Analysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/10/2026, 22:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
- Size 1.3MB
- Sample261022-2prxesvtex
- SHA256 d598ccc0d0cfed31c25b684bb3617b8daa3c49a915018a671e08b82c87919e28
- MD5 6b7a6b85ec78316af311322a60928d34
- SHA1 f59fac2453fd3ecd0293261956a0cc2056eb9306
- SHA512 b8e5ba5cdb1555c43847f2db630170ff9a110a29070137404882d8be66c422b0d79954bafec783b9752be7f8700d4849264e86af29534fe1b7190e3c52183ed8
- SSDEEP 12288:t1ifGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:u/nQ/tbw/2Mkjy6Fr7g0oo
- TLSH T1F95523297950F477D91709F51C92C5819B3F0D827FE5A38F7B88227E9B393D00AAA385
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 1808 elevation_service.exe 1904 elevation_service.exe 476 maintenanceservice.exe 800 OSE.EXE 1044 PerceptionSimulationService.exe 4396 perfhost.exe 3904 ReFsDedupSvc.exe 4736 SensorDataService.exe 3052 ssh-agent.exe 1732 AgentService.exe 4464 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe - Drops file in System32 directory 56 IoCs
description ioc Process File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\locator.exe 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\40ee2f4bf1788cf2.bin elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\vds.exe 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106906\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106906\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain elevation_service.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004508691e7762dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d867073b7762dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002776ab1d7762dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7583f1e7762dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000cb06a5f7762dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f44061e7762dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000022df8b1d7762dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 1808 elevation_service.exe 1808 elevation_service.exe 1808 elevation_service.exe 1808 elevation_service.exe 1808 elevation_service.exe 1808 elevation_service.exe 1808 elevation_service.exe 1904 elevation_service.exe 1904 elevation_service.exe 1904 elevation_service.exe 1904 elevation_service.exe 1904 elevation_service.exe 1904 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4332 2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe Token: SeBackupPrivilege 3904 ReFsDedupSvc.exe Token: SeRestorePrivilege 3904 ReFsDedupSvc.exe Token: SeBackupPrivilege 3904 ReFsDedupSvc.exe Token: SeRestorePrivilege 3904 ReFsDedupSvc.exe Token: SeBackupPrivilege 3904 ReFsDedupSvc.exe Token: SeRestorePrivilege 3904 ReFsDedupSvc.exe Token: SeBackupPrivilege 3904 ReFsDedupSvc.exe Token: SeRestorePrivilege 3904 ReFsDedupSvc.exe Token: SeBackupPrivilege 3904 ReFsDedupSvc.exe Token: SeRestorePrivilege 3904 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 1732 AgentService.exe Token: 33 4464 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4464 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4464 SearchIndexer.exe Token: SeDebugPrivilege 1808 elevation_service.exe Token: SeDebugPrivilege 1904 elevation_service.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4464 wrote to memory of 4928 4464 SearchIndexer.exe 100 PID 4464 wrote to memory of 2924 4464 SearchIndexer.exe 101 PID 4464 wrote to memory of 476 4464 SearchIndexer.exe 102 PID 4464 wrote to memory of 952 4464 SearchIndexer.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-21_6b7a6b85ec78316af311322a60928d34_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4332
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1808
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1904
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:476
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:800
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:1044
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4396
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3904
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4736
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3052
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1732
