31c6e4e6b8fcbde0391a121e0a5d12d6490f217d53d31d781a1f79aae33ba272

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_2be1783cfc1202c021e564f91d3a5727_elex_redline-stealer_rhadamanthys_stop.exe
Size 1.3MB
Sample261024-wp4nbswsht
SHA256 31c6e4e6b8fcbde0391a121e0a5d12d6490f217d53d31d781a1f79aae33ba272
MD5 2be1783cfc1202c021e564f91d3a5727
SHA1 b11c74a3d75cdadc2f45613dbd4c4a92e74e9df0
SHA512 5907589267cb10fddd768d851d56eb3b77fc291d64fb46b13664bb299a2c621d55c53f6db053c4c56b665d22a9b54b9955090dbc6f98cc83be0f1e726f957c26
SSDEEP 12288:t5YYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywf:D9e/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1CC55239A7AE1C073C57652753438C7F1139BACB12A70B483F9853FAB6FB0AE1561120E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4468	elevation_service.exe
3592	elevation_service.exe
2108	maintenanceservice.exe
1484	OSE.EXE
2000	PerceptionSimulationService.exe
1768	perfhost.exe
3764	ReFsDedupSvc.exe
1692	SensorDataService.exe
3784	ssh-agent.exe
5820	AgentService.exe
3728	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_2be1783cfc1202c021e564f91d3a5727_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_2be1783cfc1202c021e564f91d3a5727_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-22_2be1783cfc1202c021e564f91d3a5727_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_2be1783cfc1202c021e564f91d3a5727_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3c9fa7803a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-22_2be1783cfc1202c021e564f91d3a5727_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_2be1783cfc1202c021e564f91d3a5727_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4080	4136	WerFault.exe	87

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_2be1783cfc1202c021e564f91d3a5727_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9030e7ae263dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005dbab177e263dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f5334d7ae263dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4468	elevation_service.exe
4468	elevation_service.exe
4468	elevation_service.exe
4468	elevation_service.exe
4468	elevation_service.exe
4468	elevation_service.exe
4468	elevation_service.exe
3592	elevation_service.exe
3592	elevation_service.exe
3592	elevation_service.exe
3592	elevation_service.exe
3592	elevation_service.exe
3592	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4136	2026-10-22_2be1783cfc1202c021e564f91d3a5727_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	4468	elevation_service.exe
Token: SeBackupPrivilege	3764	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3764	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3764	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3764	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3764	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3764	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3764	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3764	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3764	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3764	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5820	AgentService.exe
Token: 33	3728	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3728	SearchIndexer.exe
Token: SeDebugPrivilege	4468	elevation_service.exe
Token: SeDebugPrivilege	3592	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 876	3728	SearchIndexer.exe	103
PID 3728 wrote to memory of 3212	3728	SearchIndexer.exe	104
PID 3728 wrote to memory of 2508	3728	SearchIndexer.exe	105
PID 3728 wrote to memory of 4128	3728	SearchIndexer.exe	106
PID 3728 wrote to memory of 2620	3728	SearchIndexer.exe	108
PID 3728 wrote to memory of 4460	3728	SearchIndexer.exe	109
PID 3728 wrote to memory of 4348	3728	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-10-22_2be1783cfc1202c021e564f91d3a5727_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_2be1783cfc1202c021e564f91d3a5727_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 476
  2⤵
  - Program crash
  PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4136 -ip 4136
1⤵
PID:3748

