733caeea3267059e0733bc9cc7cf1e2d23dbb3171b24fc9f51f77a85de8761a0

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_0471e920a6fe3f2c342a69b8e18f8c95_elex_redline-stealer_rhadamanthys_stop.exe
Size 1.3MB
Sample261024-2w14nsfh83
SHA256 733caeea3267059e0733bc9cc7cf1e2d23dbb3171b24fc9f51f77a85de8761a0
MD5 0471e920a6fe3f2c342a69b8e18f8c95
SHA1 0e141ea3074155a0a9c1570c96b78f076dc37ada
SHA512 66a390563f382e3ce50d7a1521e77253e7b0f31b635e1c0d4611b2adf8ed075d29df94596d7770526aa4c5d751149831303f7b4e70f2333cc848561b0c6ab438
SSDEEP 12288:E6pYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw2:Vye/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1AD55239A7AE1C173C97652713834C7F1139BACB12A70B483F5853FAB9FB0AE5561120E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1740	elevation_service.exe
5068	elevation_service.exe
5956	maintenanceservice.exe
4352	OSE.EXE
1432	PerceptionSimulationService.exe
1868	perfhost.exe
2060	ReFsDedupSvc.exe
4140	SensorDataService.exe
5460	ssh-agent.exe
5276	AgentService.exe
5984	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_0471e920a6fe3f2c342a69b8e18f8c95_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-22_0471e920a6fe3f2c342a69b8e18f8c95_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_0471e920a6fe3f2c342a69b8e18f8c95_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_0471e920a6fe3f2c342a69b8e18f8c95_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\523bf3c4f1788cf2.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106906\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-22_0471e920a6fe3f2c342a69b8e18f8c95_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_0471e920a6fe3f2c342a69b8e18f8c95_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4852	4100	WerFault.exe	88

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_0471e920a6fe3f2c342a69b8e18f8c95_elex_redline-stealer_rhadamanthys_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009715bcf90a64dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1740	elevation_service.exe
1740	elevation_service.exe
1740	elevation_service.exe
1740	elevation_service.exe
1740	elevation_service.exe
1740	elevation_service.exe
1740	elevation_service.exe
5068	elevation_service.exe
5068	elevation_service.exe
5068	elevation_service.exe
5068	elevation_service.exe
5068	elevation_service.exe
5068	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4100	2026-10-22_0471e920a6fe3f2c342a69b8e18f8c95_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	1740	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5276	AgentService.exe
Token: SeBackupPrivilege	2060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2060	ReFsDedupSvc.exe
Token: 33	5984	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5984	SearchIndexer.exe
Token: SeDebugPrivilege	1740	elevation_service.exe
Token: SeDebugPrivilege	5068	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5984 wrote to memory of 2824	5984	SearchIndexer.exe	104
PID 5984 wrote to memory of 3508	5984	SearchIndexer.exe	105
PID 5984 wrote to memory of 964	5984	SearchIndexer.exe	106
PID 5984 wrote to memory of 5400	5984	SearchIndexer.exe	107
PID 5984 wrote to memory of 3512	5984	SearchIndexer.exe	109
PID 5984 wrote to memory of 4356	5984	SearchIndexer.exe	110
PID 5984 wrote to memory of 3800	5984	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-10-22_0471e920a6fe3f2c342a69b8e18f8c95_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_0471e920a6fe3f2c342a69b8e18f8c95_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4100 -s 496
  2⤵
  - Program crash
  PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4100 -ip 4100
1⤵
PID:4588