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4928
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:2924
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3024 3028 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:476
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3016 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:952
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 088fb382b2856a2907397d0b32df29b3257230b873ed97c6ba3d18b4451fb123
- MD5 d64489b478ea90fef5d939ceb7d9f2c8
- SHA1 59f67c10b6c67fff2a59bd98010649cecd51d35e
- SHA512 f27295e8925586e7127da74299add0eb468dcf67214861db75c29ae0fade542434564b0399b827d11eab16a6d23d56d5f5062cb703f2fc4379b778396a672c64
- SSDEEP 49152:fb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn2Q/lFTjN4:d3q6HjByLm
- TLSH T195D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 35919575048604acafac89105f5f450b84240809ef399858c088323c7648edf7
- MD5 01aa7d36343a8c9fa2be20b4ffc27fdd
- SHA1 121e958d2ad272c21bb2a27f5046020bd627fa8b
- SHA512 fb5a21d40c9f55062a25c71d5b74b8b8bfc8bcf5ec626b57957c8e146ee0d51ddc728c2c293dd4148bcd72ee140542d7effadc20f516831d1df6a2b8a098a794
- SSDEEP 12288:j1XLsswWkxy2lRq2czAxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:5XYfDtczABnQ/tbw/2Mkjy6Fr7g0oC
- TLSH T1EB65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 2b609c4795a4f4852cfcb886d5df4ffb31974321ccb69af31093760e62a62085
- MD5 60f396828985b9fba842827466e12bf3
- SHA1 fe187ac4390884680a56f9f96776dc48356d1353
- SHA512 f7a75d9396396bf0a9d4065c4e19c7623444aff2f03fd33b598cc338b8ad362731b18cafa2b13cb8abad5cb03176d4795708a6c08d4a0c9c88ce8ae9a15ce19b
- SSDEEP 24576:h0Le5ji0hmxLrMunQ/tbw/2Mkjy6Fr7g0oX:hPji0AlLQ/lFTjN4
- TLSH T1FB859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 1dc70e11a22255b6a72c828ced9c1b8d1764ac581f5ed762a67f66de15e40f50
- MD5 eff29acc199bb61c67bb169a492e90e1
- SHA1 edf7a2cbdc3b95b292451a47134799b9559df20b
- SHA512 24f8759147f1249daabe8dbf197e04a5b38c770a765fb097e8ddf61a31472d65c15858e3d4df105b92af83c5619b09bafa9faab5290b4efe310d9013d049e233
- SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWE6q8wyuMnQ/tbw/2Mkjy6Fr7g0oR:I/ezSC6vUzPvxHjyfQ/lFTjN4
- TLSH T18A755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 3bdc841c6061ced2e01c75ccb2bf5505be79f616f08c856226cc66bf9ba6c48d
- MD5 c4541dbae5e589978cddf4136e0e5d51
- SHA1 47345111f6506e64f8f6dce15eacc4bcc7aed47a
- SHA512 65b62404c4d3a2262e83681d52d571681e603b97ce6cb08bae3eefbdd9f24beda584760b6f73c5ca4644239bcbabf03ec4849ea967ca553b7eb56a430edb4ab0
- SSDEEP 24576:jVbqPb88hv/l+6NnQ/tbw/2Mkjy6Fr7g0or:jVO88hXl+iQ/lFTjN4
- TLSH T12E559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 9e3eac43bd2a125fe807f452374cc06558ee4bc67d352c2b3f3dccf9a1b2d338
- MD5 8f0403dcf9fae6233358f09a58093f42
- SHA1 9eacb28b42aa9069b4a5035cfd97f8692656b8a4
- SHA512 e095c9866f706348470a1ef106bf799f9e8a10aac5f993aaef1db23f6eace769e45512cf650456a9dd44d59da8d3073dcb0c9f87bff62c8284f8bc7e23e4663f
- SSDEEP 12288:YzKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:YzKnQ/tbw/2Mkjy6Fr7g0os
- TLSH T1925523796A24F897FF2B06B15CD284826B7B0EC1BFD4AB4E6744322D857C39446D7381
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 46db5381365b798a70747c23071c2d42102dee85222ddff24f1025571260c196
- MD5 d1f431ba2338045181010ff86d17222a
- SHA1 9476db8d325175e892f9b164f8187ebb731974b2
- SHA512 297457e258d6fbb2af656758a958d74c58d6175fe00e503363edb20cf26a51acad64451071f8eaf31c782dd374be25e86711c60adbf88fced785d279fbc8ea95
- SSDEEP 12288:teBNUbTVO86UFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:tJIUlnQ/tbw/2Mkjy6Fr7g0oX
- TLSH T18C75CF3BAE28FCD2C27E4DB85A918640D77278704F61A3CBD164830EDE276E05E7AD15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 faa58d9b7ef1e7638d7d2a7a6be10769a1375b49101fa5ca25ac816980f90cd4
- MD5 ccf92299bdc422dd1a8f5944d4c86508
- SHA1 a7a71dedb43b45846341ea66bd3caed3f6c12a53
- SHA512 a871dc8daa13d804ef6349954ac16b31210b8c4c4e633c699fc0d414da126d80a4c3343b76c86c2bc7f85b74921cf4b4c027409ba8d5483af0684ab283fbc004
- SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THd:OQvGAdlCEL8c/yRNw5C/Lm
- TLSH T1FE267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 99e85fb49b6460ae3e1e86563fa1e58e12d2f3bc9f67d32ba62abc2ded2b77bd