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3592

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2108

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1484

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2000

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1768

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3764

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1692

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3784

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5820

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:876
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3212
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2508
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4128
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2620
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4460
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 16c7c2b67394a315e36550c2e4db11971bf5ab15880e4246836409de51687698
MD5 116a30bb99cbdd7c12b053d4a1ed36a7
SHA1 ff49a7ea2238141494c312c67fe2bbe587098a47
SHA512 f163dbdeebea114f8309815dde5e2da246d17ab827126d87bae8ebc4e414e7409110da27ecb6fd76480a53452d0edf7860d7d510fed371d0bc4801593dbfee44
SSDEEP 49152:Kb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnreN7xB4dcUDb4kw:83q6HjBhxAcob4
TLSH
T1A2D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 716b65f5dfb6db55ff77d6606f790739da440489264f03739b54cda24b073b74
MD5 06cb4f20fe57bba8154f8d4a41e8f8c0
SHA1 63c62457ad49f548f932fe8ea558877f342c7609
SHA512 595f0657136ee4847246d82d3326960f1df45ca6b35b7b448134d99d00319dac47e5fb0c8c8ac1b9a4693b386a7b9823d9be602ed53e4af9a714bc3905b4a91a
SSDEEP 24576:iXYfDtczA6e/fvF7asVSyRmdcG/DH+M54c2yw:ptcxeN7xB4dcUDb4kw
TLSH
T18C75F12977E405F9ED678278C8B28502E673BC910760F78B03E4AA661F736D81E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 1674585a404d1ea2c766b82c8da9e2a4b4a272c33651d89b8e6fc65315d7d922
MD5 3ae0dd3101bc4fbb26d6c1375c4e03b9
SHA1 4d40de92c930b22a3e438f4936a4e5ea8659f13d
SHA512 196e00e6cd1513e7e6a88a68ffafad9d35ca7cce0ccb56599a339ebddbf2c2c748afc1059b1f239c22b883d97fc0b196a143182c46f19fdd539d8689277ef119
SSDEEP 24576:C0Le5ji0hmxirM1e/fvF7asVSyRmdcG/DH+M54c2yw:CPji0AcCeN7xB4dcUDb4kw
TLSH
T12085AE56F6748331D073C0B9C5D2A68AE97234861B308ACB4286D77C7F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 545a2b53dbff9721567800913cf6b41c7ca9fcb2b21f9309e14ff411cd1501cb
MD5 29e672473e2fc9bb22e2f7b09cff31d8
SHA1 dc0939270bf1b929c87459dbf3481f1d00f89e31
SHA512 5917be37697eafbd5a62ae5870588ae255c0ccb95d3ee62a56015b14e2f0e2c2adc88f6c9b8cc490b1035cf5f899366bd8a93722325ac90475bf68820ba33b79
SSDEEP 24576:Ma7/ezSC6vUyD/aqgrvWE6q8wyu/e/fvF7asVSyRmdcG/DH+M54c2yw:r/ezSC6vUzPvxHjy+eN7xB4dcUDb4kw
TLSH
T104756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a00910056381b29a85716efaa1810f73ab6a4cf8ca576237f868767451a23008
MD5 cfba9d05f2d56d639ded786131707169
SHA1 8dbcf8a69c2b1fd4f40eb2ba57572da1ea7fe225
SHA512 bd5c9a155fdcf8da933b8a903dce9aa023fb33d63f6783b01aa73eb15313bf4c1147dd6744fab5605dbc58a2325eb97565fa4ad2c34b3291f3eb2388f378c28a
SSDEEP 24576:8VbqPb88hv/l+6Ae/fvF7asVSyRmdcG/DH+M54c2yw:8VO88hXl+ReN7xB4dcUDb4kw
TLSH
T1A9559E66F5748331D073C0BAC4D2AA9AEA3234425B318ACB1246D76C3E77BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e924524110aef5b3bddd048220c9776bfec1f01836da5548390d3cd2622c7fb0
MD5 75f1a79720dd9050b66faffe15797a26
SHA1 2351f1239eb50c0ff5bf206d445565300a63485b
SHA512 2db76fc34ef05d46756ccb657617c3300b4d129175c011e67ec90e03fa6ff4ed148c6a98ad193e8722f4f9cf4df159590ad04786f0e11f06403a1156adc42611
SSDEEP 12288:gR8Yln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywU:gRpe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T15F5523CFABFD12B3FBB6537134711A9212C39CD42DA0745A94943F8A66F8CED948025B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 76dc5847e8ad92b9716172fe92af3e25593bbb9bbae3139ec15f886ed3985069
MD5 854ff0b1a83c71a6060a9fe849f0f0f6
SHA1 9b40e140c16e3a880b91880a631547f6896ed47d
SHA512 916392845736aff1fa0f340668ab1893bfb10ad4879e4a15bd8f46462c09f7e5ae93fedb8b3ab96e1c3a9fff9d405fca954f426bd20ae6b16ec42792668f289c
SSDEEP 24576:ZJIUoe/fvF7asVSyRmdcG/DH+M54c2yw:ZJIUoeN7xB4dcUDb4kw
TLSH
T1D375CF7BEE38FCE2C27A8DB85A91874093A278704F61A3CBD164830EDE335E55D75825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9107e8ae0d0d8f109da9f960fd34c66bb45d0d5f4c1ffcb5dba828507a9f34da
MD5 cecf725612b57615b0c8bf03a067e9fe
SHA1 6b75f2f16bc163ad7015503a6a8995b8e7cb7123
SHA512 c49d109bba9d6bac8aa8767dcddf57c3a51bc2e3c6b68255f4ab9afb5ef81c45671d55e4b0ffef306c538debedb6de456e06c9a343d80fca49c46294aa8a292e
SSDEEP 49152:/QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH9:/QvGAdlCEL8c/yRNw5CkxAcob4
TLSH
T180266C656BF880F5E0B7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 959b93dc101e1f63f61689ca5c56d185b68de04f777ba38cdf00dde05aeea64f
MD5 b537060edf019f7b7f4a03dc3ea77b84
SHA1 a7cfdfb206ee50e1ecd5f1beb0b443107437d381