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5068

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5956

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4352

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1432

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1868

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2060

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4140

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5460

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5276

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5984
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2824
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3508
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:964
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5400
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3512
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4356
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 41735bdb3eb09c417571c60f16c87ddc1187687c3864e73fb17a78d17c9db058
MD5 da9091bdb0fa4adaf9ff806cd3716149
SHA1 1141f970792a73f9920a5da6eb5bd2558e1c2a0a
SHA512 828d320fbace812043df3b4d56645095261fd99a47f6690c320de3d60ee7981c2e560b810dfd4ba2674ed49eb1370060d4c879442d1b82b10e6c2b6e3f498e7c
SSDEEP 49152:kb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnxeN7xB4dcUDb4kw:e3q6HjBzxAcob4
TLSH
T197D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 f00b523dd456c285fe27afefeec2c8d24b536983410cf599f966be1fae323413
MD5 c9133bf748ca569af3a4ff34f0e73951
SHA1 576e45e43185876debddfe4ddee1c2296b76cc51
SHA512 3fca90f86af2170ef4efa7348a2f950069e645af4470efdf91cd17347ac82e86de2bd4b6bd5932386b75955389e9ff43fd25fba6694b7d8c3290a37a2f5b4e6e
SSDEEP 24576:EXYfDtczAQe/fvF7asVSyRmdcG/DH+M54c2yw:jtcHeN7xB4dcUDb4kw
TLSH
T11D75F12977E405F9ED678278C8B28502E673BC910760F78B03E4AA661F736D81E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 dc2a956c84d9cdf2a2d4275df83372c4c7062cf1f2119e2dcf6df35dabc739bc
MD5 b35e7a27621f2f8c67ae8072fbc58666
SHA1 60f98485b7316a596974287ac33b3620942da0b3
SHA512 cebd04044db34d09c6f0b940cf3d7d6e96a76cd0281c38963db4a343f5cd57798eaaddfee3831b2288fa9fde9cce3d5b613eabfecc25571f6cea15aeec11cc76
SSDEEP 24576:50Le5ji0hmxirMhe/fvF7asVSyRmdcG/DH+M54c2yw:5Pji0AcKeN7xB4dcUDb4kw
TLSH
T12985AE56F6748331D073C0B9C5D2A68AE97234861B308ACB4286D77C7F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2b2c94cf47830e865460354322e835466bc8c0b07a4ac7336b3959853bbe4e57
MD5 f75fbc470fcddfdb573ad55ca5a553c7
SHA1 3a85843a41f8f611a0299b7a4866142ed63c9634
SHA512 ab44d47a493f039173d5688bac7b02a092529f2e4eebd4c7188cdc00ecdcf42e9417fd8703bdc545043b8e99c49b6350a96d45459e3a564d0cbf525d73adcf77
SSDEEP 24576:+a7/ezSC6vUyD/aqgrvWE6q8wyu7e/fvF7asVSyRmdcG/DH+M54c2yw:5/ezSC6vUzPvxHjyWeN7xB4dcUDb4kw
TLSH
T1D1756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 376e2791a2ef94cb04256a9c7ac19745d02cdc02d6d48ea1a731fa0856e46b4a
MD5 3fda443ded66ac3198390ee7d2dd9b72
SHA1 b988ce652659e06b23bf32809030656e8732a9a6
SHA512 a2cf1310c0376050fb3dc39fc144eae639a4dc3c9a4b049826a88b1b1ab957adc2482a2fd89b02c32e890eeab5690bfe6a13b43c2dd1a95ae8fea8599950bba9
SSDEEP 24576:qVbqPb88hv/l+6Ae/fvF7asVSyRmdcG/DH+M54c2yw:qVO88hXl+deN7xB4dcUDb4kw
TLSH
T1A0559E66F5748331D073C0BAC4D2AA9AEA3234425B318ACB1246D76C3E77BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 0fed4c20cc20fe0393b15171a5937420c2d678cee3610e9f21c40527f70d7379
MD5 795667c89fdb1ff181fc1f684ad5c403
SHA1 ca84c87b3d48e734e07258799fc6d35f4626ca0d
SHA512 ae37935ccecc8b80efa09174cc0ebc67a8b4a4a11f0df19788484725231bdbf7e935993c9055f0e2b3dcf004b7d1080ee249c81b2e7ca3059c39c2aad9ded17c
SSDEEP 12288:gRAYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywY:gR1e/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1C95523CFABFD12B3FBB6537134711A9211C39CD42DA0745AA4903F8A66F8CED948025B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 0dfab1fc15b211e9f443181a17c044de53519cfbdce958fca124e516bd9d7be7
MD5 f70a6da27d08368e586ede6fdf2b7975
SHA1 1927f18caf76ad22ea71016c07f5e7d4d9a722ad
SHA512 55a1b9d977c4ca61271359d0bf15ee28b530d2ea4521a1329f2dbf701d6c3616b2913a768ba4986d07bb29b9545ccb0e3c8708ddff30a624a181460cf11d06d3
SSDEEP 24576:+JIUoe/fvF7asVSyRmdcG/DH+M54c2yw:+JIUoeN7xB4dcUDb4kw
TLSH
T1DF75CF7BEE38FCE2C27A8DB85A91874093A278704F61A3CBD164830EDE335E55D75825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 037a8e3c639f70d112d5240aba141fe48c0867e3df35790715f94605de808c0f
MD5 94c05f8f305cfca753faf55fdaf1adf9
SHA1 325cd93bf876ebd5629feda71a1fc3c79494f289
SHA512 a70cf1127a1f7574b60267f0e9b5fe0f15e4f61a2ae25599a2cee3c61f78e1061a71b2515b2d99b31977838b55f1cde0d137fa07ea37d8f3b56975299e5df1df
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THd:SQvGAdlCEL8c/yRNw5CAxAcob4
TLSH
T191266C656BF880F5E0B7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 3ca56d7f160ebcd3461e3475671c04c8aec901f2ee6f3f125e8df8eda49ef61f
MD5 296920255698a495c24125020e8b3206
SHA1 a8d7a4465fb7af5f9a81ef087f35cae1546bb3de