- MD5 621072f658a19d9711e751f020d2d82f
- SHA1 e556a8b0ea898ad598d043da2f4b60b4bcb25465
- SHA512 3db49488d1788f285226f2acd543f23d325055807d5b860b6830ca7f4579e4bcd97b1768bb169d2da4312011a2a9617229fa3e2d055caf8a7fd6ca7eca15bb59
- SSDEEP 12288:DAwSfxL/2Dc39DLLmt0LDQewsAjrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg9:8QewsAjbnQ/tbw/2Mkjy6Fr7g0on
- TLSH T1BD75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A88A9D59342D22776B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 78039bf3e167bf7dbf5f39a718fcd36a1979aeba052655b81f3c1632db564d17
- MD5 6f02eab92d6c4646ced48c29119c7d42
- SHA1 1d74da92707c000e172929eb807b76e0de04bda5
- SHA512 87e147be13294341786aa2daf63c5ffdf0212bce53c7e88c6fcd3b3d00672f82f1710bb30dc4f6993de2116a50f4893537953999bdeab6ea24c93fe909f3822b
- SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHoL:vUEtQevvqc2W1cpV2EI32
- TLSH T113474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 4431938cf0d97542233ea60bfa87ecbd6e412e3d702f54c32bcc91c922996981
- MD5 9266b93e53074a0aeeeb369bef39a77a
- SHA1 b7ff69c3edc2512c5e573adefb9ae94a399936a6
- SHA512 c4c504d11ab3466f506fc1c7f636162d7a37b17be634f0027b1635edd4bc90d58ef448d4b4db6e1176106aa73805459782bf5a9ba453ca73df00ba8bbf4ff131
- SSDEEP 49152:4CbRquA/m2yL5zQfFiV+XenmE3/z7Q/lFTjN4:xoqtVjnmTLm
- TLSH T110D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 88b2ba4419dbfae0d29acbca7bebf8ef5d51f0d13b674aa7054800aeae430dcd
- MD5 ff7d877945ddcbf99ab09428431104c3
- SHA1 84606b6531f4d78d0491c050e7745a3d4c6f1d94
- SHA512 f9a41393cccb7495516c87ce7189edd1d29117a4dbd46183fc9579398ae94d86ba8d93aa2a31b0425987501da68556b72eb124f53ae100d148c5e979c1bd9694
- SSDEEP 24576:hAhGLJIFoiwtA5l7S53gnQ/tbw/2Mkjy6Fr7g0og:hAMyFoiq5QQ/lFTjN4
- TLSH T1A735AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 3fac567024454f7bb0b5a71c9729f61729091d1475a46ee8db9f4ebc4ccfcc8a
- MD5 7e188a7a2c3b8c5b1202b3de69012d49
- SHA1 28f7e5a16624021801208a431bac2c76d898d607
- SHA512 8610435cd672614bcf519cd48526b8e9cfafc652eef148a645079bb3824ddb6f84a005523b83acad733bee492c0b179277e8390a28dbe272aa286aa5252ac3b2
- SSDEEP 12288:Imw5HEjsChN2BFgl0WDm+CsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM3:lwuHOW/nQ/tbw/2Mkjy6Fr7g0oO
- TLSH T1DB65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 02e9f1723caa0cd7b1489b98eea04f8b4c9229535c1b0ac34805c4fdfb5bea14
- MD5 f920700d388ce00ef6865ae539ec226b
- SHA1 c0a711f2a1d5700585745c2c86d683e5f335c9bd
- SHA512 bcbfa807988191d8f90c187050beeab1e4be1c4ea25e6acdc9b937e1a5e1aa97c4481b7d1e51064e310144caf7574bfec335429a09418f64ff42f349e1b57d9f
- SSDEEP 12288:YXZ1Iy7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:gZuGnQ/tbw/2Mkjy6Fr7g0oF
- TLSH T11B55126A33A4B0FAE6674278CCE28646E7733882677183CF275442695F3B7D11E3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 11921157794891b5279138442e2a05a612f1fb8871b999c2f5f3bb469fbae6bd
- MD5 50847138fda4449e3b904b6af134ed74
- SHA1 abba06372f472e4f523a73fee9d831a9015bf7cc
- SHA512 698d66c4892780bf46a1d494027e4414390f12759f58407b432693cf9da42bf213a21dcb424ff43e7f87a1f838bc678d5a7c61b1118c43828bc8d8109dd44a6a
- SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UB:5QRQyi36YOcPQLvw2gAf+PN3uLm
- TLSH T1E8667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 02693cb025b5af1b70acea18b02299302f61de0ccd1bb53e98c6b5b3e1f134bb
- MD5 1cb0c1d4f401f7262adc1c2af1c3628e
- SHA1 e1a9980bf25cd1a6466e64e446243cf4e5aefbf8
- SHA512 ce6cb57e490be5a4a752d27bf667002cbaab4cf6b073e0fc731548a5b9f564241aa7c46012fa8efc4bca5d8a7e9675e0b6f09a5866abd15b95171eb1961b9837
- SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UB:uQRQyi36YOcPQLvw2gAf+PN3uLm
- TLSH T120666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 b24d2bf7bbd29fc7faff7150f457ffd0af21d36f1767b992f29e6629039f3136
- MD5 0870f94a66b822760e629c6a276b748e
- SHA1 1c217e2c4f9c92a04b70253800408acd2d348729
- SHA512 c0ad440f02753833bd0c8457496e3c7e1d02af1e61f6a2df37dc91ce5a131d39770e0d5a51114d962d88a27edf573156e9db9722254a8f5e617040606e552796
- SSDEEP 24576:7wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL02nQ/tbw/2Mkjy64:z68Qg55nhheWu7PNU3/LQ/lFTjN4
- TLSH T1D5B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 39601a71a30181c5bd8d6681c2305082136b50e4105ebcebac2b80cc400f7921
