c54028fdee1a66612f
- MD5 34a4c523083e0b6a37edf6777c665fe0
- SHA1 a8f6a1a7fa7f6e3bbab7347f53bcd2d960438c5a
- SHA512 d5562e53d15614faf760b40086ec8b01030830bf9e03d0d71274dd9ebcf5d22b82abbc8e2ca6f330b0069683141c7f6d7dbc621bd1d4b4472bed211fb0f90b48
- SSDEEP 12288:A6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:A6nQ/tbw/2Mkjy6Fr7g0oB
- TLSH T1865523697925F98BFB1706F14C828182AB7B0DC6BFD1938F7B482128967D39406DB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 5eb96428d0c803f3ef7ffed4371b3903f37f8fd5f804b05a141874e62a5067e7
- MD5 70ee3f3c1c3af05b6ce037c522b6a73d
- SHA1 d4d6f445d1af87818295edc3347dfee15059961f
- SHA512 ed03160d58bbef637989bf9d5b3f1eb12031e382b5d5477b2e01e0bfa451a582877fca71623a8344a4dee30ad86a4f515b845298e4fe5938482f704cf8b2f251
- SSDEEP 12288:XtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:XNnQ/tbw/2Mkjy6Fr7g0oL
- TLSH T1775523697965F98BFB1706F14C828182A73B0EC6BFD1938F7B481129967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 c8ce9ed2fd0b1b60b64c0ff08e44f3e1b8d5da2b5fb0fa067b06d5bc4455dcf7
- MD5 b6d30d8b00c3048b484498b23bd5fe09
- SHA1 69f7b36cd2e874606fcb66a10821070ffdecc358
- SHA512 f0dec5dee139fcc25cd0d3baefbe39d175c79ab86365c1358f5b3c290b7710f9ad55b985ad3f1c6d4cdca2b2b884af9bf8fcb8b56e596c64a8b6a568f8a48514
- SSDEEP 12288:0BGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:0RnQ/tbw/2Mkjy6Fr7g0oP
- TLSH T1875523797965F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 171fde15c24eaf8a6313f0ff0f66e4742ebf15ba277035dbe5cb50582e3eb294
- MD5 9c5213d4101a0fd79f8122bf2214c25e
- SHA1 298d097254826bc650c0eb55980d8a3662635eb8
- SHA512 ece3fb0d582d39d7c262555a729072db0a4d50f23699af3c96f35cb36634ebe68d4c629dcf1a773f99e3305f37ac6b5e36d1f4a749d166e69b79b063f6bbd374
- SSDEEP 12288:kiZwbDzzFEoS2cPvypGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:HZM3zFVSO5nQ/tbw/2Mkjy6Fr7g0oe
- TLSH T1817501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 d7c4427acdbeda789d3fb6d8fb0513ea40b2b624754e8bb0e8bdbff13804bf72
- MD5 45af2c91c7990c92a95a977d3e652919
- SHA1 3487d55a6cd7bffb3a2bc614a8e92fd8e241e8a7
- SHA512 f788d617b880658d248ddf6a15954cc2aa07f1920fcd1af17639bed2b737dfd49f995233af61393e0669f1818a3bf190abc7ac414d39ce5029176a8b5a7b9d06
- SSDEEP 12288:X8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:X8nQ/tbw/2Mkjy6Fr7g0o4
- TLSH T1135523697925F98BFB1706F5488281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 6354d0e5ef194827114eaeeb1d42278b9a04452cb51cb7c0b44b3e56bbbee27b
- MD5 2897224f6dab9f881a0ef3a3f37f6c41
- SHA1 ec4f55be541a4f101fa4595bdbd36cda22da036f
- SHA512 ff36a55c92fcc10556b6477b9f5c158ca8a34687efc08a228c961d16a40d7f595c435548852dc617e62c7a45511633a8f46ef75f67831e6732c8152def0f6f5b
- SSDEEP 12288:BIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:BInQ/tbw/2Mkjy6Fr7g0oM
