19f73e3594ec4bdda444844db869d74e5f1989f8026e6d52d060a5e6d8e94f50

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_7d1e108960e6530cb2f145455923391d_elex_redline-stealer_rhadamanthys_stop.exe
Size 1.3MB
Sample261024-jalgzsav2p
SHA256 19f73e3594ec4bdda444844db869d74e5f1989f8026e6d52d060a5e6d8e94f50
MD5 7d1e108960e6530cb2f145455923391d
SHA1 edc66a1f9f21fc0e4935e10a142ffd5bbcbfc200
SHA512 595dd708f910f0ac047f943af9df0c140d1026454ac297cd693098bfb4e608da21df88082005f57e7d45860205d1300f6f215c184ef547c2bd8e625ea764b570
SSDEEP 12288:85YYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywL:w9e/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1DC5523967AE1C173C97652753438C7F1139BACB12A70B483F9853FAB6FB0AE1561120E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5072	elevation_service.exe
2268	elevation_service.exe
2608	maintenanceservice.exe
2468	OSE.EXE
4444	PerceptionSimulationService.exe
2616	perfhost.exe
3940	ReFsDedupSvc.exe
1808	SensorDataService.exe
4808	ssh-agent.exe
5508	AgentService.exe
2512	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-22_7d1e108960e6530cb2f145455923391d_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8ad0d3667fac3b7.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-22_7d1e108960e6530cb2f145455923391d_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_7d1e108960e6530cb2f145455923391d_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-22_7d1e108960e6530cb2f145455923391d_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-22_7d1e108960e6530cb2f145455923391d_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_7d1e108960e6530cb2f145455923391d_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_7d1e108960e6530cb2f145455923391d_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-10-22_7d1e108960e6530cb2f145455923391d_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_7d1e108960e6530cb2f145455923391d_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3236	1344	WerFault.exe	88

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_7d1e108960e6530cb2f145455923391d_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004fea863c8963dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000afbbcc7d8963dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000febdfc3d8963dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001cfb5f3f8963dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d68727e8963dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000095eb587e8963dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000627f343e8963dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5072	elevation_service.exe
5072	elevation_service.exe
5072	elevation_service.exe
5072	elevation_service.exe
5072	elevation_service.exe
5072	elevation_service.exe
5072	elevation_service.exe
2268	elevation_service.exe
2268	elevation_service.exe
2268	elevation_service.exe
2268	elevation_service.exe
2268	elevation_service.exe
2268	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1344	2026-10-22_7d1e108960e6530cb2f145455923391d_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	5072	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5508	AgentService.exe
Token: SeBackupPrivilege	3940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3940	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3940	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3940	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3940	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3940	ReFsDedupSvc.exe
Token: 33	2512	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2512	SearchIndexer.exe
Token: SeDebugPrivilege	5072	elevation_service.exe
Token: SeDebugPrivilege	2268	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 4784	2512	SearchIndexer.exe	103
PID 2512 wrote to memory of 1724	2512	SearchIndexer.exe	104
PID 2512 wrote to memory of 1248	2512	SearchIndexer.exe	105
PID 2512 wrote to memory of 472	2512	SearchIndexer.exe	106
PID 2512 wrote to memory of 5660	2512	SearchIndexer.exe	108
PID 2512 wrote to memory of 2720	2512	SearchIndexer.exe	109
PID 2512 wrote to memory of 3240	2512	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-10-22_7d1e108960e6530cb2f145455923391d_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7d1e108960e6530cb2f145455923391d_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 476
  2⤵
  - Program crash
  PID:3236

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1344 -ip 1344
1⤵
PID:5984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2268