- MD5 2c47f0edb1267ed6eef0aaae4860cf39
- SHA1 fb41751cbabc79f84ce538656f32202747f76794
- SHA512 371cb315c396d33c5402c85766063ee6ab5f50775a731681382101278371b2558263c204b10c1e691d6c757a7e93edb8ceed861447a37a88ba39633759da04fa
- SSDEEP 49152:f3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99T:Sy5112gYy5azzVvL69nLKnhZFLm
- TLSH T141167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 7c30dc8024f09cb3870c91b6babb27234481466706be9e2e6652b2f489fe1e4a
- MD5 3b8edfc9f1962184adc541fa046cb669
- SHA1 6ee624e969223ba27b2574f9f3bf12d25540adb4
- SHA512 d3ecc5fb248d65241ca936e38a0090599a76f5f3ca8b8836f9a1ef9e251d0ef4dabce62304e4a89a3b18a0e83e63d9dfcf366fcb97aa7c6390187a3aa4345b14
- SSDEEP 49152:CB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glxQ/lFTjN4:wu6JmVxd2dWLm
- TLSH T118D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 7bfc715cc61f6bc79a4300d11eadb7d878a6ad27aac7fff8a889d4797f8fb32f
- MD5 adae5627c5aeb6a317a3b4274820f37a
- SHA1 fe4cc813b0769f48b8a1a52059f3c4a89e406e42
- SHA512 7972f0a40fc405c4e87478909cf9e2717883ce581ae9ae984961a1c868434ae40e65609e1e69ac40da20ac37ad8dab8e7a205e8de4973df38bafbdc0baa46245
- SSDEEP 49152:B1hpsNoJpF1A6UU44CwH7R4xFQ/lFTjN4:BmifPbRTLm
- TLSH T137B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 f379b31a0de695200bfb12a16cbcb0fa33e334e51ef0f8e2041573c8ed51bae7
- MD5 56a0863447d3c3e994413cea7c82362b
- SHA1 3069f61a90dd33407fa45575acacfb87b9ab5a77
- SHA512 1326f32af947d9454e492a2e28d0514b48f8d187dfab4d6a07328a6ca3b279455aa1008f1cb834e38542928c32a8cf641271af95fa243998d025929b944defc3
- SSDEEP 49152:USuZQIY0Be2KRRVtOnks6NMHqGQ/lFTjN4:G5dKTi61RLm
- TLSH T1E9C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 e10ec5a3887b43d7e3a1f89ba05a07025f22a79889d1ee6075ca2c69e812764e
- MD5 ebac8871da7461fd8bfa54b406d921ea
- SHA1 e5e52eef389072789e873028e19033fbae764efc
- SHA512 6ea44eb47453a3d37a92dd5489b2281a05b6f73322f55c231427722612ec7931f36043704247649bbd46cdd670324f97b5622fb2579d2e3120ec98e7143e6c53
- SSDEEP 49152:chtSn8EApI0figngiDn0AP5wiQ/lFTjN4:dX2iyphwLm
- TLSH T14B95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 110a81f37cc796dfad368ec6b1b903baf2902abef839ee819bc06b4b16e8d2bd
- MD5 585af7fe4fcb24e976752ff6e3bae0de
- SHA1 f421f1d17c6d31bbde5efab223ac5cabf43ac230
- SHA512 cf078a6099f22331cc7c94db4538be4ced416819669b3edcc326b42aa3c3691c7ba5f0fc0d9b78345dddd9dacbd28fdbcd849b7eb5d7ef13944e587613e84e9e
- SSDEEP 12288:EVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:E1nQ/tbw/2Mkjy6Fr7g0o3
- TLSH T1FA5523697965F98BFB1706F18C828182A73B0EC6BFD1938F77481129967D39406CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 c0cd4175bfb9365446bd85bc38e70d083b546e9dc11e9afbe29c4ce33dd2075c
- MD5 c09f1e4794b2dccdf24098e20c378ee7
- SHA1 039f554098fee8b87ad9fb3e02591d13d3d0d403
- SHA512 4df2c25e3e7f0f5335829201a298a747cae63375243dc3ea7f3142ca7e29ceff2a809f3b9e12a2f16287ea4ee21f2d67eba48ff0399b92c5253430321762d99e
- SSDEEP 12288:sUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:s0nQ/tbw/2Mkjy6Fr7g0o3
- TLSH T1635523697965F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481129967D39406CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 be8b0304042fb39ebe8943410efd1012cdcdfdd900531e6eb8e1df32531caada
- MD5 1427843beb66a7fb0f46ea047ad8163d
- SHA1 9ac7048d3f2bc3ff0622670754b9ca2d01a461fd
- SHA512 119e7f8589d2a8487513a42c05060c3fac38be4f3b85fba63892f31bb00e21be0fb4459290fdb6499d2f1fc85d83711f1ca4442792d2b0e6da40b43862062934
- SSDEEP 12288:tWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:t2nQ/tbw/2Mkjy6Fr7g0o3
- TLSH T1845523697965F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481129967D39406CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 cc8213122fe16b11f703ab9e41b5c140c067f4aa90336e1346f7358c036a8db9
- MD5 17b7624ead3ed99ad2781f210a7846f8
- SHA1 662fbd875657f5aada712506bd3a1b7927564ea3
- SHA512 c12191e7d95bc9dfd7ba5ddce1949f960a7b449ebb652e47a165d7c7c33c02f4f83260b38b1629decf6b1e9722acfe3e2415c6ffc83965ee9d1fed23caf26509
- SSDEEP 12288:hVfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:jnQ/tbw/2Mkjy6Fr7g0od
- TLSH T11C5523693B69F4C7F92742B4CC928142E77B3DC5BBB1A38F6B04111D4E793D41AA6B80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 708d44f0444ede371280f65408d7fa8d7a59e94dfaeb587fa814ec6400d7e70a