- TLSH T1705523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 d28127a90bc2b708adf9c8f0845a801d24a339f642f331b7b95eb6417fd5c041
- MD5 4fb99197b39184f9a93329b6a6ce28f8
- SHA1 16043305dae7f7a5304c5cb682033220ddfa18ae
- SHA512 5eb9fdab1915e3096e81f42985095f7d6a7652972ddc7fd41ea85f1325547a8b500e615ee76baca3c6d13462d86574ce0d208e6b4d1b85b3a14800c4527efd6f
- SSDEEP 12288:tyPz5L8VGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:Ezy1nQ/tbw/2Mkjy6Fr7g0ou
- TLSH T1EC65021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 17c1a9b05b2cdd471b0ef5e620cd8034e3857f29338f19a68f25207acf1edb53
- MD5 26a28128ac231187f31225780d265a48
- SHA1 db3126587df186cde0ecb0d54758a77df32cc8a4
- SHA512 4357d8dbb3031546f75b8e8b2c274187cb1b48b8c296ff1afe82b0d791b9fa09aa8a1c62c14d7f15a9e08e7230329a79f747a14d0c0ad2f6bbc8a2daa26b982c
- SSDEEP 12288:x8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:x8nQ/tbw/2Mkjy6Fr7g0ob
- TLSH T1A25523697925F98BFB1706F5488281829B7F0EC6BFD1A38F7B481128967D39406CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 d1275f4f3c29c453038e649c0a6950ec889db49c8386eb0b171d284dc1f106be
- MD5 82fa44c71695b828c162c2e723469057
- SHA1 d1149a3680f427fb3dce0f28d6d81a40bc6644ab
- SHA512 387778ef1ca3fbd1796d0bc8a06acbe44ce712397d1ad8df8643a68bc67d4a585f0bfee28f8160106fb96e59f09dfcf19b436f75296867da7e62fbfe0bc93afe
- SSDEEP 12288:28GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:28nQ/tbw/2Mkjy6Fr7g0oK
- TLSH T1AC5523697925F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.4MB
- SHA256 9668e9d612941e34532cbbb24e1dcd98ff6fd1c0fed36a46a67f76244c9acd1d
- MD5 674b121c69fe677cbeee95b6e5864fad
- SHA1 f6474baecc431158d3c4aebcba5b12f6e27699b3
- SHA512 f7d13f88c0ab93dccbea6defcc2fccdc5d25af22cfe1c59aee1e2822f870da19015d10d1b2bb65a414b20af013f462f1045e36ea7a71caffe7b1f2d2176266e8
- SSDEEP 12288:ayPz5L8VGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:Hzy1nQ/tbw/2Mkjy6Fr7g0od
- TLSH T15765021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.5MB
- SHA256 c25926703bc7c68cbeddeb9d5ba27b4676ffcfa18aae792ee4d2259214a9564e
- MD5 09d578c615ab91a7538b926923d91193
- SHA1 6c8e0b467365446e25621da4652ba9830e9974fe
- SHA512 bd88fca6a80cf13b6fd4af5c1a78f5fba315d87a2126e52a272184354794c6467e572933605fa3e7d4c0c97ad3fe822e3d12da54a22899c3dac5bb6d63ba3737
- SSDEEP 24576:kT0aLl3z0zDznQ/tbw/2Mkjy6Fr7g0op:kTDLljmQ/lFTjN4
- TLSH T1CF7501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.7MB
- SHA256 f03956ca281d2a0ae5768f51f7c19339dfdf06c1933c16b429b6115f32dbacc5
- MD5 8658e43a48e1235ad1e7a72f7cb9c205
- SHA1 782a86c3b5f58c4da1bc3fbdd3e00828df41a4aa
- SHA512 df5f7e70326b4f8be2047b587984d2c45f70369c9e557429a419638153a34bd2e7b191b5bca28b3edfc8ca20f91d1963cf6ddcbc9a9617e8466745460a56fe98