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2608

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2468

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4444

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2616

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3940

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1808

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4808

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5508

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4784
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1724
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2808 2948 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1248
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2600 2596 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:472
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5660
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2808 2948 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2720
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2600 2596 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bfc22bee8e8f7bfc36b38c2b7388efd9ab15160af82896ac5832e389a4c4fa1a
MD5 a5e856090df6c03709f1d727d4ebf046
SHA1 31f6f1c77882e6fcc86ad0c24506424d3e9e9a9f
SHA512 c3196056e045ab76648fbe2776440cf65efce111e9b01c74b7e220bae8626be9e5e41dedaa007eb24ee1989fcde2965c1c8e8bf2f0ccb233498c3410cd72178d
SSDEEP 49152:hb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn7eN7xB4dcUDb4kw:n3q6HjBdxAcob4
TLSH
T1CCD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 4af5b232c10c26861690aafe5d5737909c28289394b4d32ae5cbbcebfb978217
MD5 5afb65fce7be432a94bfd611719fba96
SHA1 78ea151203bc3faca90b0d96dc1cb0f710782bbb
SHA512 df7943bd0cd00d9538dc1c7ba60279db9fb5c88ace638a88d7075dac9155038d290312761046f63c631e36d041506646689344853b9fe386055b3c6839e75a54
SSDEEP 24576:fXYfDtczAue/fvF7asVSyRmdcG/DH+M54c2yw:qtcReN7xB4dcUDb4kw
TLSH
T1E075F12977E405F9ED778278C8B28502E673BC910760F78B03A4AA661F736D81E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 1d6d40a21e1a78c1301cfc285c54c694c436769a0b50a204956e19aceadf8311
MD5 ce395b2f8f581e5dbf63f74e4e1c3cdb
SHA1 5c8f0db480144044de9ff4f3f5bac4a652f0c323
SHA512 8546918cb8bae06d72e9b77e8778f1419b204515dbaeb8cadb5e2017556050b7f2a7168dff4aac1898af70cdbedc44bb275ad942424a67200d156f253254b107
SSDEEP 24576:k0Le5ji0hmxirMde/fvF7asVSyRmdcG/DH+M54c2yw:kPji0AcyeN7xB4dcUDb4kw
TLSH
T12B85AE56F6748331D073C0B9C5D2A68AE97234861B308ACB4286D77C7F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0b5dde7cedca4dc421a5ac9b475156bad1633f955cdf3fd3fb499cdf91da219d
MD5 20fc18461f77975f55beac695dce256d
SHA1 05c8cb682a7fb14b9eb3a8629706fddaa85b12ed
SHA512 a7fb61c3bbaf25cfc15367995a926ec01b5943cd5cf2557ca7a24c6ab2d018ffdc398936d9a7287043772cbbb8a6fc65d68fd8be3251859bb8c598dbdc9a23ec
SSDEEP 24576:Ra7/ezSC6vUyD/aqgrvWE6q8wyuPe/fvF7asVSyRmdcG/DH+M54c2yw:Q/ezSC6vUzPvxHjyueN7xB4dcUDb4kw
TLSH
T19D756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f0c58831be055e9f792ccbd315f4aa615564b703023eb6de97e8bce12e3fb071
MD5 6bcd42784194139b50862d1caf7805a7
SHA1 b300994bae254577a772352a26709d358bacc709
SHA512 6fa66a0f8e13fe7394988f4fd92b9e41c14dd68fd3244e1f56ccc0bed70bbbd19675d8a3af9f6b44b1fdf5386eac3cff707ff538ef7efb4e0ba2d271df1eb2bd
SSDEEP 24576:kVbqPb88hv/l+6oe/fvF7asVSyRmdcG/DH+M54c2yw:kVO88hXl+5eN7xB4dcUDb4kw
TLSH
T14A559E66F5748331D073C0BAC4D2AA9AEA3234425B318ACB1246D76C3E77BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 0960c771be4e0d448e61e6ae66a30688be3e258e70b71ab775d522d2c69ce395
MD5 2d7c941a8d4572d4229d2337114752db
SHA1 cd2228aaf94adac80f48b1df5ad20d57fd09eba9
SHA512 cba2266d9cb0349fd008ccf43a79748c7efdea34ac76ebb05fa7bb7ae4fb390365d4794afe156ec33808d1daa52cb308ea6d1faa2d7e60a5fad845c890b4747e
SSDEEP 12288:bRUYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw6:bRRe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T19E5523DFABFD13B3EBB7937134711A9211839CD42DA0746A94903F8A66F8CED948015B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 3c913544efd6fa82b6f105fd3be4054db1dd6e7552100865e3213bb07fe55ccc
MD5 5551e5a9387437bf72bbde708db03ed5
SHA1 d4387a1327207db0849085c88bef6f511779a0c5
SHA512 b43b510b99c691829b9f883c6b23a9e3feeedc4069feab2a2139068a2fc1ac5ecc17affc33b1e42fc92b67b806e1f83ca5dea438b81b5ffb2b7e150495e9b2bc
SSDEEP 24576:nJIUwe/fvF7asVSyRmdcG/DH+M54c2yw:nJIUweN7xB4dcUDb4kw
TLSH
T1B675CF7BEE38FCE2C27A8DB85A91874093A278704F61A3CBD164830EDE335E55D75825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b6d1b430bb04c0c0b05245c9a49b6f143ae35893d08cf7e53f2d7045fdda86b2
MD5 6309f587646485e87d4f2f6fffc47d51
SHA1 1db19d1f83a6ca87554f145c698b78b4e565391e
SHA512 dd38ea85e8311d6ed8566d1c06f1e81bf3de35241688068fd89035283513e7e01a03a85a7f1688a8f6e6b1bf29387e2d2ea2dca0d3c0ad031c7c5656cb40cd42
SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH1:CQvGAdlCEL8c/yRNw5C0xAcob4
TLSH
T148266C656BF880F5E0B7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 262ade2ffb6c46ec2a18d765865feff7ae5f48930340bd95ca605fccc5664d42