SHA512 8941e3318c808eb827eaaecfe4d3ecf9578aa5041c49ce34237779829a987da1cad282a089ed2d852d4cb5d363e308a47c7b235797a126dd4f85b99aaec819cb
SSDEEP 24576:kdewsAjae/fvF7asVSyRmdcG/DH+M54c2yw:8ljaeN7xB4dcUDb4kw
TLSH
T12F75E031FE74E032C7BB0DB22B36C716146DAD600F6129C3E3A85E8E59746D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 107d144140b9cd751e37b7b310e8ed9f13c01670ff935e0f1ec91b8d28ef0bb0
MD5 b368c36686f6fa9b3c3c4ef85c8bda11
SHA1 5fce6c0dd0bef9954b04cdfcaaafe6ec07d9daa3
SHA512 19e5e7ed54ac56ee65a1b403ead0cb06c8ffd5748e16823816ff8cee07dcf5edf8a029e037c633451ae3b3d501591eb6196cfee640a821fa1fe67d3e5d7a448b
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHX:JUEtQevvqc2W1cpV2EI32X
TLSH
T1DF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 974e6277b609a5758898dbc0fd88b468df728f908195cc0b99684907f408cbe2
MD5 edd207785b99ed8a8b96c0462d5e3898
SHA1 ff671573ec8cf06d41c7ce6da16a4d6a7efcd70d
SHA512 e4cb1ae89eae822d8c0eafd4b7d32453bb3fb521decc877b5b1fac1bad6a23c4f67322e3ff3178b4139a0f980e254b1625b49ae7112a7f77bc7d246ae2a85dd6
SSDEEP 49152:TCbRquA/m2yL5zLfFiV+XenmE3/z6eN7xB4dcUDb4kw:soq2VjnmMxAcob4
TLSH
T129D58D0976B8C2E4D1F6C77896A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 82996b22565d8ab8c26405b599f648f026a6514e7b40250615d7cd504a521f9d
MD5 c4cf95ad2ad652137cf1afceb565e5f7
SHA1 10d875a8a02b1bbdb4370dc215908b93b9d4091a
SHA512 35efd125b3c725ab5b8a151f95461cee04da10f135d097ba83ef029aea4b7391b125395be8a1ff2e17452913df115c07ed94f7d5ef515f265ed5f79405ee8de1
SSDEEP 24576:VAhGLJIFoiwtA5l7S53He/fvF7asVSyRmdcG/DH+M54c2yw:VAMyFoiq53eN7xB4dcUDb4kw
TLSH
T14B359D81EBF951D4F5B3AA78A9B68171EA76BCA65E30D20F2150D10F1E33E909D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 1e4ef3f0485d091d05cea0352f36e643bd2004942dfe8940c83d4ef80498abae
MD5 6ec28c687445b67a36ae9fbb6e3bd359
SHA1 da3078d30947ba7610d98d529adf07a8318e5cd6
SHA512 aa2ba3b6c5aa7ecc15c8069fb230428a0ce576f3bec658168f981c52f7b370fb75128268abc450d6c215c86da9e70d6a93f2fa1eeae779eb5fd3ce1faa8f02a4
SSDEEP 24576:ZwuoOW2e/fvF7asVSyRmdcG/DH+M54c2yw:ZwDOjeN7xB4dcUDb4kw
TLSH
T18B65F14A77E908F9EAB7823985578532F3F3BC012A20E71F1760C65B6F772616D29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 46bd592da97875f6bab73f2730739103a6174adf0576dbd0438cb1bfeafcfb71
MD5 d5b50d88b4b3db3c908b675234c6a501
SHA1 8f473d928700410b48e720746f2e94886379e9a2
SHA512 f20e9d006eadb04aed2808b07b9931585fc058373c2cd245ae9039a806136811850c8890571493fa64525094e6c669db62efc9f8ff30645fa4717e9c139b7e25
SSDEEP 12288:2BZ1IyxYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywe:AZuJe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T12555129E37F821F6E6B39379A8F1464193A37C92277063CF1064668A2FB1ED51D35322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 803b1f0e2eec71e4b43bbf6b4c3bf975507e6c1d25eb1b4bda4d0d783752a557
MD5 5cab883805f8134755fdf458a253d7c5
SHA1 5820fbe03db13e07cd2ab85299ddeb7f7a687d62
SHA512 689886535e0537bc5b9f93efa21529279129e22e42f97f80cd501ebfe398d7ef3d25ecda0f2c6a4d4b0ca6bd4a14ea87341d78c891894cc42ab6d3826662dff7
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UZ:kQRQyi36YOcPQLvw2gAf+PN3LxAcob4
TLSH
T178667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 58a737e576f3eb5dc2c42708acf1becdf601e1e7d5d03e43c515a4a50f9e76a0
MD5 2080ee38e583287767b72647fb75a7aa
SHA1 a7730a8dbeb0114c9d597bd193b297a061202a63
SHA512 3471180821c3d0b9badc02815171b0985a8e36d0d8794b2d05c1754edac4fe3ef06f4a753cc5186aea506eeed48ce5dd50d59c584562806816747c5a3938f350
SSDEEP 49152:cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UZ:zQRQyi36YOcPQLvw2gAf+PN3LxAcob4
TLSH
T121667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9fed14972b3c9fb870c8589672409594bb73d0a2ad165d620d68895417c58343
MD5 0a751c03baee19349667a79177c73bad
SHA1 5a7d3b522c3fa7a1754cefc28d249a8e8badaf32
SHA512 67416ee180aff2edd307076cb7b2aeb7ab48cdf0fe82934e143a2148232cf71b2bd751d93bc8c0ba44a96b3537e4fdb7540c9008946c68d67f9c981a3f346e5f
SSDEEP 49152:a68Qg55nhheWu7PNU3/KeN7xB4dcUDb4kw:IthWRc/lxAcob4
TLSH
T15BB55A33B2F600A9C45DE1769F4A873196D27C758FE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5fa44298f9092ea8f0676d70d5b177e31ad0124bf1fadfc03f77cf912185e8bb
MD5 eca35f9204127899a1d75f2e2e2e0f7a
SHA1 6ae24b2de2950302ee79a9f9be0296ed68c92aeb
SHA512 ef8e98e9fee2d7b42a231d07eb09203c23a640090ae79407dcd3c842b8b4cfd2bde5367d9f14f23e44110527f53ec903c4d5ae63f421ebc454e03c0b30014e8d
SSDEEP 49152:R3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99r:wy5112gYy5azzVvL69nLKnhZ2xAcob4
TLSH
T134167B13F29900E8D05DD1B9874A9232EA62BC474B35B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 87779f959478cc628adb6549c390d13875486aa801e75b349c094b0048487e29
MD5 002ea6de115571a2de07b19aa98f7595
SHA1 18c12dc0d60adf008e4007c98b480ad9d58169ca
SHA512 48349fd662fc9f97de5f385a4b5627c67349506b83448a88a5ad1880587821a95ddcdeefcc3b73da8e0b0bd845524ace8a47671e37300a11d3e1d258292a0b79
SSDEEP 49152:bB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glAeN7xB4dcUDb4kw:Nu6JmVxd2dnxAcob4
TLSH
T194D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 24bbd83b2e448b94a3d6da2dc279df4e866306cb9c89beb3dab0dfd70ff0c5ed