- SSDEEP 24576:S31d9CHKy7GZ3nQ/tbw/2Mkjy6Fr7g0oW:01d9CHKya9Q/lFTjN4
- TLSH T13585CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.2MB
- SHA256 35e2086499458fd50d1164cb302fbb388f3774ec14d92f324c911b43b4d65fcc
- MD5 efb50abbca88d8c9ac2e77454ec7a0c4
- SHA1 53e49364f5f1f97bf25d59a18d2cb0374b014be3
- SHA512 0225bb66b75968a531e0277ba7480e0542bfa392b804f1f6b2ef0b853bc56723971ec2874d736d6a2a13a98fbef08bbd1a2cca993a5362abc08e70a443e6d2f0
- SSDEEP 12288:bTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:bDnQ/tbw/2Mkjy6Fr7g0o7
- TLSH T10D5523697925F98BFB1706F14C828182AB7B0DC6BFD1938F7B482128967D39406DB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.2MB
- SHA256 3865919d3b6571b2e829bd1a91ed2642382278e491635e4adc21bdea3596492a
- MD5 5a7109ff05e5a95f4ed61101a2982fca
- SHA1 ec98a7fc35157ac8b821bba8205327102730d19c
- SHA512 f122bdb4f65b7e59a135079a2a3b61516a199ccf4618040d4979e26bff408f5fe17bdcd47d3c46bb1405b07a87da5fbab12c80b8a7ded2ef89fbf3b76bc56103
- SSDEEP 12288:i1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:iVnQ/tbw/2Mkjy6Fr7g0o3
- TLSH T1505523797964F99BFA1B06F14C838182AB7B0EC6BFD1938F7B481129967D39406C63C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.2MB
- SHA256 c208d95836722ae8e0d9a8cd06ae69db1109292363c8898867c1fc19dd0edc03
- MD5 de7e50ad7844ca875673c4446bc56f2f
- SHA1 7b10a36e880101d7d95b31485d1339aa8678807a
- SHA512 cbcf257e52016c04c4c4a5adba307149fcbf04790494edfab4fbf116ce2ac875d140a333b3778a482f92ff709b55e9e2c14e156d7f1b0c5d5e5e9bdfd5309619
- SSDEEP 12288:reGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:renQ/tbw/2Mkjy6Fr7g0oI
- TLSH T1D45523797925F98BFB1706F54C8281829B7B0EC6BFD1A38F7B481128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.2MB
- SHA256 84399ac3946be0fec23848cad15ffdcac547c9602e1dcd26cae3dd5f6508ec6e
- MD5 0ef4863431ab21796ef3a3c9a7aa6536
- SHA1 bff565e706b6c90111ea9b42c610fdf1c77f7615
- SHA512 b8f69efa955a1aecd615dfe6fe3d316e74c24d23d8ee5bfd3b605e8f0b9f72ab02183e7aaf2362909a217fb80388cb54b433b4f95f60387fc5a1cbc1caae5d6d
- SSDEEP 12288:g8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:g8nQ/tbw/2Mkjy6Fr7g0oI
- TLSH T1355523697925F98BFB1706F54C8281829B7B0EC6BFD1A38F7B481128967D39406CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.2MB
- SHA256 5ce7dbf74fa0a678fbd8e9b343b537fc5f5da1183383c2096f85c0471dc7fcf8
- MD5 e4f21daca9d70c7b264da9e292666469
- SHA1 d064f82f724f2272e827b200f5d4a29b5c4988b4
- SHA512 182f6c9701a7ec6aa8b7fabe978ad7e4f756897cb58a7a57cc3c73ab4ec9cb9ddd0f1dc8d48dac1ed4189f8357b96cb83fc8f562276b87e8bf060ca134660998
- SSDEEP 12288:VTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:VDnQ/tbw/2Mkjy6Fr7g0oQ
- TLSH T14C5523697925F98BFB1706F14C828182AB7B0DC6BFD1938F7B482128967D39406DB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.2MB