MD5 8458d8ea23e92894247090b0b057fd96
SHA1 a66f5beb7145eb923201a3d2b760cd064a0422d1
SHA512 339a1b5ea36fd677265ebc7efffc2d618f83f24c535247eb485e6d25b64756c6e5d6b655d36695dbb84f23e1aebf347243a4e6b04aa58e360f6978dba0b4d5f9
SSDEEP 24576:gdewsAjie/fvF7asVSyRmdcG/DH+M54c2ywn:QljieN7xB4dcUDb4kw
TLSH
T13E75E031FE74E032C7BB0DB22B36C716146DAD600F6129C3E3A85E8E59746D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a7c08793bf9a3e5b9c6f33610ae2a41c216eb4e6c072387c9da19e31446481f2
MD5 bad85bfd6f90798a0cc9c11f4baf274c
SHA1 f9bfcbcbc530df6a2c060d973dd2e056e21bf0d9
SHA512 5078748796dab55aef01b2dc2035250901fda2ea09f85ecdbf4b80be567cb1295ca5c35e30583cf54280569587469fa41d9502ce02383b3518275d86482e9077
SSDEEP 196608:8UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHP:8UEtQevvqc2W1cpV2EI32P
TLSH
T13D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9870d73804c5793aa807f8a47ce694ad7e3f199770da4491454a1e0e2927dc14
MD5 6cd78d85fbe2532bc6f71a50afec2f25
SHA1 85bd028461d2c32d8a98f7076a18f32fecf594bc
SHA512 cf7d28ab2dcb9edab3d24e7657929a7a82957ada23d583cba7232f7ef9e3637294211359ade74ae2496218a1ad1936723a0a605d1d2c166668af38b757306e91
SSDEEP 49152:mCbRquA/m2yL5zLfFiV+XenmE3/zCeN7xB4dcUDb4kw:Loq2VjnmQxAcob4
TLSH
T13BD58D0976B8C2E4D1F6C77896A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9a6e89d8384b0992be7876d23ba067170a2c7b14f924f484c184bdc9f5973fa9
MD5 82d3398664098ad833e7c393c7b1eb22
SHA1 3e75ffcfe15826b6bd8b8106f53b9aa0bfdc88dd
SHA512 22280b2576c8bab580aa1f4a18e1fcad07cc4ff97eb5ab1bb8e786c1acf93f23c02164bc5886fc3286c93eded96192e7ea1a7abd61f75106866a20abfd34074b
SSDEEP 24576:hAhGLJIFoiwtA5l7S537e/fvF7asVSyRmdcG/DH+M54c2yw:hAMyFoiq5LeN7xB4dcUDb4kw
TLSH
T151359D81E7F951D4F5B3AA78A9B68171EA76BCA65E30D20F2150D10F1E33E909D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 42a130250afb3fa38e38087074d2575d74cda71e2ecc5045b8ae2dbcaa478faf
MD5 a1e5e1ea2c825efc7d86c7aa8fe42b18
SHA1 cf8a2de0425061f28626ae80673a8ee71b8c9699
SHA512 04e984f1f2b26733b17567ff6982cc966bd45729181e16bb113063d3e5ef81d191a4f1be5935af2c4096e512acdc3fbafa88b778f5ed5cf9976a769226ae882d
SSDEEP 24576:EwuoOWEe/fvF7asVSyRmdcG/DH+M54c2yw:EwDO5eN7xB4dcUDb4kw
TLSH
T10E65F14A77E908F9EAB7823985578532F3F3BC012A20E71F1760C65B6F772616D29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e99c0f3a0c0090a67d3b979fad93eb35a7e8bfedc0f25d82f0590b94143ff5dc
MD5 379857af7bd8e37b7e7e0adbf61e5244
SHA1 0e37e49e299e720550a8b27d0593b61de595384e
SHA512 01cdffaf11a9cebfe857f20cf8d4a16ee072ddec2f5421283265c2256795705236610bb6248a3a5699832b5c63dc9c6a9be048fe2c40f14a90e2309f1ebb09cd
SSDEEP 12288:HBZ1IyJYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw2:hZule/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T16855129F37E821F6E6B39379A8F1464193A37C92277063CF1064668A2FB1ED51D35322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 efda11eb04fa7fc2921045c16f3ecb71a3249d51813e06786c0a4c1412f2186e
MD5 01cdb4af249c6936818f1d218918f1c2
SHA1 8b230f9f966b4d75860a09939b60916895da6b7a
SHA512 7b9ca1a190127c0d3d3e51af29b320e1950ca25287ff82267ac800d6ca9c91cf80c18914599401eb63cdea1aad45e2c174e77a8b5559f5c409034d2d8fe6ef98
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uh:iQRQyi36YOcPQLvw2gAf+PN3TxAcob4
TLSH
T1D0667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c3654d6b1c614b50c6fd461d5c8098797d334e89129c0c0774a36f4bc36472f9
MD5 195be3c6a1f4159420b38bfccd74086b
SHA1 8e529b9f27cc331fdab052b6615efdb4b1bdbc2a
SHA512 ef1962872065706ab614a4cffc1d39043031efd90100be0b8aab9231dbdfac05a0d89a55fb55ade98fda94a97d8444f8ad573deef5768557fcccc9de104e7f4e
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uh:9QRQyi36YOcPQLvw2gAf+PN3TxAcob4
TLSH
T1B2667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 643d0d2beb87f165cf398c7e767c382b8ec5a5d4e506a0ae0341683017eb6b91
MD5 2ddd8629a6561c3645a4307c0739f243
SHA1 26e94eb782a6428cc385c678c68f3587ba8f77e9
SHA512 116149736b988aaccef9681dcc8a20ee02f20ea1d8d7d6aa1ab90ad168d33bd738f521a916d9672351f93cce714f7a16c72f504e60c9c80c7057e92d62206fc3
SSDEEP 49152:s68Qg55nhheWu7PNU3/yeN7xB4dcUDb4kw:mthWRc/dxAcob4
TLSH
T1BAB55A33B2F600A9C45DE1769F4A873196D27C758FE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ccca921009cbac7d13ef1b399ba75fec02153b568738529b10f6ded7a7b18b2d
MD5 731439ab0e8943500c2b29e87ba9f895
SHA1 0a542cfe308ae1e0ff7c1095288a93addc0cd381
SHA512 194525ccd54c7dffa6493f6a04327f34a3fdafc02b1361b2c4b21a88822ddeb753257a49a5b460642e13cea3822df06a0338e19dc503b6b60a451e6cf11f507e
SSDEEP 49152:N3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99j:cy5112gYy5azzVvL69nLKnhZyxAcob4
TLSH
T1AC167B13F29900E8D05DD1B9874A9232EA62BC474B35B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d1e5ac4693385b0fc75316c5dfc6f8da340cf202f64e8527f83b3c77ce6693a4
MD5 f6538976b79fbb12d13b03203276db78
SHA1 c2f54d0b2fddef26d759ffa2be7a74cbed3809e4
SHA512 ed5a907a005dfb65b40ee65d74b5267bde753b38688070bf600990ae9802df7356dcbbf75ea0df2ae42137ac9a79d87cf62ac85a18e691b401bd3f19f1c43550