- MD5 7acad1cb5cf852bddcedd14f884b4b85
- SHA1 ffe5f03d76913d84a5c1017b2a13599bd34c2c81
- SHA512 bc6ce59c73bfdfc977f235a4ada2295d5b7f14655db13190235a39ffbbd1f3485a0c598f00a67a078f72dff4b8575b8a9f53cd792ed7f4d68194703c65a91db2
- SSDEEP 12288:1XGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:13nQ/tbw/2Mkjy6Fr7g0o+
- TLSH T1125523697965F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481128967D39406DB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 56f3d99f02c898d50f40f5d61763f7c2acaf6ab043d652cf992536ef73b21c42
- MD5 3fca902b66152c7d39394130a41a7afc
- SHA1 1288e12568aed904f3be2af421243283187f3801
- SHA512 b819354def2dd444fa7d51627fc974efa8b49a5ec58d54eff4359b9fc9fae9429919ddb945d078246dde69d6400f52261b16f0e0fcd7effc41352e287b8d0202
- SSDEEP 12288:44GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:44nQ/tbw/2Mkjy6Fr7g0o+
- TLSH T12D5523697965F98BFB2706F14C828182973B0EC6BFD1A38F7B481129967D39406CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 246aee53a9f5715cca59b6e8b65cdae1f2e0967ad28c0f1703ae35670deb8214
- MD5 41f4a0bec2b698a697171ad4f0a4f709
- SHA1 5158ed34c5ff4d77d7ea683a556416ff67022843
- SHA512 f57fb37366d5181b8cad70fdac0b2d982a695df6c00405c7bc9eebe7a0f68d2565950bb74ff9980fe90ad08143d0fcd07621e629be2b9b38f985164037c8f61d
- SSDEEP 12288:IMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:IMnQ/tbw/2Mkjy6Fr7g0og
- TLSH T1505523797925F98BFB2706F14C828182973B0EC6BFD1A38F7B481129967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 dedf68007a69047f0cd88f46cc49e54cd560173b47654f528ba1c859afc5090c
- MD5 bfbed6946802946fb535362a703468fb
- SHA1 7fa0d2b2315f73287478fc247ddf5037a5073b9e
- SHA512 384396c175ab3ee40ca733a66e06b0fc29c9f440e140ed0e30df1849e8b2a5eb4def4510ad3e834b3fa20312a2cee69fa223d08a594a5f3650e700b3187cc76a
- SSDEEP 12288:EiZwbDzzFEoS2cPvy0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:nZM3zFVSOUnQ/tbw/2Mkjy6Fr7g0oq
- TLSH T1797501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 7376746d94278542e48cfc841d7df7e5d9499969c846b7e92219f9f4d2872d59
- MD5 1d0255c368799741b5c437c1a1cb7d4f
- SHA1 3793da065c13ee12a6a3ec6826243eff3d423e06
- SHA512 dcb345f4b4850a23c93fcd03703114a9c730ac79c7615a7b1ecc027ad12e9510d53276da3ceb2f56a4e122144633bb8edbade25627501596b7addf3097983bf9
- SSDEEP 12288:FRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:FhnQ/tbw/2Mkjy6Fr7g0os
- TLSH T1D55523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 cbb19ef5ca4a137a28d3cf3cd66a4493b00dc51ce64e6b1887f04785f3d2c62a
- MD5 8208697bee234a8a5f1a0857ab1f80b6
- SHA1 3f542e58959d288bf830676a4982cf4bfb9385f1
- SHA512 cb9d5cdb811570b09ade6e7be6c556ca16b33cea5fadd47679005593ad3f9bfb5c137ab5fdcfe4e1dc37b9263113f29706b996659169c17a0b90e8a3cb9039c7
- SSDEEP 12288:K9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:KdnQ/tbw/2Mkjy6Fr7g0oa
- TLSH T10A5523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481129967C39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 482ec46461485c87be1f592e0882460e43321ea765c3aae9e0ac857f04b06e4e
- MD5 dac9a07e64aef840baa2ae9bcf59d758
- SHA1 b6afe354936930f6f03b954cc865f0c27b310ccb
- SHA512 9fb56ecbb93ddd8d1f5774d91aa651062fb4b24e1fc9c355cc3c30ba6eb6713df53f79310b9b17927ee2d8b8a9a224dcce389a0b0a327a8f386d37af341c91c6
- SSDEEP 12288:VyPz5L8AGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:8zygnQ/tbw/2Mkjy6Fr7g0o4
- TLSH T1BF65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 894720342d738dcd39bd81fb13e053f231dbe97cfba21ee5cb78cd4deb52f2fd
- MD5 3602738405b7ba76a1de9cb7e0e6660c
- SHA1 c11a5bc3ab27f4d1951aaa7f86ada497fcbedc1f
- SHA512 f8551bbc5c0fc9fcc76e5c2820d5aef2cb04df8b9350de1f0468e6f9d1fdbfb0727474fbd9fe0b113f0669af61a8263ab07daf8d996ea1e31448536c399d3f97
- SSDEEP 12288:MRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:MhnQ/tbw/2Mkjy6Fr7g0oa
- TLSH T1045523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 aa6dac7aa48efaae7bd10dd619223486de5fc610e906fc809443cedb3c1bcbce
- MD5 343c30c8d3fc08c63e4f35b6257b342a
- SHA1 a16cb7e59083134d1eb6815cdfc1b0a8e09df517
- SHA512 859f37add3dd3ed5c1f77eead7e73609acbc1424cac77aa2077fd50f321a3200c1bf99d5f993171351cc45ae25ec0fa65e8c77f083490f15f82f0dc8b36b38f9