- SHA256 45b6e7f9163d6aef73ab2b10c135bf79ef3cd767c2af840f22c70ddadf1f76c8
- MD5 5cd4d82ad5ae5a7f4349e01fc709f6b2
- SHA1 434cd712647245ff1903a617b44c333dddd56ee5
- SHA512 8464a8c32b3555f5cb51ccb37c73895b5b113f8616eedbf535e3dde83e582e7ebba9334ad1f195068f90f91ee371b3a604d9c17f360202870e311a64e1bd33c9
- SSDEEP 12288:nUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:n0nQ/tbw/2Mkjy6Fr7g0oh
- TLSH T1735523697925F98BFB1706F14C8281829B7F0EC6BFD2938F7B481219967D39406CB784
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.2MB
- SHA256 00bde545a9bb589094cb9db90a25ad863a4613b3ccc19b4e2ba1deed5ade3848
- MD5 bc4aca90cd49dff4f0658c0e36e63843
- SHA1 56b59e5d401743e7c95480caa0b8fcfaf50ed4f0
- SHA512 7dba8b4e460a31dc306bdc99f13d882b98641e8b1654124417e0e0e8887ed928cbd4aa2f1e537621c35a78a93fd2524f49f01928c49d3f46acf7f7ceff9a58d9
- SSDEEP 12288:V6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:V6nQ/tbw/2Mkjy6Fr7g0oq
- TLSH T1E15523697925F98BFB1706F14C828182AB7B0DC6BFD1A38F7B481128967D39406DB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.7MB
- SHA256 66a0d58b3b5b3dcf0651224ce0a5d71e1b11bc7fff68360c5a12e1bca84183b9
- MD5 6433122fccdb3dd1b68622f1399ca495
- SHA1 2b49635ca8617aa68a82f1311d3f422244e96e93
- SHA512 37d6afb7141f20930e68192723f6dae10e58094cd4a99b5442dc326157717308432503973fbc23d896449bba632bb05f94c5b45d8212271007cb4c660cd89a8f
- SSDEEP 24576:2fwv/k9RX6wkyAI4nQ/tbw/2Mkjy6Fr7g0ot:NMnYI4Q/lFTjN4
- TLSH T12C85DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 9d6e229565d2781112f48cf704c2f2ca30e429fd7970ed5398b061dbf1475b63
- MD5 7252ac2788986136e0ce7954e0806ff5
- SHA1 e4465358b040713479c3722327b00551c2f595df
- SHA512 dbdc2b008a283c49dd79152918cf27050ab6886a16619bc8bf68791fa8220164f934c8dddeb9e800fe2d37d46a7dd54a6992ab34f5b8b5e5dab9a03966546464
- SSDEEP 49152:eYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0vQ/lFTjN4:QySzPcLm
- TLSH T14F066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 f553de217ddc9b440cd302d372b6d0d9bcef620602e88dea0dfb193bf857f6e6
- MD5 a5e3bc4bb0d9324e6b20b6d44421312d
- SHA1 4c86eb432020f6476ed8fea9aa0317a3fd68550a
- SHA512 5a2e635c4bc751c9d678aaacabd6e0b1593c4e528a919144aeeef84ec33ba17e7ebf35ae53526d27c1e8fc10ca5afa2989010b2d16b4e531bdf8712d4030eb64
- SSDEEP 24576:/47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYpnQ/tbw/2Mkjy6Fr7g0oH9:/47JUQj1irIhCnDHUPfF/fQ/lFTjN4H
- TLSH T18E65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 ea5a708b2f995ee2dcc6a5620a9ce63bcb0c87429d2ccb5d5f7321b2754d40ea
- MD5 e5aab358109552151eaeea016aaa75a0
- SHA1 b44229c17dfeb43812ff5dc5ff8b59bf3b36fb1a
- SHA512 8f276163924194fa50229901f1930d729e6b380cf3453549ba77ac7566d6c8c3e4d7de99dbcb87ac464f1ab7617b0e50930c8abfdbc20f27045d17587c6ddee5