SSDEEP 49152:WB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl+eN7xB4dcUDb4kw:ku6JmVxd2dZxAcob4
TLSH
T1A0D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 307c2616d929911b91b095050dd10471746b49a167726124b90305009b6bde60
MD5 cd390f9c54421abdd62b8e0e16914215
SHA1 7a7dbdc1d8b88c20ff625b49b8c5cfe1801de13a
SHA512 f055b92030b473cdad1d27b1346a0460648673835a5fcb3d1fc37a308610ace81adf77ec6ca8f0057dbd922c44fc69d0b33d4972d928de1454a700d1f5d39269
SSDEEP 49152:J1hpsNoJpF1A6UU44CwH7R4xQeN7xB4dcUDb4kw:JmifPbRQxAcob4
TLSH
T1CAB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 162f45f466225e5b991bd90aab0518aaaa0db23f9fba5d9fa3030379abab3ac3
MD5 87015fd88038042352606f8824bebd17
SHA1 f07deae64658d16178bd55e5df2793dbaf2c2cb7
SHA512 fbb076cadd4ee3e6a0e132e06a0efbf2009f32768d68fd575319a0452c452f56048839e0972cc17c0c24316b127ab08fc742e8e83d69a9c9cd98441e2605c6ae
SSDEEP 49152:ISuZQIY0Be2KRRVtOnks6NMHqleN7xB4dcUDb4kw:S5dKTi61mxAcob4
TLSH
T1DFC5BE13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d9440cc185b8e0eee44f1a6c214ebfe7225c851860fb151e76502a7637a9c0e5
MD5 6203843d57fd3d8d3464679721e8ef44
SHA1 0657f508c4354cdbaef4408f79fcf8ac3e741955
SHA512 9c0aaa614882ff10368427890a777b40991ea0ac81a6d22ac8e45fe91b89f216246c337ef202fdf31c69e984e54925ae4fb982eff9b592952f7216f9c4d8ea9f
SSDEEP 49152:ZhtSn8EApI0figngiDn0AP5w0eN7xB4dcUDb4kw:oX2iyphcxAcob4
TLSH
T1AA95BE13F2D901E8D06ED178C7568632E962BC160B34B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 ac95a2bd0d645099ac64a71e27ac5bd035936c4b9c1e9c35a47be3d77d06ddae
MD5 7dba98bc76c1f273b77abce705b6ff9d
SHA1 eddcb1b2b51fb8a8fb30f40f9e7a76ecdc6dafb7
SHA512 1498ba54dc3965f9e313fad018ba7b65b5b3b654df78e1e2d51fe4d90485a4a440d26155aaedef82b2c37830a514a5d90c76c06226a5186f2bd01bd0a51b6a4b
SSDEEP 12288:psYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw9:p5e/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T10A5523DFBAFE03A3EB7693B17471168211879CD63E6030ABA4983A4667F4DED148015E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c09fa7eb7e0036fc66919836c5d083a824153bb312c113f8a486b1a711df4049
MD5 2328f0103aa295622711315a6f599124
SHA1 c67d8906e88e2ec0c686c0bb3be8da8722272004
SHA512 efcde714fec0442072b0a1dcf0d6f313e24ecc49b98705698bca8621a3c3919fe6920b378e0c628b90f8902669d4bccdd46f66ee85d8727107035518baeeb896
SSDEEP 12288:71Yln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywW:7me/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1325523DFBAFE03A3EB7693B1743116C211879CD63E6030ABA4983A4667F4DFD148015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 0f6a2f6236b88bcd4ca41f7f8c4ca462cc7a983fa5860bc79683f313f75edcf6
MD5 70823e0cec0deb7fb84e55738e6a5dd8
SHA1 1d7685e774b2259d0d487bf04d070bc0610daf96
SHA512 7e12a6b2fbc1ff0410176f715913522f468169a027157f01b2f72e81b9bd3883cf741409160c5eb80f59fcc4ce219e1e83dd5db73128a4809039f6bc68cb9524
SSDEEP 12288:iHYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywM:i4e/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1425523DFBAFE03A3EB7693B1747116C211C79CD63E5030ABA4983A4667F4DED148019A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 e898ebc4637393d2eaad304318cdadaafecea69208d40174bf9007f30366a52c
MD5 826bd3e56843538601daca5616d8d094
SHA1 51797cd5df076dab15ca0e12bffa565dd5ac6518
SHA512 12d2d04709af8a25158d558a0292a630ed41964f20add171332118fd354e6c662466f7c29a783ecb473f87f07eaf68f1968629aa005a90dfae6eccab9855b7ed
SSDEEP 12288:vVmYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw/:Be/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1B555238B7BFE02E3EA76D375A4711691A2D7BCD52B30729F94403A461FF0EE81860359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a7f2e1597b529b1f9f4c7d714dc9a338a4e12a48044088e17c86787a7617f083
MD5 1bf0795d8ac3153302c3a7004af1fc5e
SHA1 f30c97e607f5f0acf5b49f5bad38bac2ca607b2c
SHA512 e65d097172689f2f6e28dee61eb52f734289a18f2d0e6c502a98a66d8be5e81f3cf91514b5c01e3bf6bb64c2db9fcd4071f63f076d405726d9ace2021e8a6067
SSDEEP 12288:pOYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywQ:pze/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T18E5523DFBAFE03A3EB7693B1743116D211879CD63E5030ABA4983A4667F4DFD148019A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 2d7506bc3ae1d7982f26531ad6dfa96c5b2fb34bf13904372070e74cbdd33a41
MD5 14a0c3b646706ac175e63cdf04722846
SHA1 ab4e7ed1f3dd3434d2181f9a3d76e80c21b7bdf7
SHA512 0d0c3a895e746b2b554ea994d552b0e06473cdfe0c8e3fb14072fb7e35223e3cd3e160e960b7483792acfcf2c5d6a31ae944bd90f1e20ae0545d8aa5e94d9546
SSDEEP 12288:PxYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywi:Pqe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1575523DFBAFE03A3EB7693B1747116C211879CD63E6030ABA4983A4667F4DFD148015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 e9c8b235e1d64dde44d49cb85fad51cbbfe280de772c3822e87eb379b89bf0e3
MD5 a6b09fe94307347d7dca18a423177542
SHA1 a3c97539eb3b4d92e8bd2e6e41574079b8d57d1d