- SSDEEP 12288:iRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:ihnQ/tbw/2Mkjy6Fr7g0oG
- TLSH T1A25523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.4MB
- SHA256 4b6824bfad252dce066381c05e8af764fc229adcd7f7ed23e1ab3fc3b5bff6a6
- MD5 5a7d6511cde0a028883fbce6b695145f
- SHA1 a4400ea2bbccc65feecb81b7572950fb6e637d13
- SHA512 c2e91d4796c9dd3f3c5b1343db47f859d2f1c8835308377ba30c63350c91ecac2caffe7f8d992fd06f4bcc6f6202d671c831f1dfa3fa832024aa43319c38f6c4
- SSDEEP 12288:KyPz5L8AGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:XzygnQ/tbw/2Mkjy6Fr7g0oQ
- TLSH T1C365021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.5MB
- SHA256 878e2bca45d3249daef067d932fe9ed9e583d8eba2539504be059a53f3df0baf
- MD5 59c2514d9a3f04d7f5c918d79063ca72
- SHA1 36048aa168115b030f75751f72c2136f0ce3c6c2
- SHA512 11911e455b1e9b99f036765cb28dbebf6e2db6811cd36519bdf5611d63a494818efe3b6e9139506347b6c0776f1ef686ab3ca93d278d85c010d762e5b49c6459
- SSDEEP 24576:rT0aLl3z0zDmnQ/tbw/2Mkjy6Fr7g0oI:rTDLljzQ/lFTjN4
- TLSH T1487501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.7MB
- SHA256 e3e0c5af6644c49cb9723489747bbe15420b725050aec6610ee3550caf5158ef
- MD5 9fc4474373d26f51e40cf0d45ce2e818
- SHA1 396549898ae12cf6cc4d7c6a2dd291b884a32b33
- SHA512 a05b750d2f0015d8dd184ea5b1f43de00997acbef23d2e14df0befd93617853419dbddf4cb37f82c94b9cca5121c760a4f6f875562bd212c664ea70fc284e8ae
- SSDEEP 24576:O31d9CHKy7GZqnQ/tbw/2Mkjy6Fr7g0oi:Q1d9CHKyaIQ/lFTjN4
- TLSH T1D685CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.2MB
- SHA256 551c60e31cf3e55cd1dd2699b92911a698aa9a99301cf76ef4c750f4fc4a80c6
- MD5 140c0c697882aeea6bb83ad748b7b454
- SHA1 3ffadbe21a1e4f259251481e824b46cd75ba0342
- SHA512 d5aa4ea1ce933bd5dfe6acf5266d0444947fcdf2070d2ed5481c9e26455418ed92dea64fe5b0bbc98ab097319b5bd675282aecf029c67f240a903449d11a1ae3
- SSDEEP 12288:R2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:RWnQ/tbw/2Mkjy6Fr7g0o6
- TLSH T1265523697965F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481128967D39406DB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.2MB
- SHA256 5e313fd8ce1bb4da67a01e4657af1cd1d80b5064c2074cd5c95c9e7102d6d2c9
- MD5 900444da4526c8f06b54d832249d0856
- SHA1 02667e5a0e29933e430e62f45264a1faed19bd61
- SHA512 47ef2b068c989531e5f09a13facdb56a674a4faa2ec940a6326ff7444dd5dd0b8e96841aa2971bf954367ff122ebbcff3702304e11926e56d87390fff9425ef3
- SSDEEP 12288:MgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:MAnQ/tbw/2Mkjy6Fr7g0om
- TLSH T1B95523797964F99BFA2B06F14C8281829B3B0EC6BFD1938F7B481129967D39406C67C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.2MB
- SHA256 bbf71ca91e9a57143c3e5058dff36b5cce8963fd83263f95be1265cc7383dbd8
- MD5 61222e88d45cccd36d120741074fb2e3
- SHA1 300a7265ae07b7e5e49f4397bc1ed7356a4b66a8
- SHA512 a448afb7f1ffd73a5d10854880f6c4dbc68a9c5640c54b74a096d2bc9fd2cc39b661e4c737691579a3f46c5844637f1755b738bf2af8fdf85f2692383aafd3f7
- SSDEEP 12288:QbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:QLnQ/tbw/2Mkjy6Fr7g0oa
- TLSH T1CF5523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.2MB
- SHA256 c333df6fd06d8e5d4b1d71700af0a53fd63322c88bbdc30c5692aa4edf04b468
- MD5 5c3d03465fff161f187803126dd55e02
- SHA1 88b52f9eec57b6d1e0beb040b869c1be95f48fca
- SHA512 d41fe6fa38ba30d7d508b5a7a41957abb1820439e08175943e68f11169198b6acf1f37e44384fef68c837440b9ccbbf59e847891d7792374e5d4f1df1836bf8b
- SSDEEP 12288:2RGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:2hnQ/tbw/2Mkjy6Fr7g0oa
- TLSH T1835523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.2MB
- SHA256 20dc34f5b61babb5c13e8ccd6285b92771cf7a14dfe329e133cbda6722987161
- MD5 4eed1be970629d8d32dc3e33078c5610
- SHA1 6a0aafef95f34d9eeb048a126f1a399511a87360
- SHA512 eaa044305ba7a6e23d21f836539b69762d1c472162479599ef054341e5ecfe3c017d48377c67cad1ae2c6f1a5cd2ae8d40c4593f9c4298b3883bc9e1f85d88a0
- SSDEEP 12288:i2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:iWnQ/tbw/2Mkjy6Fr7g0oK
- TLSH T1685523697925F98BFB1706F14C8281829B7B0EC6BFD1A38F7B481129967D39406CB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.2MB
- SHA256 6afbcbec8875c5dadaf051b65b4652eebfbc5446f3d95c401e3ef0dac60cca4f
- MD5 dfffb3f401022f34f9feaf050f1e2fb4
- SHA1 3fb533f44170d0e6780e85b7174aa1da9c56c006