- SSDEEP 12288:TssfMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:/MnQ/tbw/2Mkjy6Fr7g0o/
- TLSH T16C65F119E29852E9D12E1279CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEA743
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 a58365e6f28f3ab6c5f61ad97fc631463ab344b07357e540522b5d5117acb20b
- MD5 c0da9583f12962db70b322dec49f8235
- SHA1 424da04ffb64b0e0bc624c5c54547e3dce0ae58a
- SHA512 573d01af3efb6cc92b02d7ce081faee03633ddc51e93753639b50d7bd0d39df2d5feeca9b067ece48d8de9a44ccaea190dca52dda0145ee698ec416d32cc4bd9
- SSDEEP 12288:9v0f5U3flCdi0yO53hTHRO0y05vwhxG5QmJep68e+ycrRam5Tg:9v0BUPlgv53h1vwXuJJeY8e+yc4m5M
- TLSH T1E2351750762ADB4FC6A940321E36D2CCAB707C45FE446F0773C9873F9576658BAE2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.4MB
- SHA256 4a1c5c4c61ea38d699f73eb680c29afffbe74dd6b7134f19e12fd560379f8407
- MD5 4eaf1529564ae3266c6e09cc26d6773e
- SHA1 1950a574b59e0e4e037dc303e58aac145a3ce97e
- SHA512 bbb07f3bcc64d3c466e4265538d13384cfcdbd6c7901c162c6e896cace2455b5c484c1d09f6ed7c668008e88a72a60f0224adc3f44f068c924a5578b4c382ac2
- SSDEEP 12288:w/jl/dYzJTZ5zz8x63BHROP2hX0EH/TSvzNivI56AKvdX:w/jloZZb7MhQXvvJ
- TLSH T19865E9406537E78FD1B76032072A5B8C77A4EC0BB7496F26B385453AD82BB15A0F93C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 c39d30bbb358fcf8239a787739228dc273821ac9087bd0e7e1c451b338758c5d
- MD5 b3d08ea44d21ba3896b38da5cfa83b65
- SHA1 581eb20e2e9b413530c05bf22d2a9cf022decd3b
- SHA512 09668278b168343018f0ad6023ba8b132b6b5bff42648312aa95877d5402d959a5881c3616c81c0461507d93a3ee0f77928147cdb98b62d9bca1c77fd9f0c4d6
- SSDEEP 12288:G67kGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:pEnQ/tbw/2Mkjy6Fr7g0o4
- TLSH T1A55523756668F94BFA3B06B058828111673F0EC5AF90D3CFBB082269957D3D40EFA785
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 13827b8424aff2d19b8a3ac5b2d26ad42a0fe26b6310823c160904e7d0d03fd2
- MD5 5ac69cdadb3b52ad9481b4d2f1883f36
- SHA1 a0699ec934d132ee8a644c0843bf2c5bf4b798f3
- SHA512 62e27316e69afc74455e290b8f4615d2f80402cc02d5acb230a1109ad016524afe7afeb8b6dd3043b322c7019bdfaebb4c4064c853bb878a94712bd695f86822
- SSDEEP 24576:Dgb6bmBIi49WNNFpg1rSvFv7bYmnQ/tbw/2Mkjy6Fr7g0of:Dgb4mBIBhGFpQ/lFTjN4
- TLSH T19265AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 0d301183f0e319657c8c9e3820c6d94a2af792ba6fcceda6c7fc90811f18d78f
- MD5 9e789535aabd42a48343619f069c9120
- SHA1 f19a9c988a6b7ba335cf039524293cc2b16869da
- SHA512 0fc0886322799a69acfbf3f129b13197a7e7db60bf551c84be0a411811dab46c525f8ff68a11e24b206d75c397a4378349d3c0e538b42d7a37eb31892347d3f9
- SSDEEP 24576:1G88u8FpJqH1Qzria7/m5nQ/tbw/2Mkjy6Fr7g0oY:47ZFPqVva7/+Q/lFTjN4
- TLSH T1C785F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 ec43793013a18fa03164214a62fd7280cdba9c5715d33ee75ab267a874d9b110