SHA512 859cea51d6427d1c968a90beaad1f5f865757577c6e81a46b075863d4cf2d171f44deb1cdce1a493528173024beda55c8548cd65f45b8ff7f5f60ad1919c72be
SSDEEP 24576:RdewsAjye/fvF7asVSyRmdcG/DH+M54c2yw:vljyeN7xB4dcUDb4kw
TLSH
T1F775E031FE74E032C7BB0DB22B36C716146DAD600F6129C3E3A85E8E59746D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3bb1aadb894c8e28c01b3a79796d1c86535962441fa1114d2b222e4f370e8713
MD5 af32f815e5bf35981166806adf909adc
SHA1 7a1418f10c7939e53000f370a97d3a42e44b191c
SHA512 06942d3dc049cd4a86ce2db01e534840d3801c4a826a360c363e3412a614f05fb415d7b33f8cdff446a00d90111d53664913c5f179cca549dc2a84ac7a06c87b
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHf:bUEtQevvqc2W1cpV2EI32f
TLSH
T1E1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5956b336983f88fee330781d4f4a6218d1e624b63065ef96bca21a2ae95fb8a7
MD5 417e7b4a5e3d33e6b6807a5a7f2a065e
SHA1 a0fccbd62cddc89380296f77a7908d784ecad3e7
SHA512 7603f05a30270f868b5bff6c494d383b3614220a46b65cc9c15e5a8f8e3df93ec985449b0b6a062f6b592a7b16ead8b700c30b6cb0d5b00f58f3f4a7b3eff23a
SSDEEP 49152:BCbRquA/m2yL5zLfFiV+XenmE3/zSeN7xB4dcUDb4kw:uoq2VjnmwxAcob4
TLSH
T1A3D58D0976B8C2E4D1F6C77896A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6b8afe9d28c73c992bfe7a70baf1a4dce052fff005f2636e86f66bfdb259b13e
MD5 de70db9d991fcddb0289afa5d936e9d2
SHA1 1d6f2af5d6963760cf5b551660ab050dda29f7c3
SHA512 2bbcd39b53e2592bca58f7a21b768fb149735e916698a163143171e306e59a849f56a3d1e8baed345eb13dddaf8e8ae3580405f75e87d4977fbca46a2aa06ea6
SSDEEP 24576:hAhGLJIFoiwtA5l7S53be/fvF7asVSyRmdcG/DH+M54c2yw:hAMyFoiq5reN7xB4dcUDb4kw
TLSH
T10A359D81EBF951D4F5B3AA78A9B68171EA76BCA65E30D20F2150D10F1E33E909D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 aeedd27e4f8f3ed03431b2f48799d6133d59572c96646003a2c841440bfa6f1a
MD5 e98c18940b5431206d3239f02bf0a106
SHA1 88da6c6768815b4590a33f442336ad293aacc37a
SHA512 7a8493c45e8fb04d5b6bad56640039c11d9b08fd1c18f2707d0663e1996ac4965229055a3d1487188686ffec74dd1d1c13eb41551ffafb00b328ca60d5201c4c
SSDEEP 24576:AwuoOWee/fvF7asVSyRmdcG/DH+M54c2yw:AwDOneN7xB4dcUDb4kw
TLSH
T1D465F14A77E908F9EAB7823985578532F3F3BC012A20E71F1760C65B6F772616D29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 7ebeb7c9a4543095caafa0db4daf2e1176efe60ea752c2504b171383b202d637
MD5 7667376034e11cdccc06e9fc20c4b526
SHA1 9394a6f605a78e81f549e6efc744595be7e9f36c
SHA512 5933093249cdbb04635a4d0bc9baa649b8ab2c51defad65c26b0d674831f602b0eeb43cc8bf8b2170687e67efad42f11ce1baf5daf727dc86d3b212f424b1d56
SSDEEP 12288:BBZ1Iy5Yln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywH:vZude/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T11B55129F37E821F6E6B39379A8F1464193A37C92277063CF1064668A2FB1ED51D35322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d99702b579ece66440e1a5787288942d864eb52e05a9d8070707b8aa81505f7d
MD5 467d3fae914ad96a2cebd3b08ee0fa4f
SHA1 3aad001265dc54b9b72c89e651e94bc6087dc557
SHA512 c9dd6c5b90ec85e43b61b99de56a2cda972e86c081cd5778f7a126e9dcb3e9ec0fb94483e99d622caed23c72d3f9c79977ae08b4e81cd2c75a25dc7703fad6f9
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Up:kQRQyi36YOcPQLvw2gAf+PN37xAcob4
TLSH
T115667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 fa7eaa1e4a1e28fef41c10a84832dc07fd4de5d8f568db448614d9941ee37eee
MD5 30cda1abe69b008a0ff08de9e71a0daf
SHA1 dad0ba4c05d491a3964d7cf0015144504456940e
SHA512 1de01342110398d814fa63a5045d266e8e0d5f08ddaebdfd907d47fda7587afe23b5d25379e29a49ec15cc80e3d78ede4db675e5018f8b78559c55c8c31bee0c
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Up:HQRQyi36YOcPQLvw2gAf+PN37xAcob4
TLSH
T106667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a616bf8b0897325efe130400ec80015caf65558c281a6bef6805b52cba58895c
MD5 d3e435ccce51e8aa8d55e62140876144
SHA1 6b46d3a23bd9ad6890e0814b57478511d8e643b6
SHA512 b7eefb0b9a08979b106a34f1141a6c40b23449556c6b522520cf91da77a0e0707a4c5cb3ecea5a63b9fedf297349c6b70554ba41ef6d4b6a0b41dda779e57a03
SSDEEP 49152:L68Qg55nhheWu7PNU3/CeN7xB4dcUDb4kw:VthWRc/txAcob4
TLSH
T16CB55933B2F600A9C45DE1769F4A873196D27C758FE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bf0fd10c1017d48ef0c028e61df11dea123c6ad2973d084157a2861f3e19a0b7
MD5 97929b046df2b45150663bfda4f13ac6
SHA1 e8c5db9e6572d3650f093b058ef60d23d8c18077
SHA512 e18a22f32434068f14e7eeb9fc3613bbf2ea1c5c6508a561127aca3f86aef90b8703c7f9d350b2c964afc64279055c8c932d2d9e5e52320e3d8fc9cdbae73cd6
SSDEEP 49152:13aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99T:0y5112gYy5azzVvL69nLKnhZaxAcob4
TLSH
T1F8167B13F29900E8D05DD1B9874A9232EA62BC474B35B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 58b62777ce8a143208f642fb785c2c5279fed2ae0b0cffa88e89765ee023dbd7
MD5 18f43304775c854bc580ddfb6a5325ce
SHA1 c3d177b5433376cbd4e93d91260b2820e65f4ab1
SHA512 87152c6b500749481574ca626d0eee7f6562aea1cc604d55738c05061714a36ae25b6fe4aab077ae666106d595149441f1c4c477487921a08423d3034aef740c
SSDEEP 49152:OB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glKeN7xB4dcUDb4kw:cu6JmVxd2dlxAcob4
TLSH
T1E8D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fa1fd0ba9e6d7ce8440295f44360ac4c1c80a81825233d378d02da82114b4b5b