SHA512 f29ca460330e3ab609c65ca8a9b95b52130c04da2be129f0f0a35d5b77230b6752d8f6822bf965a9f381f30ea87aa958f2b7991759b123699a99aae26e0a7be3
SSDEEP 12288:89Yln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw6:8ee/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1FA5523DFBEFE03A3EB7693B17431169111879CD63EA030ABA4983A4667F4DFD148015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 9d459f22c9091df612dde7fdad646cca735e41ba00d902f29b407df6ea87e0ab
MD5 a9ebf4e2a8634480838fb0a87dd23ce9
SHA1 66207886754e8c4d171bf5154117a6a6d2c5d201
SHA512 f635d9cef836372ce87f71e44abb2ad76f0cc8c2a196dfc08c52ac8c9ded47b886f3d336988868b33c35531812f31761f97ece0579c6e8d34388769e08c706f8
SSDEEP 24576:wZMSzFVSOGe/fvF7asVSyRmdcG/DH+M54c2yw:wZMSzfaeN7xB4dcUDb4kw
TLSH
T19E750199B3A018F5ED77823EC8214906D2B2BC5A0B70D61F13E436575F737A11C2DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5200c63900b05e442b430e850ed81aa37ee0600249c39a0bff8ee08e31e26933
MD5 d8c1a671869895eeefa031bb2f6ef48e
SHA1 664b13e7bf8b20815624170512376b905db492b2
SHA512 71b972fc4a52edd320c7f3f355bceff08955d14951c6ef91a487214f4be79bac3cad05507864f46c826b457e0760e21318e0dea9b2c5da273f83bebf98eb7d92
SSDEEP 12288:9gYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywi:9Ve/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T15A5523DFBAFE03A3EB7693B1743117D211879CD63E6030ABA4983A4667F4DED148015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f45ebfdc06028722dd1aaa7b73b56498b9298662eef70358b44bf5dd5ca3e8c2
MD5 98d0d8e58b3aac37adcb720f47c370f5
SHA1 4e986ca387ed6b30f680f71356d6fc8591b1cd09
SHA512 d8b64c3a570453adaa00f027b2ddd4db4c72c9fb56badd030d6dcc462886a424d8c0facc331f4e46a5fe3e76f8efd601492b20dc243a5c8d98980128365b7beb
SSDEEP 12288:IkYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywA:IBe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T19B5523DFBAFE03A3EB7693B1743116C211879DD63E6030ABA4583A4667F8DFD148015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 8e7bd21c6f347fdf31bbd349811c047d8f1a8b7decab946b06b83f7bf754b3fd
MD5 3117b16c37bb653bd10b2efc4467b1c3
SHA1 971151c8ac31a635bfc69a61a454aec5e75f4dbc
SHA512 713ecf9242479f4f599f34853029e56066a93bcffa7f18740d9e7771a9c83621268c89da070d037e025a70be563c300202fa1e2874881be36d3f7c2b83628b90
SSDEEP 12288:QyPz5L8JYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywS:hzySe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T19065124B77F531F5D177833498610A42F3B2BC721B209AAF52A027762F76AE45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 7fea20ee3522addb0cfe2a9189cf2d52bdda4fcfc5a7364066fde56717f58190
MD5 b3ecca8bbbbef3e73c446891978bda1a
SHA1 c4497d9275e4064e0c954d1fdd61b31b0fb512ea
SHA512 0f8153ba078e12f90e7278f9131bdbdd04762268c85686e4e70b03ed27c4128c7b8a56803606da9a2ae5f7502e49a8dec6b6ad74f66546787133e12123aac1fe
SSDEEP 12288:2gYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywU:2Ve/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1575523DFBAFE03A3EB7693B1743116D211C79CD63E60309BA4983A4667F4DED148015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4417a275c6b47de6978af55a9ebdf427a65173233bb9aa7ca78f6ccaa2099640
MD5 cd3ac2e1da468298b0072418eb015af7
SHA1 f6789a9d63803f8b28c964f99ec46516b3e60de0
SHA512 56d51a9bdb6efc196bde0ca5d272afdb7ba668c4418ff4ed658938225e1f4543f7cb28ef5ea5cda9c533ca8d348a7799d71e575f4196a0ed1da38b2f85814112
SSDEEP 12288:UgYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywq:UVe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T19B5523DFBAFE03A3EB7693B1743116D211879CD63E60309BA4983A4667F4DED148019E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 30a92307699174667e552e213104a7011b3b5cb1cedf1be17d1f7e75687a1931
MD5 39f2b050e43490979470ae390e2bea58
SHA1 2316fbef7bba0afde98682bb9781e476924c1835
SHA512 2598edc6fe61248b28dde9ce82228200e06ca4bc4d5ff332c1b42ec9723d3e6787ea81536f9841a7e0e507d536b09ffd377681b0d3e53307b71d66767a89912d
SSDEEP 12288:RyPz5L8JYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw4:AzySe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1D265124B77F531F5D177833498610A42F3B2BC721B209AAF52A027762F76AE45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 913da0466ad9e2910f2e722f85abe0e1c181260bd8cf1e38301cc6c4533eac7e
MD5 ff79397928f3150c37e9087997249135
SHA1 44d54bc6cf0990a3a1f1045720d78d4e9fcff607
SHA512 3b9b94d361871803603a4bcf8be619d7cbb67a162b878ae7057976c86541e4ab44e3a3bc06acbf1fec0e3e90c9cc9a89af5ab1c0b507a25c48f17ac993b3d419
SSDEEP 24576:CTHaLl3z0zDIe/fvF7asVSyRmdcG/DH+M54c2yw:CT6LljPeN7xB4dcUDb4kw
TLSH
T1EE750199B3A018F5ED77823EC8214906D2F2BC5A0B70D61F13E4365B5F737A11C29B9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 ec55831fcda0bc62689554bc05ddded4fb7c777dac5d431283ffbeea2c53773c
MD5 5acad8c8ce3b54071d83aad097b1480f
SHA1 27af0e58cd602a814b6db0d651a61736f68277e0
SHA512 ce73a1cd8c8deccf044e2fc162aa8e5c154c94263feed93ddd6207087d352ce4a9b4c3511a70ef269884ceb30cc956fa27c8cb9d3d65b11ec6165300fcd7232b
SSDEEP 24576:x37d9CHKy7GZ8e/fvF7asVSyRmdcG/DH+M54c2yw:h7d9CHKyaaeN7xB4dcUDb4kw
TLSH