- SHA512 9f54ec27c54b0b70301f1cc4605a1fbc243724c79e0482d91928c2f81e365474211562430d37aa59e9d0fbe611d37cef3fc9f6561e54daf4e75d2c450a3a4836
- SSDEEP 12288:bpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:b5nQ/tbw/2Mkjy6Fr7g0o+
- TLSH T1295523697925F98BFB1706F14C8281429B7F0EC6BFD2A38F7B481129967D39406CB784
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.2MB
- SHA256 268b8c4d0970691fbe33a484df5043116cce5930a70e33814692ba19aba71895
- MD5 15f9cc948f5755d2ae8150ee1f27f5e6
- SHA1 36a71cec8e4e80c9e1144895f73fbc72c1138372
- SHA512 9dcdef46d1c81690d10d8eee27a7dde29a897fa6cc988119219e15fe5e33f15bf8cf922cfd797eb347b0c6d6b3e1d3d4b0d113f8c7bcf7b143edcdd6c4de3249
- SSDEEP 12288:IXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:I3nQ/tbw/2Mkjy6Fr7g0os
- TLSH T12A5523697925F98BFA1706F14C8381829B3B0EC6BFD1A38F7B481129967D39406DA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.7MB
- SHA256 9dadbc74ca1fee9b79f96db570d6f361ac527042c4a514af9a9ccb190501fd3f
- MD5 46ddb6bbd3072cac5d40fa66c9477912
- SHA1 3b0ee9c5071c26b21ba9caf8b1b7c77a5ea40900
- SHA512 ac4dfdc5d188942933be607c1298a4dff0d7d29cd5ebe01210aa21a630420ccd15a412e4f5a9129154243869b615a872c2f05b1e89e3b27daf77c84b56d9a7d9
- SSDEEP 24576:Afwv/k9RX6wkyAIqnQ/tbw/2Mkjy6Fr7g0oK:fMnYIqQ/lFTjN4
- TLSH T10485DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 01c2dcaace348fd1806383a4747a3641bd51077e4c9c835dba83c6d662938997
- MD5 db9b9e74f6468a0e95d8d954cee064e9
- SHA1 3348efdf4cad7730964b37f3565a58a38b49eae4
- SHA512 8337e83c7906f4b471c8b4492b96860687543d1f76e0344e626e868440559b0db7d3b4b9fab3ded23d74ed0037610b655bcb2d837684b0a538ac0799021a20ed
- SSDEEP 49152:jYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hQ/lFTjN4:nySzPOLm
- TLSH T11C066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 ea352fab32f57603cf6adbd2735ceb518183ce7a8832d93aa07f06f5d7818fe4
- MD5 e2c8c64ffd0059fe9c3fbb614b64c990
- SHA1 0617a8737216b3b1c4e36a2b550b0636f204c276
- SHA512 776bf57e2cdc89c73a74b1dd19d1316978a0b055f0f1787af1effd245886d6cfd6d3ad47b3496f87cf997f7f9779e0c22acedc209205dc70251911a57985756f
- SSDEEP 24576:K47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY3nQ/tbw/2Mkjy6Fr7g0oF:K47JUQj1irIhCnDHUPfF/xQ/lFTjN4
- TLSH T17865AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 13fdc474567fd43e65e46988fdf600fd16cb84fb462c3fda77cb10e60c5abf7b
- MD5 242b9b80fbe7b8a235bcc35dbf7b78e0
- SHA1 3095007d2db298e232503d7e516614ee24147a19
- SHA512 ee3ea777d13c6898a1d715c89f415deff8431f10cfe9d2661c0d7f233c164072e9a2b49916e700b19cbd1e458bf9595ed465da8c50ba24ffaf6bb67b20d56117
- SSDEEP 12288:kssfmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:KGnQ/tbw/2Mkjy6Fr7g0ov
- TLSH T1EE65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 1f3c86614331cb4da17b87030605dff1f59efc187bcf6370e3340721b4c5fbe3
- MD5 022cb10cbd8ffb462c2c0bd50741dcf1
- SHA1 7a461afeaa184f9d549349a00b9d617f3a83145e
- SHA512 faff2c3677fe3f4b20f9ea6fe56f0e6d6012be2bda662208cb0d836a471c36b76411409e684771764e2e4f9ea2bbb80fe64b0b0f65a9cf5f67dae455a7e00192
- SSDEEP 12288:PwllXvFU3fHj5VievyeeqylOt0AErlyw1+qBjwXSjpd:Pw3XtUPHziYODlE0AOlBAqBjwXSjpd
- TLSH T19B4517007626DB4BC66950321E76D6CCAB707D06EE44AF0773C9873FC476658BAF6282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 4KB
- SHA256 5f8e27f68049cc8c42747a76ce1e487fa1f4c3d26998db21246fb06ef4b13e9f
- MD5 d0804dca00bcf13dd028be7857f0f701
- SHA1 fcedc15d291606951b4d9908d9b99124d338b758
- SHA512 94d9c48b1d004d9a7e1018092bfd7e728eec73b81cecc871e2e72563a4a08f0948ecdbea62a4e141be376c35105696d943fcdf9499a9348e2e09c1ce8a67a575
- SSDEEP 3:OlH/lAHwd/1Niglkz/MOOzj1Bl3yjJ/llS3mCllltGlslslslslslsl6zY1lt:KSHgkzE1dOjlEmCtEEEEEEETv
- TLSH T1D08112B46FA02B91C9A6787184CC876D8731D00AE080CBBB154C54F16C80268BC2D72C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.2MB
- SHA256 b63e12c09374a404c9370a97b70948c84b864a641c0a17c4a1c519f3401c9fb2
- MD5 15c206b92ab481fab8ec32146cc03c48
- SHA1 a0d8788100e4fce4c02d8e659763c1f4ed58c570
- SHA512 53403602902968b1e867077199f1e64bd192ad793cd8e52c23cd9a6d06d2643dc09ae3625d9e98247adae392446a09b617f3aedd403b79b21bbb1ed15ea037bc
- SSDEEP 24576:IJpmGHT8nez3CLGW+ZdDYYClbjlZblAUlxlkltlR+tRYda66BT272yDzpZ:0enez3CLGJZ1VCFPFTIn8tel