MD5 64674e01f6b85106d3a1e96b13ea667c
SHA1 28494e0151ccc4e7a2f6cd8f89efc20eae1c6498
SHA512 6ca5673e70d71997fd1c9f8c8bbb3fae78037e4cf27625dbfd731d8a0d8d5ca4a56a2634b474e789a7997d2a963f0cc663462e0a1538e56ea56dca08f5e99a4f
SSDEEP 49152:R1hpsNoJpF1A6UU44CwH7R4xIeN7xB4dcUDb4kw:RmifPbRwxAcob4
TLSH
T1C1B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1a4f3550248fa615741048a4dbf11dfaad15366bd29fd68315ddd3ca8908d729
MD5 b83b6a7cd5dfb3bda79ef23356fe8185
SHA1 5b3ad4547aac5d4e4c979400187a42d15e1a2b91
SHA512 90adb22eb811c774d1bf12446be330dcfa8bd78abda37ccf257e76465e71c2b901b1b3ce5276bb9f8bd32de551c907dd457862bff56cf94e2e7b8769e5538af6
SSDEEP 49152:QSuZQIY0Be2KRRVtOnks6NMHqdeN7xB4dcUDb4kw:K5dKTi61OxAcob4
TLSH
T1A9C5BE13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3ef44b5b005fcacbe7d26c21703a3fa806dd05e42f59ca8937e0a98b741be372
MD5 7d4b415e4342878f53d9a36899982841
SHA1 d8d00df4308ac6f932dceb24c403054733f40809
SHA512 1107b3119ea77200ecf2dd911a79f4526b01765a396cfd0114aa17179f9500dd0d2c04a45c0ffdf5b678929544652338e7a80ed6d70a5f6ae943cf90413fe7a5
SSDEEP 49152:chtSn8EApI0figngiDn0AP5wseN7xB4dcUDb4kw:dX2iyphsxAcob4
TLSH
T12E95BE13F2D901E8D06ED178C7568632E962BC160B34B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f145aaa07906d8c4cb819b2f70b7d656ab2f4f13b1e56b8e389fe0d1dd7c6242
MD5 29c10485ec0d253e87c9a4c49a7ae695
SHA1 ac2cab61df77b86214c8d8cd141d748e6070dec3
SHA512 e9bc960237db2a95ce742c0771db64b332b01c09fd0ba90cf8665eab5b27c60340163a0964f7251284f035bb2ec636838dc4dbd6553407a1db60d643e8868824
SSDEEP 12288:vUYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywF:vRe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T14A5523CF7AFE13B3EB7693B17471168211879CD63E6030ABA4983A4667F4DED148015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6ae7da68dfe70be652beee8185d68bd6561632e1af6d99465a0f1f0f060c2c26
MD5 dbf04907669f6bede3279d79e1a7be87
SHA1 37956f5f3631d3f6add76e9f0bd721d5d257f40f
SHA512 5f0ee762018cdc2186dee9a6d8a42c15efb1ad48b1b83198fa2567e709f8c896c3b7777afc4a6961402159c67563ca6a5c52018d63b1691d063868650305984d
SSDEEP 12288:aFYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywx:aWe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1295523DF7AFE03B3EB7693B1747116C211879C963E6030ABA4983A4667F8DFD148015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ef2680e3350569922f5ed286d3f81200a47df16a66370904f68d6451e4bdbc21
MD5 1f25dae332fcc60b0cee47b90114d828
SHA1 660213588f7e34be57428b342a5ec27edcef4ea8
SHA512 646f58ecb9f80aa2f42f913883b9e4b28499308b3a40ea6668312c51af6f56a9f1f4e7e8498dcb58afaf6440579692e6eed9c0354d40fd4b72d13cfd78ff97ec
SSDEEP 12288:IvYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywx:IQe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1A95523DF7AFE13A3EB7693B1743116C211C79CD63E5030ABA4983A4667F8DED148019A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 fce0344e917f4e2a0b0eb2f559405a092d4d33b21ab1e0a7b54a9837c5a1dd1e
MD5 a2156eac22f667f8b386ddfcdca4d7f3
SHA1 2d8828f262cdd7e3ed04f3a96b7cdaa6ba917da6
SHA512 990597f18ee889ef67f0491a59db1d693627e861d7ae09828640dacd54e3087dd0bc5d02abda36c6086428d9f1312ba4415531d90848118799636023c310c2f9
SSDEEP 12288:hVGYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw9:Pe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T18255239B7BFE02E3EA76D375A4710691A2D7BCD52B30729F94403A461FF0EE81860359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9a1e2889841a1b5bff0bd6a1337bbb16576db44700c21f92671623ed339ac9da
MD5 1491c37191d6fc52bf39c7fc5f60d38a
SHA1 0fae6cdc5ece7895de1f69bbb49d1b9d6854d1b5
SHA512 88dd8c86a9c02a249e49b196bb2cd20e74be2be9a18951f04203d29fb8c4f2033c08a9b9fa2228c9b6b7b78acf52c063294fc043d7e557d45be3761ca4bf3d24
SSDEEP 12288:cOYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw2:cze/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T14B5523CF7AFE03A3EB7693B1743116D211879CD63E5070ABA4983A4667F8DFD148019A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 0ad9ade85a016e228c231a10e1571043db4f35d88f32a3268dc367a39300f84e
MD5 ee2c6b8872a7680fd2901f1a06025377
SHA1 815172686507f6eab955b2fc9a83ecd5812c4c5b
SHA512 2cacab61ce4d0833399ff90efce42cf6dc37fdab5ee5aa225c01cf74af8bbae65c579364b5bef4920a876e8e6dbbbf6fe2641df9a3303fe9359756bd27c890a2
SSDEEP 12288:KBYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywu:Kae/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1325523DF7AFE03A3EB7693B1747116C211879CD63E6030ABA4983A4667F8DFD148015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 d8c00fcff6d3c7c433d63968f5146090384560cc783d2a19a95d62a3fe89c591
MD5 49e598e9f8b1283b505df59191d23963
SHA1 6b70ed8ba1393896c81420ce7473747fcc40b739
SHA512 fda86d0db8302b7c52df15daf9a797f487e897c699915fdad8862574b4dc104ab2a6eeee0af45f3885a4fcfa9384478ef6d40526f42e8afa72628bc319eac53a
SSDEEP 12288:etYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywW:eue/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1475523CFBAFE03A3EB7693B1743116D111879CD63E6070ABA4983A4667F8DFD148015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 fc5501bfaffa6f86c523698c0e819c246126eea95a3a5048f7d6121c143dcadd