T16785CF91F3E811E5F1B7DA3598724511DAB67C9A1B30DA8F03A4265A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 82b33081f9b9424479192e023e15c507e14788e0a4972d8410f53a5361dc17d4
MD5 eac4ff409d63e9043a97aaf0eba21850
SHA1 1a99a52bf20f616db23eb5e1f925864dcc334993
SHA512 493287a30e35e905208f2528f33169c71e3092a686f0b106592dbaeecef99f9ffe7dcd75a689326aee0b2a9788717868668fadb0b8cccb14c848d0f169657959
SSDEEP 12288:hnYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywk:hYe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1575523DFBAFE03A3EB7693B1743116D211879CD63E5030ABA4983A4667F4DFD148019A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 bac462659bbdfaa1cbea1a05f3ce7fccdfeca4305697e72eca0b71e2407cd422
MD5 e2f4805bfbc83950591786293e751f86
SHA1 9f2411fd731c367d27491ce4f150eccccf2cdfef
SHA512 a79a7dc20808937c6c1e91837db39c8007472de46a3db2f1ddb011b9e308fbeceb5d10996acb0364821d56c289700518ff8e5310b820d34c25636942bce0221d
SSDEEP 12288:npYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywM:nye/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1DF5523DF7AFE03F3EB7693B17471078211879C963E6031ABA4983A4667F8DED148015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 2f59469cb9b36c147b6197df0f964901c95a57d53aa1036a437c4287c2cba808
MD5 d560fa4bc730e6a2fa6b55604776f15f
SHA1 4d6b2af6e5d52567f08d3a14a452244daf86e733
SHA512 7ced7b7d03d495f99f13d9ee756c250c86b1a7909d6aca74adc3a79d27e1c4f2d7cacf6046512ea51ee38752f9be429c1646a0acf4f6b5b8975774ccc361734c
SSDEEP 12288:RKYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw/:Rne/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T12D5523DF7AFE03A3EB7693B1743116D211879CD63E50309BA4983A4667F8DED148015E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 f5f96bd5f35e865c396649fae2d83fd077542982c41a1dce53f6efdb89213fa9
MD5 0b0397d7d52dd2e1b34cc2ad16995074
SHA1 320f60352e209c40c386845a2ab1bf5ef323ecbe
SHA512 464ef26738ea84267d15c47a9ea29d41b14f0df3ba55307e7ec5194e3d0e246c4394d85391e041469eb69cf9cd6d88d81c5e960976170ce2fd243ecee12425a3
SSDEEP 12288:hgYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw/:hVe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T14C5523DFBAFE03A3EB7693B1743116C211879CD63E60309BA4983A4667F4DED148015E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 7aa454ec0c034b6b5d446f5fa7d374e554d8fb6485d94b91afa8f387b226210b
MD5 9500f24240d006f33d2307c76a005a0f
SHA1 366dbb0a51e4ddd7dba70156d66090135ed91134
SHA512 dcb164be74e0936a90e237452bfec4f6bdcd697a6befb13531fcf597a3f5d27f3df30aab69e0ae45feb03ae427a089c24eadcf834ec6b608cf1fcf687b19bcae
SSDEEP 12288:knYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywh:kYe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1CD5523DF7AFE03A3EB7693B1743116D211879CD63E5030ABA4983A4667F4DFD148019A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 0b4b2c11d642bb36c2419f608a3d718fcd3f20d4ea008cf004705823208237cc
MD5 4052b2d24f5f2f81dec8fbc44111ddfc
SHA1 e0df8dd687a470045d60b63f109ee485c2499a29
SHA512 8113e4821d3003001f98587f26cafe3b8a0bc948e220541976a594f4ecb95a80b43c7fc3f2467a0be34884f27b112e8a1fd13ec6327217c69e365f9f01298fe5
SSDEEP 12288:roYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywx:rte/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1865523DFBEFE03A3EB7693B17471069211879CD63E5030ABA4983A4667F8DED148015E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 8ef7b9ce9f0c37306417e3e51618fda0a8418ae353bb0122350d244d4bc54e48
MD5 95b98832f4fa222fce9e8b89db1cd100
SHA1 6d585ffe62610d38cb0f8f9211a6b8808f0b0b81
SHA512 75a331d396a71ce764d97ccf8618db9cc230d9aa1d96205b6e95afd4eac0f5cca87083de5e3bfb6c880e4d393dd4e916d11be2dc44af65beab3de21d1e53b9bb
SSDEEP 12288:TOYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywd:Tze/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1BA5523DFBAFE03A3EB7693B1743116D211879CD63E5030ABA4983A4667F4DFD148019A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 9eba337d6ee26127ef2ee675de512f214cbcaa8954759b225cf825baed5c424e
MD5 e43587c304b020d9e45a5747a34c5108
SHA1 84141505bea84511fcc32903181bf69c64badfdb
SHA512 4c24e6d599f0c2c3189c62c63427e9cabd15d5187f3e8ef0aa64de33cb9719754ae498525a4ff15050ed884061d95bd34e7e412ad328a316c2d2b60426e8b997
SSDEEP 24576:Nfwvok9RX6wkyAIxe/fvF7asVSyRmdcG/DH+M54c2yw:LMnYIxeN7xB4dcUDb4kw
TLSH
T15585CF29EBDC04E5E1B7923C99B3460AF2B178591B31D2CF129A53AE0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d6f29c8d9f4b73945a4aaeebb8d62f993e4befb6f1fd58e1fd599d813d2b9c97
MD5 6acd3a6b4236a86db5739a7a7d2e2314
SHA1 88ec3707cf958ccdc44e453c5792ee8db631bc6c
SHA512 3659d871c9b7d62537b8bb19a987c326c7f33deaacedccb83be3752c4d38b720d57d32b3e8ac73f604acca8f33238b4aea32cb1bc7c07f1299d47991ace0c4ff
SSDEEP 49152:MYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0UeN7xB4dcUDbU:yySzPzxAcob4
TLSH
T152067C97A1A801D5C1B9C1B98B1BCC17FBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 98896b0c95f2edeaf4732e8a8b9b9a616c78406c18b35d364567a360def0fd2a
MD5 926de0693d33acfc63f30159f72aedce
SHA1 35afa9bfe084e0199565bed30eec8223b5085d79