- TLSH T1D9452C426173EB4FC4BA403707329A8DA7B4AC07FB452F05A395893AD4BB609B5F57C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 19dfb0a1fb54df5bc36f9b54bbfc9e0c2bdb3a1bcccb15fe7559d224389d808c
- MD5 eabf58bad31c2faf3f87a22329dc27ce
- SHA1 aadb703bf8ad699552058d2419352e20a7cd2b1f
- SHA512 d6f82d69fd636c768662496a78ffd021ad6cff7c8f04869463cc70eecd21a792cf55a38d512fa9bbe7d5e75151031788072f6075fbceab6d671253943d35d585
- SSDEEP 12288:n67OGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:uOnQ/tbw/2Mkjy6Fr7g0oy
- TLSH T1F85523756668F94BFA3B06B048928111673F0EC5AF90D3CFBB082269957D3D40EF6789
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 594801ff6317a00c220a40e56137b58e841290c1a72aa9a6dde1628acd4e0d4d
- MD5 743bd33b2719caa481c9994fd92244f7
- SHA1 f9d34b569aaceb25164b1b46f8850cad068c4e78
- SHA512 01272170632b3622cf7d75e54d4f99252cd0ec96d86b0584f27e9d23d514ee38eda5cd22c3098855498556bcaff976d04282ef5fb5c618c05848db903ea334ce
- SSDEEP 24576:Ugb6bmBIi49WNNFpg1rSvFv7bYMnQ/tbw/2Mkjy6Fr7g0oj:Ugb4mBIBhGF3Q/lFTjN4
- TLSH T1E065AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 80ece008380e8c4db9c1c9b9dcf2600446a5a1c1e916414aea8f327ff44af943
- MD5 60f54877afaeba8a81d6c4226975f5d0
- SHA1 f9c12a1ab27c9740942b08f0aa38c1e33f5bc413
- SHA512 8d0bd6815532910058d8cf85a8f19f18607ef78d42a75f71bd230038e1e3b568e14a6ea51c08209a78ef193bfeae2159442a8582284d56d40278afab21001a69
- SSDEEP 24576:nG88u8FpJqH1Qzria7/mnnQ/tbw/2Mkjy6Fr7g0oM:G7ZFPqVva7/UQ/lFTjN4
- TLSH T16C85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 cfb01e596a30e327d4c6590d5fdaa6b290f857b334a6d68cd0ed2e299924630b
- MD5 b7c7685b0fafd0fa51b7130c5809a932
- SHA1 55ad588c1f896302d385b59191807ca781bc2fb4
- SHA512 15408296890e5c697ad3986098cddc407f84848c9666406ca010b378392687cbc856ce66f57d82713acaa5c449c0a7ea734186a17d88f158b286063ecde03397
- SSDEEP 12288:qHvUrBFrEjwaQzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:qPUr+NQjnQ/tbw/2Mkjy6Fr7g0oV
- TLSH T10765E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 a72662bd23a3fec086c383ef0994c9bfe1e4e6edd68466329ccedf5528d41201
- MD5 b55405bc1590e23610607af714a26bde
- SHA1 c434c831764c10d62ffc622aab313b6f958dfc6d
- SHA512 054aae9f4aa061b3cfceb11e371bdb942c6878fcd3002fce6950860de9f968f53067bf1489184f0281e3d3ef5587d85a75f98b39b8015f83b09e8bd098951b91
- SSDEEP 49152:BBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjTQ/lFTjN4:iG05lO43b9Lm
- TLSH T1DAD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 0268a648053782aa2e8bd906b8b20ca1ca831912d44cd93f8a0268e8f618ade0
- MD5 cbd1a10d776f567f38e5c0f490aa3a21
- SHA1 4a301d94bec7af9d7adeb95c8e9d4941b08bf2e8
- SHA512 1dfb63e9fefdb8e955d4962aba6501bc5a930e04bc22f2294c4ce40db65d5f71bac0fda653a99c384d90fac756716af493b88220071b61af5bb5101d601b8174
- SSDEEP 24576:hfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnhnQ/tbw/2Mkjy6Fr7g0oB:ha5POZ3+Jt2pasx2+mLQ/lFTjN4
- TLSH T15765AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 164cce1d2cf402c1da77262c53efbfaaaad6ed254cfe4b9146e6ab00e6574826
- MD5 47e7d8d7bc1f37ad27b1c98f25773898
- SHA1 bf082228d2fbf44622f971459f617bff54d23c8f
- SHA512 1669bb4c73fa4cce00465e6f1b19cbf0d2ca69f9e2d6bd256d5361c115a73f149d8dcf34775e72a56fb8a78bd13f8bc6eb0c2f2e478a748ab0c073a30d6d6456
- SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7FkfnQ/tbw/2Mkjy6Fr7g0o+:SNc/zEOVHF0Q/lFTjN4
- TLSH T1B8858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 8455a011fe30cff4945f705241ebf1ab47c5e20e6fe8e356bb28bb01a36e287f
- MD5 ab495b1d7b5401739c54da721403e649
- SHA1 9976d179320264b96a0093398a0f5dd7ee030717
- SHA512 334205a6f6a9ab78fdc2c247893946c2e4d8129e17dcd2703f2455b690e4a63b44d2f39534bf2803006fcb86df4b6e00f720496c7ed6b0d42bfbb54b634d0dbe
- SSDEEP 24576:W8kNvNnaFeYhJNtmZBm1nQ/tbw/2Mkjy6Fr7g0oX:W8MwBtOm1Q/lFTjN4
- TLSH T12B55AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.6MB
- SHA256 5938ea4ae359da3bcd5c96226f19ade7740e1d044096bc13282dde8b0095fd9f
- MD5 848d116e2a85eceed7051c0cfdc9b891
- SHA1 19b30bda114e42a42012000c2a34af598b81101e
- SHA512 86bc30d93c30322ac0dcdd923a400626f764bde941a6e8421b159875693229c7948bbe3d94d01d71a7c10d2cd55433a19471d6a96bbf8721c2025e352421c9da
- SSDEEP 24576:MD3FHshBIYQgACnQ/tbw/2Mkjy6Fr7g0op:MDVHeBIAACQ/lFTjN4
- TLSH T1BC75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
- MD5 SHA1 SHA512 SSDEEP TLSH