MD5 13507201dcca9608b679d2d4901e6588
SHA1 37a7e4a0e340800c96581b42425dbd9801571d49
SHA512 37f3c993171607cb73d6f8b1f6fd09a686afec809da7f99a75bb2f73fc410defe7213787649cb170d867e126d4f80c8256c8b83dfe625ca2075026e399889cba
SSDEEP 24576:kZMSzFVSO2e/fvF7asVSyRmdcG/DH+M54c2yw:kZMSzfKeN7xB4dcUDb4kw
TLSH
T11F750199B3A018F5ED77823EC8214906D2B2BC5A0B70D61F13E436575F737A11C2DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 044d273d4140119c13d0835fabb2270ce5def6a024eebae616bf52f19375a50a
MD5 3f2b25e63c404d22dd979716dbb24cb3
SHA1 5755e937010fb5a698d335c790b53f7cf38ed711
SHA512 1649ca65c4cbf3c4bd2a70e7874b220cde8733368041bb413cdd6c7cd35b84f3fc9ac4656b1cc623c5fb98d7dbcf785158cc4ffc35cea1040290401e8335c7a5
SSDEEP 12288:+IYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywY:+Ne/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1905523CFBAFE13A3EB7693B1743117C211879CD63E50709BA4983A4667F8DED148015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 41141575dfbfa5832e7c55dd1412327f206898c07124605453a475ee126a8dd8
MD5 5c1f0dac6461cdc6053d043dd57be051
SHA1 e3a438b8fce6a15e47bad8fb2ab3e2a7d25259d3
SHA512 79e466c94c976c76c4def40330186627f2b59c3676673f02cd1f207364cb76ec42384c0ab8defc5abbdf41fe2ce7d6b4543430874d2b20c55439849279bb0d94
SSDEEP 12288:hMYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywa:hZe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T11F5523CF7AFE03A3EB7693B1743116C211879DD63E5030ABA4983A4667F8DFD148015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 64e4ee275450f6d8bbeddbb8db3d4f12e540f04049c77d23829f00473c503b03
MD5 e6b47a7957f6c240aa9ffacbda4d8ea3
SHA1 8ceef471eafafb5af8348d4f02bc4e780bbcef39
SHA512 1ba15f7f18059c95e4fe55206757ec645f8244329558dd45cdd9bcbb5bb633da6fab1b480e811ddf81af615628bee21759ee1cabc73f7a08fe3f430ebc7ddb61
SSDEEP 12288:SyPz5L85Yln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywn:Pzyie/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1D165124B77B531F5D177833498610A42F3B2BC721B209AAF52A427762F76AE05D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f922d651d942624f090f900aa75b168335118b040b145d68d3ea33524efe9878
MD5 321ca93cd9dfcc067e1062e44db626a2
SHA1 f0f60c18e92158585cb1da2aca3c95a0f20414c6
SHA512 a7634fb97ad6483d0801a9c72ee63d30479903f14129c27f848b91c703bf17b1785e6909964b4e17db0a605e8088b7a49ead37139fe113e97ce48dc7a73e5794
SSDEEP 12288:hIYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywy:hNe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1FC5523CFBAFE13A3EB7693B1743117C211879CD63E50709BA4983A4667F8DED148019A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 7c9e31907f10f5b4ed9ebc0a6bdeeb008b3dedfdf493321bf44aef4c9441e109
MD5 ead1d287fa57c251b2468ebbf22f6124
SHA1 61668246a4ef2df8eed986d2095b3d328a935fe2
SHA512 39de7452c1b4e289dd7de45fb543016627504b14f239bcbbab856f0e220a136ac0b35789997444428303f5642f2ae1abf6f33919bb9f2e94d56a421d05d638a1
SSDEEP 12288:LIYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywy:LNe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1805523CFBAFE13A3EB7693B1743116C211879CD63E50709BA4983A4667F8DFD148019A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 dc8a3b0e5c561a2079c995281c01109b08efb6ae6ef2d4c7722d89a1fd9b8a21
MD5 3aaa072726beb2d5e04f6de71df507d2
SHA1 34fab25f241a5c651a35f6a4b192b11ce7e43156
SHA512 d284579f2cb98fa051279da403c41a1fcefaed127ab984fe2075d3ac6c24a3c92b448a11826c8b9f9a82d36bef4a3672c4c20f498749660189d4233b357549e7
SSDEEP 12288:wyPz5L85Yln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywi:Bzyie/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T13865124B77B531F5D177833498610A42F3B2BC721B209AAF52A427772F76AE05D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 a2a5115a3ac71299ac12b85ea2bc89a451dae8f926cb86ee05bfb18e26d17510
MD5 380a60a4a0f4ec953288e61e839735e0
SHA1 07d4e9f98d4ced0758688df27648ac3bb983b3e4
SHA512 e9b9028d02355141dfb1a29ec1dcbdc293d95bab9c670ef5cba4d5ec829eb02f27c8db8873c5b93dd1f44dbcd8ddbc784b8279badf61ae910fe423884e4e9db5
SSDEEP 24576:jTHaLl3z0zDge/fvF7asVSyRmdcG/DH+M54c2yw:jT6Llj/eN7xB4dcUDb4kw
TLSH
T1C3750199B3A018F5ED77823EC8214906D2F27C5A0B70D61F13E836575F737A11C29B9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 a5b256f0413de43e98d7b4fb7fb070c9c2b95c2c6e43f28e402cce957cb22c7e
MD5 51c7bb45dae0d73d58c428092e1b3a09
SHA1 1479c0bfbb79d47aed36c6886ea1f66f4beae8bd
SHA512 2c87aff1be1037c38c2131bf94276927d250c953699dc9b42919d047133123c892952c1d782e24d52f80b5b4cb79b046f11ab8c4c4cdd1d3f8941ab86d1e8ecc
SSDEEP 24576:X37d9CHKy7GZ0e/fvF7asVSyRmdcG/DH+M54c2yw:n7d9CHKyaKeN7xB4dcUDb4kw
TLSH
T19D85CF91F3E811E5F1B7DA3598724511DAB67C9A1B30DA8F03A4265A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 6ab2200abad1b6c7d04ab4b930bb9f59bdad7a75a828f7d7c03c553fe2639810
MD5 f7479a2f3ef27882276df0d39c799d55
SHA1 f8bd517968638c7ca4dff1b3bb873cdfaa52af1b
SHA512 1b293c5fdc10900b13391d0219584d59e09912a922752f56d551e564acf486de17f300f1135302f6386bf52badd53046ed6e7963240138d47afcbdddfa91176a