SHA512 d6eb558517c4813a6fa03ed634276d8c02b6a71d6704e310f571de514af1236622d61e4fbeb66342601b20f40210f6d996b3138c0b699bc7d4d77c903795293d
SSDEEP 24576:x47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY2e/fvF7asVSyRmdcG/DH+M54c2yw:x47JUQj1irIhCnDHUPfF/EeN7xB4dcUs
TLSH
T16265AE1EA3EC02E5E1BA827885154A5AEA71782E1F31DACF1270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 72bf6a4864e3c7bd27da6a4edbf9e40e479dfebd856dc385c7fda92552792605
MD5 afa38d67b7b49046bf14f7db9b962808
SHA1 d07f46dcbb070f4a70bed87e6124ef1d85170b26
SHA512 9b06bc1cdf6816732e392b4c92b97ad9ff4a78b7b6b7820b74310c078fd3f758b23c005989c8651e49f5f41e76e46b778b5472a5c6392906a264c55ccd9a04cf
SSDEEP 12288:qNsfQYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywX:jle/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T14465014AE2A802E9C17EA275D7624A41B3637C6557E0E3CB62C0F93E1FB4AD45DE5303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 9d9048ac08300b8ce76c3be18136ca17a8e42b91886d2a7f4599e8c36ff7155c
MD5 fdf099f8b061c428367259d314715c20
SHA1 addf79a7c874b8cefb7d9801eb6cb8e5ee6f92b0
SHA512 85c2d50d75bc2df90dad5a45f407f262aaa61e914c77f0ccaff755da1acb00d5197e3a34b6ba8fea86f2cff5fa462dc7883c94d82e6c27e92611a1124214f2e2
SSDEEP 12288:cNpBU3fkC2Gtx9X/kBIACN3JVFx7mQPEVQizb5n:cNrUPP9X/kBIACNZRSQsWid
TLSH
T1993529107626CB4FC66940325E37D6CCAB707D45EE05AE0372C98B3FD576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 08f4d6fe0613a4b7e4b52f0eb6878b4256963d4c0aaea72bd811bb98ea91ca21
MD5 3dba306fa6ca097112dbaa07bd1809b3
SHA1 0291e47cf49ac17a29a135234aa0184631f24c27
SHA512 9fdbf4f212d786745ec8d8c19a47dcfc8cd6d3515e4c655cfb710d5bd94a84950c9aaef5323818c6cc30d9bd64fa3177c08d1d49985ade4c8563846454c0afdd
SSDEEP 24576:hJ8HFQqtp/kBIACN8hiIh7TyIqG0iGNt0g2/KLW5tm:hJ8Hiqv/kBIACN8hiIh7TyIqG0iGNt0Y
TLSH
T1D1650A409536A78FD1BB6032072A5F4CABA4EC07B7056F227389453ED867B16B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c3691c9374b823a730a5182e718ebbf184fc6277b75483a250377d315138f3cf
MD5 81e1a1585c955878ccf47c54c147423e
SHA1 fec404aa34a6f07ee7e8ab6fa6b78596de7c72d1
SHA512 9fe6e70bf1f4fe84096275729afa52723de53ccc816304d3fba90619e0a35d6e4c876d250cf33e6c3cc8fe61fe10a752992bd29597526f84daa4d4c67f165bbd
SSDEEP 12288:DF7YYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw2:Z9e/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T10F55239BABFD12A3FA7693B034354661218BBCA52F5070DBF444368666F4DE91CB021F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 189ac6a51a0ae77d242c77b9188767d9d62947839ee590b85017d25344254649
MD5 fe7c2b45d8093f5fca6110758e6a5884
SHA1 8987bb0f224f7501f4c886075d67f7edf4a338dc
SHA512 cbbe57ffc4b66b86dba080351303ec9352cf2fe680c17fa7255ff895f7702ae8562a56b97d217fb3200fd1d190043444d6a71e67ca430b8c98a29cb34ca6b98a
SSDEEP 24576:Ngb6bmBIi49WNNFpg1rSvFv7bYPe/fvF7asVSyRmdcG/DH+M54c2yw:Ngb4mBIBhGF2eN7xB4dcUDb4kw
TLSH
T16265AE1E22EC02F5E0FAE2B89DA64417D6B27C160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 910e8db536491d9014a8a72f1a5266879d6cf6265cbda90b3aae927a224c4436
MD5 f0b4154d6377d319b76fdd6ac6052951
SHA1 c761095b43186b3315e540a6477eeffd8e51712e
SHA512 dd7231585521c4ce3403750f995a939ab3d7cdaf725176689d6ba9e24d5b5540bda32d9647f8125b879f0e1378618058c80cb46b8e2fe9f8f139bc5d001c1374
SSDEEP 24576:oG88u8FpJqH1bzria7/mGe/fvF7asVSyRmdcG/DH+M54c2yw:L7ZFPqVea7/HeN7xB4dcUDb4kw
TLSH
T10C85F16677E502F1D477D13889924663F2B2B8251360FBDF06A88B511F33AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 038da8ddeefeccf49ec1fed3c27ae5c327523c43f2f9754a93408766d589d5ce
MD5 fe2d52cb241e89e0334cb87cbee289d0
SHA1 9123c6df96cd5421f47d7e795b7e8effb9283701
SHA512 c153d9e0473e7d4c0ec89a76e25630f5760cc7a013dd9842f16efe81edf58013eee9e493540fd6e47702892b13185d4d950a0ae52fa0902e299e8cdd62eac507
SSDEEP 24576:mPUr+NQAe/fvF7asVSyRmdcG/DH+M54c2yw:mJQAeN7xB4dcUDb4kw
TLSH
T10765E16F22ED18E5E676E17D85924709E372BC621711A2CF02E0917E4F77EE8AC39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6a1150d641941d25fad0777c075da315b26723c1f941950554292d1d34da65ed
MD5 53281f5b3b419f2ee693064af607f34d
SHA1 5c296ace3da69be9880f7e526b72542ec01f13d8
SHA512 9fb2292b929aaca705ac2f5333a7e4943e4d5667fb739ae6c53a7694c50e3e51f956457cc08c373986375c5461f34d53c5e7c363c6928ac2173e447c65505ceb
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjqeN7xB4dcUDb4kw:RG05lO43baxAcob4
TLSH
T1F6D5CF6E62EC11F9D1BBD17CD9864A0BEBB23815033456CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c9dea19292fe92d5ae34412cc0a077f01135b42b4455f2863164beefa0d6985c
MD5 645fe04416cb1e0f7220137d5d781ab4
SHA1 b2eb8cfa8d473941a8e61184e8d1c1868145159c
SHA512 07262565d529e7a215ba37f28174ee371fa80ab9f57ee38cc2340c57a425e7ccefa34f102a58c994d4014361c2cefeb22900c24108ccd85d750063a7692992d2
SSDEEP 24576:Ffa5POZ3dpFWVM50JicR2hG0lasx2+47eidnUe/fvF7asVSyRmdcG/DH+M54c2yw:Fa5POZ3+Jt2pasx2+myeN7xB4dcUDb4x
TLSH
T15965AF5EA6FC01D5D5B9D17DC583461AE5B2382213319ACF112182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 afd6aba67e3252b25a6dc5b93cb0555aadaf546b65d925119b10c98e48bf75c0