MD5 afb498a2e2a684f0269814645f6e376e
SHA1 62b74a4783f12f2bbd55c1bf0717e77537668eca
SHA512 21ea305f3eed914845b547ac5cd40449eb61e85e1b059bbfc41aaeb4bafb0f3a0c075e319f14308efcae17e68d141fd03672e553a0d9879cb65cc98a1edfc5a5
SSDEEP 49152:91hpsNoJpF1A6UU44CwH7R4xIeN7xB4dcUDb4kw:9mifPbRMxAcob4
TLSH
T10DB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cdde949fb589fedaf88ab0b0a12141a365614c2f533b17f73ad77075eb6cd0d5
MD5 8c973f7c39680ae4d8191ffab5b38e0d
SHA1 198ce88796fd7c3167866cdfd99b96cd563d60a9
SHA512 9ca81c069ca4553fcabe804fdac84cf79a2637ba6014a7ca6cfebb39f87ad929f08f0bfe029a4ae97e22f7afb89d52cb3be7e5b2c27589d9e25eb2ed20b0d2bd
SSDEEP 49152:QSuZQIY0Be2KRRVtOnks6NMHqJeN7xB4dcUDb4kw:K5dKTi616xAcob4
TLSH
T162C5BE13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7b677dbedf2bf70b1bc09ad3bea2e9d263f7c5875b37482bb23d9b174b9c9ec2
MD5 883879d3dafd5051fea33caf33c385fe
SHA1 ade58e34449e6a178efdcfa6f9ec9ace98cb5c2e
SHA512 ff80f9ec42bf270b3bd3f7ea9fc9af21511737598765b9233cfde2c7b768e7a377184255eae27c7de70d1795264f4ce55f1d5a6f492be3b5ba3ced2010ee926a
SSDEEP 49152:FhtSn8EApI0figngiDn0AP5wceN7xB4dcUDb4kw:0X2iyphoxAcob4
TLSH
T1BD95BE13F2D901E8D06ED178C7568632E962BC160B34B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 d19d072caba10d9f5065cafc7a8d7a2e5dfc1d3085f8bedfc3c137e0e560bd6a
MD5 f9981b4391682a43f87f5d0eb2527e7b
SHA1 6c9b33f1e3ae0d73237e50a5791574cae534ca30
SHA512 438a97e415a4e64dbca716905900e903627e8d95e94eb39f9e4afe03e67e167f1b4e0a791ff6d8088d1a38eb8356bcb05c320782b72233ba7a443b67d59e84ed
SSDEEP 12288:C4Yln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw+:Cde/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1055523CF7AFE13B3EB7693B17471168211C79CD63E6030ABA4983A4667F8DED148015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 953c5997b57dba3585238cfbe6fc9e8472f836aa97442b037b3628e2c2bb7efa
MD5 6bfc6781834ebe6de8cf5f95025dd9aa
SHA1 6d83176f4be0b5d01e386449b7bbd101b4f4a96f
SHA512 0714eaf2f167af178e237493491d5812ce0dd459aad6ad3b12e5bdc5bac4c06f0a097fecda2fff6458e729a54d5162dce43bebe57efa0d5f7607b98704593bb7
SSDEEP 12288:ftYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywW:fue/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1405523DF7AFE03A3EB7693B1743116C211879CD63E6030ABA4987A4667F4DFD148015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ed99ce84915f8d2434cdaecfed13502494c3b8de7b0876305ae365c82ab89edf
MD5 745a09b3579deaf0f4e91cc594986279
SHA1 beae6e36f1d1f1a6c020fc3df083dc2881f19469
SHA512 4666296f5bb775088002ba517e2e1d3e7d036a9bdc897004d28e014cb19938ed2b829f9ccbbe5e019fda6ef0f95f581e8ea805cc712c7d84a65f7dde8667d79c
SSDEEP 12288:dPYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywW:dwe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1865523DF7AFE13A3EB7693B1743116C211879CD63E6030ABA4983A4667F4DED148019A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 9e3683bdb86cc7296fe0ead71513fec5f5471b2ac4d610011d66ad8f81e1b162
MD5 8c3b885a24caaaad48576139bbbafe6d
SHA1 7beadea6fd8c14aaa2cc1ae88af1aa4171e7e811
SHA512 631c1225786cab81d3963197009e3d999c11a2f61e1f403ecce68aa91150ae86e0002fe0a709451cd1707b9242e0e89cf3fda4c32ae7a4357cf197595c014336
SSDEEP 12288:ZVKYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywC:ze/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T10C55239B7BFE02E3EA76D375A4710691A2D7BCD52B30729F94403A461FF0EE81860359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4a0c162fe316c608abf987184f7429c225414ae8daab87d70446e7fcc0b3cd11
MD5 3a8191df847f6203468664eb0eff38bc
SHA1 a5608bf4835a05e065114553ee25dc8ae77e58db
SHA512 0805a9ea4325d98c4e90e9b9205540236b2c88b6cbb9d0e1522dcd2dea627ca3a5bf1d83fff72c516f6328367e745d68f0f66ba9b12e59e381a02d922cdd85da
SSDEEP 12288:cyYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywu:c/e/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1B75523CF7AFE13A3EB7693B1743116D211879CD63E60309BA4983A4667F4DED148019A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 96d687b2a05dc9a01e4d22d3c511375c93a2254139a52ba97e0e18d760128ce3
MD5 cffcbc3c76beec39ef5be107f2975c43
SHA1 76b6e61f69df636adeefe31233325556025b29c6
SHA512 1f9fca405a26c3e865d08810e35f9cba1be85e6f59b71d91168030a9d8074faafe0227ca93c4140612ab9ab6b72eb1653f707ea424038d5dc1d02dc63dc731f7
SSDEEP 12288:QZYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yww:QCe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T15E5523DF7AFE03A3EB7693B1743116C211879CD63E6030ABA4987A4667F4DFD148019A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 647ec8d3de70a22e3c4388afe28383e498589fdad35f823ef48332efb18568f7
MD5 82e62d104d4e8b46ed5a008bd857b1b8
SHA1 18217ee6048eaf653edd610a310c7e148c698dea
SHA512 2bc60b9f13f5e2c14d58532066959e203a0b5658d66cd05b8cfc7526e5c3194a9f2bb055d1fb883edb7f5daf73a7914c4f8c487feeae549822498f846aa011b7
SSDEEP 12288:b1Yln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw+:bme/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1D35523CFBAFE03A3EB7693B1743116D111879CD63E6030ABA4587A4627F8DFD148016A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 6a98c8c2b99675f3e9efbd9edd763084ef71fba133222de3eb9a9df041278578