SSDEEP 12288:3PYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw8:3we/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T16D5523CFBAFE13A3EB7693B1743116C211879CD63E5030ABA4983A4667F4DFD148019A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 806a917d24242d2d8980f8fd6efd8a24a6dd41e3747d8da223d8aaed301a7df6
MD5 ce55c25edd16f6bd80deb4d27ac160ee
SHA1 4da21968f2fde5aa3c45cb7b93dfdeabaa7436cf
SHA512 0ce2277c85f411fd1478ba5923e0c565bbd25c7e757a869c338ff582f3c8dd43dd926ee79c7420987361645774b3b7db2e061085a19b5fc68be39983f5d54397
SSDEEP 12288:hZYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywU:hCe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1705523DF7AFE03B3EB7693B13471078211879DD63E6030ABA4983A4667F8DED148015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 37d3ad8475c2b30d8359200b959f37121c9a19c952a66c778edfa4c54a4f867b
MD5 e3e7b98af37a38ea3d567dd97b8d23ae
SHA1 7558a2bcf7cd0ebf868e947c401bc4f9129d8766
SHA512 4c096996aa7e765d39bd5f74b870ff0ac9f495164b9718c18af3539da78d59c53f482600616e2d21af4dd4831a8a39104ce5bd494e64c8786d4696cfe044b44c
SSDEEP 12288:j6Yln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yws:j3e/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T10A5523CFBAFE03A3EB7693B1743116D211879CD63E5070ABA4983A4667F8DED148015E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 c22f1c366e4afeec2c3bae199e22c3448090a09a3b389c75c430e1cc796a2d08
MD5 276bcbfb73cfce720ac61004b8dd496e
SHA1 7ff9a9cfa928ce6a9013c90745236cd126886d71
SHA512 d13aa6bcfbb4364e551b603c5a60b72aa353b78d2b84a3a484516da531463fab7d7df5e2f892ff8e4eaa76b124a6a14c41a9e939c89165ae75c7a5dec7406ea3
SSDEEP 12288:sIYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw5:sNe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1425523DFBAFE03A3EB7693B1743116C211879CD63E60309BA4983A4667F8DFD148015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 0b0f2c22751479579a9a5132b3142fde5943ccbacbb239e1f59470f18203b628
MD5 ac8dd84f92810ef22c18cf1d311b4c01
SHA1 99b2fc0101dd7ba39f7753ca47ec3cf4eb2773cf
SHA512 8b14cbe9b1055c0964fa36284487b6c954d2eb41132124ddebd16716adb15633e40010452ca2638ba5b392a6eb0a788baad89693a1e0068f0f8f03f805108fbc
SSDEEP 12288:MPYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywF:Mwe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1625523DF7AFE03A3EB7693B1743116C211879CD63E5030ABA4983A4667F8DFD148019A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 3dceb8c205f1848f3db567beb5cb87c4b77a395b152045fde0fd1405ae456e2b
MD5 f14933d7c8587517d3c8a1ee43bae7f1
SHA1 7b5571aa9d238e6b711347e8b935760b78f05efe
SHA512 a34ebad9df6e8123fcae2adcd71139972df8bc31630ee567bacb59ec4757a7ac372d83c5521aed75a574e7e26dfcd9e8138164287e9139b8b69a67960ff44533
SSDEEP 12288:dwYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywL:dFe/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1DE5523CF7EFE03A3EB7693B17471069211879CD63E5031ABA4983A4667F8DED148015E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 69f701c8039d64d6af2807ce30a79f69b412c53ee20f5dacec2c173b78315716
MD5 a065147fa0917889abdc485a14bdb0cc
SHA1 029787b3d975f95a4ccb19acd3d0e4d2ffc9b021
SHA512 84d4f75661e81f2c8bd909aa336f18193e7e34455340e37754374eb64c78a9b7a9a76a22fe52f1255eebaaf74743757e529c4fa37b8b14062d0dff4bf07012ce
SSDEEP 12288:4OYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw2:4ze/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T1185523CF7AFE03A3EB7693B1743116D211879CD63E5030ABA4983A4667F8DFD148019A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 ca8ebb92eac0eda53df49a22adb99dd05994238f13a01d3bc8e7b172fee0727b
MD5 6e767e8720823ad106c270feabd9f777
SHA1 4aa60665cff3b75c9e281efa315ffb9295124cd4
SHA512 3bac8d5d30c34641c70c010ae2709dbcacb1edc7eae28795ee9c6eacfe49d56305182ffc9642e34b7f6994e06151e5145efe64d906b025708d8bf60b4b26c749
SSDEEP 24576:hfwvok9RX6wkyAIJe/fvF7asVSyRmdcG/DH+M54c2yw:HMnYIJeN7xB4dcUDb4kw
TLSH
T1BF85CF29EBDC04E5E1B7923C99B3460AF2B178591B31D2CF129A53AE0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2e9e8df83c8136dd9accd76f7f691881284da74e35f6012230799fa09ed44370
MD5 0aef2a608219b1ac6a3da5a056f9fd9a
SHA1 54d084c57fbe3931aba866d09204d6325e424ce6
SHA512 0927bb23c7d2f83a25692059398ff72ca5cbdb394b02a85cf91f80a16ff7e8b61b1b4fea18afdb85de50fe1ca185e86ef783c1498f3d76eabfcdd9fb0879a63a
SSDEEP 49152:BYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0MeN7xB4dcUDbU:pySzPbxAcob4
TLSH
T146066C97A1A801D5C1B9C1B98B1BCC17FBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 90885cb9d5f20fcc082c6fb5c95c6028bd6ea6663d7b2eabd8bcaf616e60a5ac
MD5 1a1a2d079d90a8341906947a99420fca
SHA1 8d90838f0bb7620785ef46cb9714889e1bb408da
SHA512 9fdc1a942c7dd097840f31bb3ec5e42a20a7933dd84a20a8ca860fcb2bddb4e1a9ee4dd61debd86f992b0c5e503c9562763ded222b302c4ad1b0939baab266f6
SSDEEP 24576:o47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYme/fvF7asVSyRmdcG/DH+M54c2yw:o47JUQj1irIhCnDHUPfF/8eN7xB4dcUs
TLSH
T1EA65AE1EA3EC02E5E1BA827885154A5AEA71782E1F31DACF1270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 7c6f3344c7d2cd7ddb6a6490a58f49e1c8e778247f40fa2381f19f28714159b1