MD5 a5d200ac767645368c8f7d1f3de15067
SHA1 2e65ba89a3f4ee80fc05a4c4a63dee2399c636d1
SHA512 b296449ba9bf7f0cfbb973bf8efe348297fb09f653b4feff8152a790ae37c869b36904c104c1afa06887ff5a6939f6cde45a9190e8886008ab8beea67d2f4765
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7Fkue/fvF7asVSyRmdcG/DH+M54c2yw:ENc/zEOVHFneN7xB4dcUDb4kw
TLSH
T1AF858B1623E901E4F5BBE1BE89779546FAB1786513309ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 05474f4b212ac786d576f78d901291629323d4e72710437ebb7975de83d3c905
MD5 e5fd6b8c8877324ebddc72c414935394
SHA1 57d11fa47ef8536bc13029cf00dff7a2ae5a35e3
SHA512 ed88a90ea2d5a4c446dea67e152006ba6224b75e5346c87ef7e00a41be72f6b23ce88c201a111d2cd0529e09416f56c92f290e4a4b3aa59de272e9ae7b24ad55
SSDEEP 24576:o8kNvNnaFeYhJNtmZBmqe/fvF7asVSyRmdcG/DH+M54c2yw:o8MwBtOmqeN7xB4dcUDb4kw
TLSH
T16D55AF6EBAF806E4D1FEC6B49D238512E6727861073293CB9290C13F0E679D89D75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 79fc9c0d28001bf09f830dbc3cd8b80f0220d9b98703e372dfd537b5f33a12f0
MD5 dfcd0e05d4247726bd055ed3fdb8a706
SHA1 69119cb3a1bb66b0c322883476847140c30f7bb7
SHA512 d3714fbef2b97ae7547fc1dac423bcb00789f987780edec4cb7e869fbd5ccf6d1e1bf63cb9df376ec525c027876c4eebcefad0e3ec5c496da35b6f792149b1ca
SSDEEP 24576:6D3FHshBIYQgAZe/fvF7asVSyRmdcG/DH+M54c2yw:6DVHeBIAAZeN7xB4dcUDb4kw
TLSH
T1F575E17EEAAC00E5E57BD2BCD5634A06E3723CA9032165DB01D491B61F7BEE42D39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1344-7-0x0000000000740000-0x00000000007A6000-memory.dmp

Download

memory/1344-1-0x0000000000740000-0x00000000007A6000-memory.dmp

Download

memory/1344-6-0x0000000000740000-0x00000000007A6000-memory.dmp

Download

memory/1344-0-0x0000000000400000-0x00000000005F8000-memory.dmp

Download

memory/1344-70-0x0000000000400000-0x00000000005F8000-memory.dmp

Download

memory/1808-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1808-105-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1808-314-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1808-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1808-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1808-111-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2268-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2268-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2268-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2268-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2468-53-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2468-60-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2468-308-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2468-54-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2512-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2512-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2512-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2512-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2608-44-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2608-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2608-43-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2608-51-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2608-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2608-37-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2616-87-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/2616-81-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2616-311-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2616-82-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/3940-98-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3940-330-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3940-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3940-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3940-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3940-92-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4444-64-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4444-310-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4444-78-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4444-72-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4808-118-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4808-317-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4808-124-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4808-116-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5072-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5072-20-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5072-21-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5072-15-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5072-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5508-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5508-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5508-136-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5508-138-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5508-130-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download