MD5 253c2daa25209d831b17cba47898f513
SHA1 39d621ae2a69100bc0b491c62e800895901d035d
SHA512 a5dbc27a468ec48319d477759186afbdabe823d740226757468b5fad4bfa217c773cb541f86aa04daa083e8912104c51129eb4588e13076c4bcb9f657e97a2c4
SSDEEP 24576:yZMSzFVSOOe/fvF7asVSyRmdcG/DH+M54c2yw:yZMSzfSeN7xB4dcUDb4kw
TLSH
T16F750199B3A018F5ED77823EC8218906D2B27C5A0B70D61F13E436575F737A11C2DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 cf16b346b5c8a375f07748a4057b63359143d5af3e2b2e442a1bafc4dab14355
MD5 b5b7adaaa07df66e02d629df72ed704b
SHA1 f759f27ee9f1ad061609fbb029b5fe7392593cdc
SHA512 ee02f75dd817adc5b1a592b386f33bb45650a30af2eb033e4cb7a1d890ec0aa4b98bd82e45c5a9f304f366fa9dd35fa48eb7b47d25d041494416eefc4019b4ff
SSDEEP 12288:nMYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywB:nZe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1E15523CF7AFE13A3EB7693B1743117D211879CD63E60309BA4983A4667F8DED148019A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 72427a9d82e327763e8a6c5241e26eb517cf43c8db8b3589db441f3e2ca10752
MD5 e6bbc2f5cf5d12448448e336827b2fdc
SHA1 d2c6a1a4481db05a5cd9a5a2f2770bf0585d2b26
SHA512 28bc7241f29e265106b9864a05ade00d5df0af8afd46811ec77e2f9e7db0691f37fb0fe9c4904376e5cf8b444bbcf2bbd6bf8d9433f235f03a628f7acfcbd03e
SSDEEP 12288:zwYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywO:zFe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T18C5523DF7AFE03A3EB7693B1743116C211879DD63E60309BA4983A4667F8DFD148016A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 98ba2c5cb2694a42a5b0b8ea6115d8f81fc2ef912538c4658e048c1710dc5b26
MD5 62cf50b70695325d86d07a323eb244bb
SHA1 889422933762b9160a7e146e7aae7cabd2ec0cdf
SHA512 1e25d4675567625098315c4e29b4b54267a548d98e56a35fe5d12245d572204806c99c867357b3129e4401e87361278c3af55312c2a2d88ce965f3bdd0bb9a2c
SSDEEP 12288:QyPz5L8xYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywE:hzyqe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T12D65124B77F531F5D177833498610A42F3B2BC721B209AAF12A427762F76AE05D3A760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5de8e57915b9a156f355090344f18846d6cbda95ad64bd84ae77f25ae92a3d7b
MD5 3ee13dd67a010b5cf9d8779f53f144f5
SHA1 2a1bd7441c6f4ce4edd76faa8e24f51063dccf7d
SHA512 562f44407d3db349895905dd05c9b4004487bdf3509495a0bd1c641051a3308653548308889e22f79c036247e7f44105c492b7b1f49b54eeff4571c65a248dab
SSDEEP 12288:IMYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw8:IZe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T10F5523CF7AFE13A3EB7693B1743117D211879CD63E60309BA4983A4667F8DED148019A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 3e25af0c9296d4274db9ef3406675e95aa93bba84ce450b601ccc9983af94689
MD5 dcb98548dc49e87029910c031187ed56
SHA1 7513de3c7b2f47265adc11ca2b92f1c6ffd87088
SHA512 8bf5c4030b90b83d6cb9b9c45156f664794f0d1091c698c6406b545a45d90eff9be2cb91a096db0be10fefe458ef8fd7114a39d62c4d86190108673b7f6e7ec1
SSDEEP 12288:kMYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw8:kZe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T16C5523DF7AFE13A3EB7693B1743117C211879CD63E60309BA4983A4667F8DED148019A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 c3dc3b57991c16f656f2cf38530d9a501758128c656a2d5e56885d0912bae35e
MD5 a33fa4a50856a8480cf07aa8e9ca3c4b
SHA1 e9c4c4e3ebeef95a5202d3531d922dc67cf6589c
SHA512 7e43f49c4cab224c56650b1f0d67d3dcc73273fdf2df329bf92072d6b102d4a352067065cae971748d0a4e2b0e9f428436a1bd4a4f234365b1de43f004a8fa34
SSDEEP 12288:TyPz5L8xYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywh:ezyqe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T17665124B77F531F5D177833498610A42F3B2BC721B209AAF12A427762F76AE05D3A760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 07e21895122b1b5de2f5bc26724e3f81d9848e95e0284181eece2a57b23dc0ce
MD5 9586ac38b5f592434db2b24aa1c869e4
SHA1 0450b77175edbd0758462c663cc14764ec5c365f
SHA512 98aefabb2d578a06bfcc30020eaa803ac6a1899a9eb5d2e80ff1b251ffa8f9ab55cb6ac930685b2441fb994578229a9a2096fb64a249a6de9f95b5dfc47ee371
SSDEEP 24576:yTHaLl3z0zDge/fvF7asVSyRmdcG/DH+M54c2yw:yT6Llj7eN7xB4dcUDb4kw
TLSH
T1A3750199B3A018F5ED77823EC8214906D2F37C5A0B70D61F13A8365B5F737A11C29B9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 6402d7966754d8a43701a2142274168bd5f7611f06907048582c555cb381f666
MD5 e5028a14b7e90ba0d5b8743b977a3ac5
SHA1 b0c72ae33dae0913e30731d19ad0885fbf7fa4f2
SHA512 7b9067678a296176e887e33394ce72d12026748b75f4804bf1a64786a670f096750108d2ea819b2b3efca59c3a0935fc7eae1731c6c78c8d8e51f6d99b963f94
SSDEEP 24576:J37d9CHKy7GZEe/fvF7asVSyRmdcG/DH+M54c2yw:Z7d9CHKyaSeN7xB4dcUDb4kw
TLSH
T13285CF91F3E811E5F1B7DA3598724511DAB67C9A1B30DA8F03A4265A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 54e347b93fe570922deac3a965d1a2eddc6e371f632f57e380e847557ab71d68
MD5 d63456af4e5365e99101ecea28d8649b
SHA1 fd2c6a27f2834e75f6cdb892f026ad6bd6c00055
SHA512 e2d7ce3f450d8bd018e2fcae905cf9b8c3aa1f07dc6becd57b3ca6e8db21203f99f33776265b075a73ec3ed790fe2a0d77dc868f6eaed8a2a847f1c9e000b557