- MD5 62cd5522798eb62f4285b6efe4a38b29
- SHA1 2ffe0990f8744de1bf84ed23239c9151be43cbb1
- SHA512 02c434c08bbfe831c7dc0d09d3cb46b6e0f6d4fb0d1f1601f10ba06b5d3b28d20bfb3fc7249b79f063210c0ae57ddc1af1a5bd45e6815d4fd67b55f4fce4912b
- SSDEEP 49152:iBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjNQ/lFTjN4:tG05lO43bjLm
- TLSH T195D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 9ee0085c0f4fad4fb706df0a99f66ba565a46a21adebc3e1c3a95f83706b8ef1
- MD5 200f405b239e6849e57049ff0ac8f95a
- SHA1 775d8275e460bee95aacd83eaf89ac597d1605a8
- SHA512 2dc8e52875bc6b671063904dbf276c5a109beaa9c9a35342a5e43b1a37cbf7bce7be8674a58baca4c792246410d87b13b863bc4245593e87bc40e1b7d9fae7b8
- SSDEEP 24576:7fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnvnQ/tbw/2Mkjy6Fr7g0om:ja5POZ3+Jt2pasx2+mVQ/lFTjN4
- TLSH T10765AF5EA6F801D5E579D17DC583860AE5B1342253329BCF122182BE3F37EE89E39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 2248a39090dcbf9571fd9ef4fa01545c3e6c555d133d95059e60b270adf39e47
- MD5 f90248104a2019473c62a22403a3bb81
- SHA1 054fffaa5df2422be88ffdab05e34279a3c0ee4c
- SHA512 11443203b511e5739228868df7ef4fc0a7b5ca79482a195298818fd21c60a62700fa31f74b4b0688d1133f90b09fcac3f97b1c9a1154b969c507483308b51b0e
- SSDEEP 24576:uNcwHdjbyQ4nLC18lb/EOjowL7FkhnQ/tbw/2Mkjy6Fr7g0oT:uNc/zEOVHFeQ/lFTjN4
- TLSH T1ED858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 85b867c273fd559edc16808b6fb8d5cb6edaa9f4939c9323d76a2db0776849e8
- MD5 60c0d8bfc692b232d9802833d1639c8c
- SHA1 fdc825c0b1ebf283edde6be8d2498287da4f0b2e
- SHA512 175a6d6811b27c267ec95785cf654e5bd31bfdcedcac6eb8a3c8fee2981aea0b70859228c89fcf0819d4d65563f8a89d5c227d6ef288332c828bd579665a692e
- SSDEEP 24576:f8kNvNnaFeYhJNtmZBmfnQ/tbw/2Mkjy6Fr7g0o/:f8MwBtOmfQ/lFTjN4
- TLSH T11955AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 ee84063be44012bc72ed81a8f387f545920caffc3f6997424c74c16dd9ccf19f
- MD5 e2505f777a7cda98afccaff5a5c0e4b3
- SHA1 c838b2a15dc6de3975fb273c96676aa8adfbf918
- SHA512 a3f8660c4f81cb2495283c86e0f4a487aa587de055696d8b45234369d35056255c2e606cdce72ec2f078012532a7daba79eca1129d79df11857e0d275c2c12b5
- SSDEEP 12288:hHvUrBFrEjwaQdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:hPUr+NQ9nQ/tbw/2Mkjy6Fr7g0o1
- TLSH T1AE65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.6MB
- SHA256 adf5e28374e58cac22ebe6448c1607487cf5fea3ed0d7f80894e117caa785656
- MD5 187659000150f3d901208883f755e900
- SHA1 98ebd540a97d6e2aaaccc997c94a11bf194a7d78
- SHA512 4f8d9fc230b6ae0249b1a67ed8953cbb404a70d7be9816e38f17a39617c7a137459e2006e6f2d2c15a19568bac252873e0f1efa853658ce93f3c68b327ce9d10
- SSDEEP 24576:fD3FHshBIYQgAAnQ/tbw/2Mkjy6Fr7g0ok:fDVHeBIAAAQ/lFTjN4
- TLSH T1B175E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
- MD5 SHA1 SHA512 SSDEEP TLSH