MD5 74822fda38ca682051df71e66707787d
SHA1 c5a1817aa4e0cff0953d579d3627ceb6e38e181b
SHA512 f9aa8279a5c0f4e4421618b127d18308faec271b3c7faa0ed3b1171a63253e69e50f0d9d762742a62795fbdfd0d1f5a226c601de1546528f98e23bbb3bc454ae
SSDEEP 12288:jNsf4Yln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2ywA:gde/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T18C65014AE2A802E9C17EA275D7624A41B3637C6557E0E3CB62C0F93E1FB4AD45DE5303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 69bf1af1d81e679447fedeb6e7b2a7297a085cbb7ceadedf04c18b2f7b90c2d9
MD5 fa9ce28e84b95ea12ba73807002caa1f
SHA1 7d7b3aef48cf19dabadef2ab197c121e40e774b2
SHA512 79cdd12462f522b05562a03f3f20d73612c902cea9b858f8bd2125290a6914d4f646428de242e26d564009ae93d05569ff3fc0375ca1b16dce7c103633107a66
SSDEEP 12288:mcJfoBqb7ibTWCHDgrI+L3Ny9mla5AmN:meolHDgk+L3Omla5A2
TLSH
T1DB4518107626CB4FC6A940325E32D5CCAB707D41EE056F0373C98B3FD576A59BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 ca8e7a60062abcc881dfc167547e1720b5b1157e94620732df08cf8589aaebcd
MD5 a675f00eed30f0e6090b211e8bc2b5d4
SHA1 fdd36d0455fb194279b6d98657441a6bfc4fcf3f
SHA512 c6a2c7c2cc1e569b95b994601871f23a5874310ddd28543acd955a48a2c823277b4cb45b4d79eecd986a754d2d66a8ec5b76619e2898b58e1068ef04299898ce
SSDEEP 6144:DHlFzLJe46wUHRKKLsXgWjGH74JKDeoHx1CqQhAJKDeoH61c1Mwml/74EM4xo4IF:DH3Je46wUHRKKg7ZhAn1t/71M+o7N
TLSH
T1DA65E9415137A7CFD1FA5032033A6E8DB764EC06B7066F26B389447AD86AB45B0F97C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 a007c3de3ae8c53a4ae0af02dd25ec3ec1b2bc3be332499fb995d1cfa420615e
MD5 78c938e0cdebd1712b37ad572ffde521
SHA1 f659e1b4643d688bdc485d9357f34ebd61bbff1b
SHA512 4ee0e4c66192b83f23788499587e597a54c472bc598fdc59058230cf6fc4a5fa930537bf07ba0f96e01e62b36d8641f08ebdbe85f3fd8a2380c56f9fb917de4d
SSDEEP 3:OlH/lZrZ9qg/2qPh8Dd/lA3mCllltq3mCllltGlslslslslslsl6Kl:KPbBol8mCtSmCtEEEEEEEVl
TLSH
T1D48192984B200760D206A5790121AB451360C09DFBA14BEB15083012CE822A80C47F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 cfc06fd0f6543c75e2fcb21fbc3c4ce2caf0cddcf9be1c89061777241c65c035
MD5 07b5543297455834c020354008f4f0eb
SHA1 555b72a247d4ab412da34f77c56a1435e927a511
SHA512 ebbf074a5784ae2f322a6b88ccb506990e5dc10ac736cf3717cfbdaa155f1b5eb0f77c0d35c815508dbdb7d82712b0f193ff0cc00b6fafd3291283b98004ffd1
SSDEEP 12288:kF7gYln0//fvF/D+rsUXm+jyDFm4BgcG/DoMb+s9n5NSBm2yw5:4Ve/fvF7asVSyRmdcG/DH+M54c2yw
TLSH
T14C55239BABFD12A3FA7653B034354661218BBCA52F50B0DBF444368666F4DE91CB021F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4b182b9ac4087766bbdbeb4ad314110fabf7ec68886e53a532c332ca5a80c173
MD5 4cb4503e07721239fde639cbeef57885
SHA1 3d6c00d053e704ebd69f6fcbfff0439de01b0b44
SHA512 06615b1d48e8e7be0c9a57f2495fa84ab0da1ee730423a72c398f69177953bd6132cd7929808915d4049b30e782ab9d7ffcf673ed59492e0c29282f75b21c256
SSDEEP 24576:ngb6bmBIi49WNNFpg1rSvFv7bY/e/fvF7asVSyRmdcG/DH+M54c2yw:ngb4mBIBhGFmeN7xB4dcUDb4kw
TLSH
T17865AE1E22EC02F5E0FAE2B89DA64417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 a1c8ea407a13e0e72ca3c8c3650d5dec31c91317ceaa708251640feb709398fb
MD5 c6099ea58714bf35f3085682d1e33525
SHA1 cb75c9c54822f3709e1b6b55f9edc3690828ce01
SHA512 02fdf7ae6bc1de023d4b65fad96d9af82fae9c39293e484dc9a44fb8ba98eca8c021efecd8b33cd95ed1a3d2e4000bf16fed73135eb2bb4d30ba816d4148dc4f
SSDEEP 24576:BG88u8FpJqH1bzria7/m2e/fvF7asVSyRmdcG/DH+M54c2yw:E7ZFPqVea7/XeN7xB4dcUDb4kw
TLSH
T13985F16677E502F1D477D13889924663F2B2B8251360FBDF06A88B511F33AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 7a33a48168782b5cb66702b698d02509b896ff649273637c2ad6b4249ee1b2cf
MD5 57de36c8b354c5af31cbc052b11f89cc
SHA1 893c4d47c43b442a6e5bf095d95e4883a2b9bfd9
SHA512 7166883a374241c29e994d256e580f4fad68e0bf3319fa0d5110d70ffdf8688feb0c4491d192dd34c69c511ad44ad0970ca315a1faaf0b8e9e5359133939b721
SSDEEP 24576:4PUr+NQKe/fvF7asVSyRmdcG/DH+M54c2yw:4JQKeN7xB4dcUDb4kw
TLSH
T17765E16F22ED18E5E676E17D89924709E372BC621711A2CF02E0917E4F77EE86C39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 634f7ada04b66def60e27c479d9a506f2f674b90323b00843f03d20c9013d274
MD5 761f5608d5eebaab617479c032f077f9
SHA1 a2b9dbabe9fb973d505b659d7066aec3133fc998
SHA512 96f789cbccaea758d7ad168a9bba356ed53deb00f17a088a68f7cc3aec6d1a5ac13704545f44614cee16f80f6c6b7d79785eeb3c6b07b11ff35e8ceee98ae86f
SSDEEP 49152:IBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjaeN7xB4dcUDb4kw:jG05lO43bixAcob4
TLSH
T1ACD5CF6E62EC11F9D1BBD17CD9864A0BEBB23815033456CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8b35cb3b47129b2e4c2aa7c4f8f678b8ee3c6078e09cda7c8902860c752a4675
MD5 5662b3a3f8353fbebffc51a24de21a3a
SHA1 ff150a8fa1cc7b777740dc8893d03aef0702702a
SHA512 17e5484043f68e1d59d49fdbcec4873cb92a42154d09b42b316a8497f22123ca07b9468e911e2ce341d1cce808e5620458f57ac457b4cd66e8b012e710b945fb
SSDEEP 24576:Gfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnMe/fvF7asVSyRmdcG/DH+M54c2yw:ea5POZ3+Jt2pasx2+mCeN7xB4dcUDb4x
TLSH