SSDEEP 12288:vvYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywT:vQe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1AD5523DF7AFE13A3EB7693B1743116C211879CD63E6030ABA4983A4667F4DFD148019A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 659ae7ea407e4548c5a086003ad907dfe34bf9801b7ac3454d156310b1294f14
MD5 b9bc781382d2059d13ff600328fd1751
SHA1 e135c18e0cba16411f63e99b0a60236e8bd49ed9
SHA512 30ef38f57f0d603a1afcde88fedfb9d23fedd0b0b795385637b7b398f57a42e8f9fbcc8ed8ba7158de113c50e327a83445ab5604a69cd2541de148c2362ad91e
SSDEEP 12288:RRYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywb:RKe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1DA5523DF7AFE03B3EB7693B17471078211879CD63E6031ABA4983A4667F8DED148015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 283195171da81f2a47db5c878a741ccede2ad4c39f7ceb10ad2d241b18af330b
MD5 229155a28c151eaa38bbdc1ea7e22a59
SHA1 8b083422b97b6f4049678e20ba514c492018bf72
SHA512 192c07a837eb40ca1875c9e7a0673fc72330391e9e448bb9dd2ae1ea2da97f483cb5de266947d5b95501d0e2351c494458e1210408e3d2225dd0317f0146cb97
SSDEEP 12288:TuYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywv:TTe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1205523DF7AFE03A3EB7693B1743116D211879CD63E5030ABA4983A4667F8DED148019A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 91e947273d6ce5b4cd8647ea7ece92a852d4f139d1cedde4ae6ae5ec68cdfdbc
MD5 ddf7b43f6d8d3460b0b994107fc1d653
SHA1 f8f4015add247957c6491a07e715cd7726329e1f
SHA512 2a05137feeea11bbfd4991544ca7e3125839cbf4529fa7cb75c915554e2f3c32736affde856fec14fa0ef9f198304f2adbf07628f8d26de804a38e7cb074e5b3
SSDEEP 12288:eMYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywv:eZe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1655523DF7AFE13A3EB7693B1743116C211879CD63E60309BA4983A4667F8DFD148019A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 32acd815a5a3145c6aae6a7527cf006e2797597282cb0a999f60d65ba143389e
MD5 270944bf3219a4cadb86faf70998162d
SHA1 e60bffa4b8bcfdea1537382e9c81d4dc5a476cc2
SHA512 d01ca9a1b56fa11e5e9ba3fb6b6a80e1f0617b99a7db5c99676a5a1ee597c80e63a28d713bb4caaddb00e5fccac633f16cc39e0ddf2272926476b43fa5142d1d
SSDEEP 12288:XvYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywD:XQe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1CD5523DF7AFE13A3EB7693B1743116C211879CD63E6030ABA4983A4667F4DFD148019A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 85ba1d30ccfa9809c75e99066eb63af62e0e9e7832be782b4bfa2ff72fe00a1b
MD5 1c3796ed3597ddac065b0abbeb98cda5
SHA1 1c46e2a1b1ad673fde711646e40860a7d224e3ad
SHA512 da5bef156be00adc46ecd4ee3d9216f453609ec97e90e8d1f4f1975c09e22d90764dae539c197d1642e21b8e7bf3d526ea3698d0b04a56c3638e3f6263028208
SSDEEP 12288:JUYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywP:JRe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1685523DF7EFE03A3EB7693B17471069211CB9CD63E60309BA4983A4667F8DED148015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 3b98b2600cc218273f25b1aec879f935730fadc061e79ff7a0d2961bef1811e2
MD5 d401489c4724903047843dcc39c99159
SHA1 638fb1da0b9a790c3fa64117c42508da597158c0
SHA512 f2367e009a2442d67aba32d09624dce9a962ed85e4788d7f05f848b909d96373179957b2edb277e8a120788e3c334bc5237e5d36fb737ada24d3399ab6b3d091
SSDEEP 12288:pyYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywo:p/e/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1255523CF7AFE03A3EB7693B1743116D211879CD63E5030ABA4983A4667F8DFD148019A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 2c3e7093ac7fc686b835336bf6c2ad9c7d42e6c04a02016a15cbcdf54a5625c4
MD5 d7dc797d0ed2c961fea63bd0ec4347c7
SHA1 ac3a8ea0057ad14c7cda9403f4217490c435388c
SHA512 1c5fab2c501bc14c026d5688a01309fdbfe95b044596e8db9cc543b67ff3b065f183a5c8fa5deac1b13fc811162d40d7d3d079f54b2ac954f9a96c37ab2e0eba
SSDEEP 24576:Bfwvok9RX6wkyAIVe/fvF7asVSyRmdcG/DH+M54c2yw:nMnYIVeN7xB4dcUDb4kw
TLSH
T1B685CF29EBDC04E5E1B7923C99B3460AF2B178591B31D2CF129A53AE0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 adb688d927958cd943e2cba0bc542dcb58c1a707fd78e45f57e78ba74bc45706
MD5 18827b88f7b7bc083662b43965dedbfc
SHA1 040ae2f685c7d1e2bf342572bb833d772efa440f
SHA512 5e7d2ace3598f56d6fa2fee234eaa22c3d4dfb36b5edb1fca76675248f7d4208da6d1e29c672d210f2f3a322d91603a4c5f8d4147a136f5e15dd5633e6c10285
SSDEEP 49152:sYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK08eN7xB4dcUDbU:SySzPrxAcob4
TLSH
T14C067C97A1A801D5C1B9C1B98B1BCC17FBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e5e21d639b31af7fd7cf22cef08105f28401da8060e8623289fc09d6a9eb9b4b
MD5 9c6a929adc50dc1e86623e3d5e3e019d
SHA1 a1d5fb10c8da3dd734ca4f8fb46d46f82f8dbbab
SHA512 7ef412c6d6b00e4b01bb37f0f73f5120c7f1a304102f681af973780b3eede789fb2ff33ad2f7c47f0f0ed06483876669d86ee80d54e0217a88add6ed976412e9
SSDEEP 24576:M47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYee/fvF7asVSyRmdcG/DH+M54c2yw:M47JUQj1irIhCnDHUPfF/MeN7xB4dcUs
TLSH
T13765AE1EA3EC01E5E1BA827885154A5AEA71782E1F31DACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 75e8ddd977906c2cf928ae8fbe09f700d7086b9c5eb4b86fcda356ea1e7cefc7