T13A65AF5EA6FC01D5D5B9D17DC583461AE5B2382213319ACF112182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 79a3f1eba50d26100b2400254f3eb175c0aeb12e943426f88c2773729e8bf308
MD5 9398c50868ca4a7e710dd5fa44cc82d5
SHA1 3ae660b84bf8fdb25bcdbc51d8064d32a798e9e5
SHA512 e8aca2d6b1c90958839818f9f64ff410bb88eadf199b65c238edbd902f6fd1c86975e472be9b6157cd680032449d5a7f7145338d40289a0d155471ceb152740e
SSDEEP 24576:kNcwHdjbyQ4nLC18lb/EOjowL7Fk+e/fvF7asVSyRmdcG/DH+M54c2yw:kNc/zEOVHF3eN7xB4dcUDb4kw
TLSH
T130858B1623E901E4F1BBE1BE89779546FAB1786513309ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3becdb216b1273421ef2d566286fa7565afa1739dfb086c8930b1b78d5043dd1
MD5 869a32f0001768726c67e65648d89a85
SHA1 fbb384baa2da8b8125738899aa0db7761f0ec78f
SHA512 609c6e9307fe92996c3edbe4bdbc56cb42dff09c1232aaeb4e298b1fd3ce243b7df3f8630784bd1b2f8bcec81cc26960c54a7a7f30cda8d4f6ea58f3e9d3ef33
SSDEEP 24576:48kNvNnaFeYhJNtmZBm+e/fvF7asVSyRmdcG/DH+M54c2yw:48MwBtOm+eN7xB4dcUDb4kw
TLSH
T1E055AF6EBAF806E4D1FEC6B49D238512E6727861073293CB9290C13F0E679D89D75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 a7b8c3f7a0a26cb6033d2db9ab3aa72bafdcc4bf37a5b927712260bc9f91e5ea
MD5 2356c2ef98a2def658cb288211026e28
SHA1 4539466437649e172edc36d15dc73c04e43c3649
SHA512 7ec45ac4058419dd74e64192012ec02f0eef4c0070ff20fbd2883a3afe12622e591990de53fb9383d14161ea1dcfe1b275bf272a4d0709b20b35f2e9fa45f41c
SSDEEP 24576:DD3FHshBIYQgAxe/fvF7asVSyRmdcG/DH+M54c2yw:DDVHeBIAAxeN7xB4dcUDb4kw
TLSH
T1A075E17EEAAC00E5E57BD2BCD5634A06E3723CA9032165DB01D491B61F7BEE42D39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1484-291-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1484-63-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1484-64-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1484-57-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1692-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1692-316-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1692-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1692-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1692-104-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1692-110-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1768-312-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1768-80-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1768-86-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/1768-81-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/2000-76-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2000-70-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2000-310-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2000-68-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2108-38-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/2108-37-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2108-44-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/2108-52-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/2108-54-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2108-45-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/3592-115-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3592-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3592-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3592-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3728-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3728-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3728-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3728-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3764-331-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3764-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3764-98-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3764-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3764-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3764-91-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3784-116-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3784-118-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3784-124-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3784-315-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4136-0-0x0000000000400000-0x00000000005F8000-memory.dmp

Download

memory/4136-50-0x0000000000400000-0x00000000005F8000-memory.dmp

Download

memory/4136-1-0x0000000000750000-0x00000000007B6000-memory.dmp

Download

memory/4136-7-0x0000000000750000-0x00000000007B6000-memory.dmp

Download

memory/4136-6-0x0000000000750000-0x00000000007B6000-memory.dmp

Download

memory/4468-14-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/4468-90-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4468-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4468-22-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/5820-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5820-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5820-135-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5820-137-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5820-129-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download