MD5 8030d9b749e343d71e72845a7c05e2aa
SHA1 699262376c598e750f8dc60951363fe50ad64fbe
SHA512 baa80de028f3d37b6285ffd38cee1902516d3e281f6b7b36103a6cc5ed667187585224d0b77233c8c8527aadd06c7251d49de5b1ca23e4393ab4a82b5bf27597
SSDEEP 12288:UNsfcYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywV:lJe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T19065014AE2A802E9C17EA275D7624A41B3637C6557E0E3CB62C0F93E1FB4AD45DE5303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 8ed9dc6bb56796e03e8eeb68080375a0309a692a3d483f8848ab1d7c49e6e329
MD5 d1edfc959fbd3e6eb14954a83ae71af4
SHA1 657d514a02cbc323dfe1e5c784795c5d5032bbae
SHA512 46397f77c7c9bfcd0372ea12f8060ea0346f683a46326e41150cef0a87302df87eab9fef2bb74b4e560fb0ee74869a82a2fc7a150b90c152b16e16e4f36737ec
SSDEEP 24576:k7I3PUPG53vVJExyVx/vWft3btCfvH8taOrb8U:TPUuFHjvWVJSvcsS8U
TLSH
T1764518407626DB4BC66940321E76C6CCAB707D45FE05AF0773C9873FD476A58BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 59ec517cb301608b2e07a71f00be428052516f3dc8235f6df45bc41827600208
MD5 5b743ca875f2b0f4468d89ce855748e0
SHA1 96ee508238e0e9602ee170840d05dc5cfa82e664
SHA512 2982ac0fb38e189fa2c2790f5cebac1487eba9e2e45e25f4e70e45d9484b695ee2a6e4b8eeb9f6039acacb319bd1544c74e7e2e0c411d9bb66f596ccfea71a70
SSDEEP 12288:ep3D1/Isa4540/+PicGB8u181FWU9lq2oxViqUtkQyB9g73wthG:ep3cMyPiczsKYK4piqmB89g7gthG
TLSH
T1018508415577DB4FC97E40374332868DABB8AC0ABB453F056385893A9877A5EB1F23C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 71a09a46c506017de5de30441c2e213737eea5742d54630b77eb748da4e270d9
MD5 a82d944542b33bf7b80984da71681fa1
SHA1 362bde95b1ecba928c4ab5dcb8cd7cc70207a92f
SHA512 f09bd82ad14e6c0d02a24547308b8bc603d7ac03b83203f81d134537714645e6f6093efab098b581b01da516efe084e3c942bbc41fe7e0720a7637068d8551fc
SSDEEP 3:OlH/lTCKT0N2/anUC3ht5l3yjJ/llS3mCllltGlslslslslslsl6Cl//l:Kj0N2/aH3ht7OjlEmCtEEEEEEEj
TLSH
T1AD8192356B801664C931BC70280897188B26D11072A09BAB22C727B61C052590C51A24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8abb80be59150be88310dd8044ed53915b00dbc932e0e4aa163a27114e46a78d
MD5 f4dc973d180c599fc7724f233832b647
SHA1 9670828d758d578efe7a1dc36b9bf5659af3e4c1
SHA512 605a5ebe573a9906eaea897323fcc7ff25d303958557441a3be4dcc2db5cdc7aec54f7a371290e9b2452d41b8c7449c1e89d0a44322253a9af1fd3dca8c9915e
SSDEEP 12288:PF7kYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywy:FBe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1E655239BABFD12A3FA7653B034354661218BBCA52F50B0DBF444368666F4DE91CB021F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e539ce1614ccc4fb1f0da2e31c69020fc62ffc6e5d0282793265b683918b411a
MD5 82a27d9ef3a947e31488f1bc3190ffa7
SHA1 d45bd02acfd00b80ece42fa86be869e837928b7a
SHA512 65282b59954dbbdb567d0a65952db89cf84d7e6b5e5c69ca955a0c91eca75b550f7b41d52eb383531b46aae5e54ef867c653a639b9e6e0170a648667a62c94ce
SSDEEP 24576:Zgb6bmBIi49WNNFpg1rSvFv7bY7e/fvF7asVSyRmdcG/DH+M54c2yw:Zgb4mBIBhGFeeN7xB4dcUDb4kw
TLSH
T10265AE1E22EC02F5E0FAE2B89DA64417D6B378160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 08702d5c4164eb8b379b286ad43bc09b2a80b737dba1af76743870e36450dc05
MD5 cf9519024e075d80d3cab57b60389c5f
SHA1 7aa79497c5e62502c5a4c6a7f73ce2be7fe73a9e
SHA512 c53066224a40a9a9114d91982d7b1363f28abeabdf5f48858af5dff452d845574392bb2b80308cffa5688c31e47bd222b3432f263b1a2f8b608d117204df59b8
SSDEEP 24576:kG88u8FpJqH1bzria7/mOe/fvF7asVSyRmdcG/DH+M54c2yw:X7ZFPqVea7/zeN7xB4dcUDb4kw
TLSH
T10385F16677E502F1D477D13889924663F2B2B8251360FBDF06A88B511F33AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 be61bbf6dd9b3e65741eca9ef52f00eb6f91c1d9f28e902409fa43533dba07bb
MD5 866b8733367a3143e24013c00ad046d2
SHA1 782c13904edc2628aaf4e15ac5c8cd646e9b8cfe
SHA512 4336746921238a4d9185bd5b62e1190739d351ddc11aeb689548420630d629f0897dfdfe1df0fe6425d372d336f0a7fe7dcc358d89c42eebf50210623665c50d
SSDEEP 49152:HBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjCeN7xB4dcUDb4kw:4G05lO43bexAcob4
TLSH
T1B9D5CF6E62EC11F9D1BBD17CD9864A0BEBB23815033456CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 024c92bae0f0edcfbf3df052162b4138ddb419afb9950c825ec28b1dce6d6c69
MD5 5ebd49316a26b53ce155ee8b7266f92e
SHA1 055d407befa68a9cd292b0f6a938d3df847b2779
SHA512 af8190d46283cd6e8ddc7e4fb78866baee02ecb2369473e6a2e7bb03f1affef8fda230be7466dfe78b82d3639aa0862226b26048a897c3220d67f99905c0d786
SSDEEP 24576:Gfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn8e/fvF7asVSyRmdcG/DH+M54c2yw:ea5POZ3+Jt2pasx2+mKeN7xB4dcUDb4x
TLSH
T1B265AF5EA6FC01D5D5B9D17DC583461AE5B2382213319ACF112182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 683f90b49a753ff054c81b23036b8c2b9f423b4ef75ff491492696353755cd07
MD5 375c0eceeb25b6c1d39f3d0c18bee09c
SHA1 68d4e971187c7ae65f871943619e25dfc93acd7b
SHA512 defee28c4ce62ace6f3a699fe03c1332dba64ae2142326f6c59b87c016beac310f2b1b9abb28e7a941828903036f82948a577f46bb22df5e21e42db73395f488
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7FkWe/fvF7asVSyRmdcG/DH+M54c2yw:ENc/zEOVHFTeN7xB4dcUDb4kw
TLSH
T123858B1623E901E4F5BBE1BE89779546FAB1786513309ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5f86d1d46878d31313596fbda1748c82b2f97e2476e7f70a6c6b288cd8a3d4a6
MD5 ac4fb71ce91b9e79fcda530fe66a7ede
SHA1 0d779bdd5e2eb7c3175b295d00838e81b50f6157
SHA512 020be5a60483eb6ed59c984a93f9170acbcdf6edc0caabf30a809ab99a7f0b22ec55c25409f73fcaf8b939885f5edca82961ff5fb095c3052c2d215978a59269
SSDEEP 24576:H8kNvNnaFeYhJNtmZBmEe/fvF7asVSyRmdcG/DH+M54c2yw:H8MwBtOmEeN7xB4dcUDb4kw
TLSH
T1AE55AF6EBAF806E4D1FEC6B49D238512E6727861073293CB9290C13F0E679D89D75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 95b6c54d0751a534be607b665e88c03f7e776837870a7af876cbebaaa87d95c2
MD5 ad06a472c475f3c2f060cda7d1097e82
SHA1 1ef411322669b632c7f565ca66a56bf37dc39730
SHA512 325cf355abda93a48ee973097594ab6ed9a05749b5d96074b04f15815462e418fdb67c15518c3d238ae9bf45245ddb2e9cb17be64bc4e8a2161e7b375170f45c
SSDEEP 24576:IPUr+NQSe/fvF7asVSyRmdcG/DH+M54c2yw:IJQSeN7xB4dcUDb4kw
TLSH
T10665E16F26ED18E5E676E17D89924709E372BC621711A2CF02E0917E0F77EE86C39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 6e25468232ddd3253e8947a6c16facf9126f07b29d8dc5cf5b69029fddea6ee3
MD5 988b0e0caf87383530b22d3376f401e0
SHA1 553297558344ee4492b7a34505a58c944a60f9f7
SHA512 0ac7a9f06c800bac442576f23544504e9f89635bec8527e0a6da93b714a59d8912add7bbdb27c7ebd7fc0a3c6e630877b12c37b2e1578fa045271d168f7d2203
SSDEEP 24576:MD3FHshBIYQgA9e/fvF7asVSyRmdcG/DH+M54c2yw:MDVHeBIAA9eN7xB4dcUDb4kw
TLSH
T15575E17EEBAC00E5E57BD2BC95634A06E3723CA9032165DB01D491B61F7BEE42D39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1432-312-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1432-77-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1432-69-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1432-71-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/1740-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1740-20-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1740-13-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1740-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1740-81-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1868-83-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/1868-88-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/1868-313-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1868-82-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2060-332-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2060-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2060-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2060-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2060-93-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2060-99-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4100-0-0x0000000000400000-0x00000000005F8000-memory.dmp

Download

memory/4100-6-0x0000000000A70000-0x0000000000AD6000-memory.dmp

Download

memory/4100-7-0x0000000000A70000-0x0000000000AD6000-memory.dmp

Download

memory/4100-41-0x0000000000400000-0x00000000005F8000-memory.dmp

Download

memory/4100-1-0x0000000000A70000-0x0000000000AD6000-memory.dmp

Download

memory/4140-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4140-111-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4140-317-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4140-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4140-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4352-55-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4352-54-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4352-62-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4352-297-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5068-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5068-116-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5068-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5068-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5068-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5276-137-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5276-139-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5276-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5276-131-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5276-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5460-126-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5460-316-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5460-117-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5956-49-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5956-50-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5956-64-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5956-42-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5956-43-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5956-67-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5984-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5984-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5984-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5984-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download