c5196961467518b2a2b99813fcac86992798e538bf3145613dd801a32c17f97d

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_6d3423ffed80303caa1cca964d8032fc_elex_karagany_rhadamanthys_stop.exe
Size 1.2MB
Sample261104-wal5qsby9w
SHA256 c5196961467518b2a2b99813fcac86992798e538bf3145613dd801a32c17f97d
MD5 6d3423ffed80303caa1cca964d8032fc
SHA1 caf1b35ed5e1caa47b3b0e0140c94bf992a563b9
SHA512 e938b6f84d12509b9c5997ff8315c78df8cb150fb792693338e56f3830c9a2a9ce4bd2c3b727215c39e05dc4be4798010a4d222c5ac74d0edffae0d2f834b7d5
SSDEEP 12288:vwJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:YdCN/j2GLl3iFSE33b9
TLSH
T11E552321BAE2E036E07B437407B8DB225715FDE0DA74854357C41ADF6A78BE48D362A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
8	elevation_service.exe
4416	elevation_service.exe
5936	maintenanceservice.exe
1880	OSE.EXE
2760	PerceptionSimulationService.exe
5636	perfhost.exe
3656	ReFsDedupSvc.exe
1380	SensorDataService.exe
1008	ssh-agent.exe
4692	AgentService.exe
3932	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-03_6d3423ffed80303caa1cca964d8032fc_elex_karagany_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7ab219ca227843b8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-03_6d3423ffed80303caa1cca964d8032fc_elex_karagany_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-03_6d3423ffed80303caa1cca964d8032fc_elex_karagany_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-03_6d3423ffed80303caa1cca964d8032fc_elex_karagany_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-03_6d3423ffed80303caa1cca964d8032fc_elex_karagany_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3016	4924	WerFault.exe	87

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_6d3423ffed80303caa1cca964d8032fc_elex_karagany_rhadamanthys_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000086e29c43846cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052b8e900846cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000081a5c43846cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000670de6ff836cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052035702846cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
8	elevation_service.exe
8	elevation_service.exe
8	elevation_service.exe
8	elevation_service.exe
8	elevation_service.exe
8	elevation_service.exe
8	elevation_service.exe
4416	elevation_service.exe
4416	elevation_service.exe
4416	elevation_service.exe
4416	elevation_service.exe
4416	elevation_service.exe
4416	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4924	2026-11-03_6d3423ffed80303caa1cca964d8032fc_elex_karagany_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	8	elevation_service.exe
Token: SeBackupPrivilege	3656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3656	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3656	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3656	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3656	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3656	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4692	AgentService.exe
Token: 33	3932	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3932	SearchIndexer.exe
Token: SeDebugPrivilege	8	elevation_service.exe
Token: SeDebugPrivilege	4416	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 2148	3932	SearchIndexer.exe	104
PID 3932 wrote to memory of 5868	3932	SearchIndexer.exe	105
PID 3932 wrote to memory of 3504	3932	SearchIndexer.exe	106
PID 3932 wrote to memory of 6120	3932	SearchIndexer.exe	107
PID 3932 wrote to memory of 2360	3932	SearchIndexer.exe	111
PID 3932 wrote to memory of 5976	3932	SearchIndexer.exe	112
PID 3932 wrote to memory of 5664	3932	SearchIndexer.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-11-03_6d3423ffed80303caa1cca964d8032fc_elex_karagany_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_6d3423ffed80303caa1cca964d8032fc_elex_karagany_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 596
  2⤵
  - Program crash
  PID:3016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4924 -ip 4924
1⤵
PID:2044

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4416

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5936

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1880

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2760

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5636

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3656

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1380

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1008

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4692

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2148
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5868
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 3064 2924 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3504
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 3024 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6120
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 3064 2924 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5976
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 3024 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 79bb6e54f7a5e4c00e9daaa3735069d730e08417d4402e24d10b7e601dba44a4
MD5 897b18aee627a80f8caa051fea6a6de8
SHA1 ebdb5f936d68d137baadd330211004c7ad017ac1
SHA512 bdea210c11acf54052d9839ccd971de6ef193207da5e8f5fc9f128d521a2cd4713038bcde0007e44254c7a36a0b492c92bd7934ac3c4926a6f5bd722ce5269f5
SSDEEP 49152:vb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn6N/j2U4FH:t3q6sjBXj2jF
TLSH
T1E8D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 a8e04d8b1e1a7de004e800ae2c88f3f63abc9ed94c3e044c3a2059a8c2acbe52
MD5 7242d94537ae8457c3fb2ec8ffa2ec84
SHA1 c986fac11a56429a6033f03ccd1268ab26a6b9a2
SHA512 c14225dfee5dc50b214676e67bc3e680b5156c8663bb3b912e188528864b3c5d0306d038cca6b331c3d13e315f0657ec397d5dbdbc2dbd74e484c82660c50d80
SSDEEP 12288:B1XLsswWkxy2lRq2czAuJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:vXYfDtczACdCN/j2GLl3iFSE33b9
TLSH
T136650128B7E049F9EC67827CC9A1C511E632B8948760E7CB03E499661F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 c50ab0b21be3090944cfec26d32d342946a3f77094d163344375f2498925d2b9
MD5 ce74c4c61162547bb633172c1c774e5a
SHA1 c4039ffd65d34fbd7723de44c37d65c49c124816
SHA512 820f36b54991c27d8b19d21219cd3e4cfa83ac4ad0cb4276f4b12a6dbc9a3360b7cfd8b87ba1b1801a35d52ae9da02db59ebd0f364ea0b80a8876ae9b6b9314c
SSDEEP 24576:U0Le5ji0hmxxrMxdCN/j2GLl3iFSE33b9:UPji0AjzN/j2U4FH
TLSH
T19A85AE26F6748335D073C0B9C5D2A69AE97130855B308ACB4286D77C3F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 605ebd9574cc4fe546fcba19147f1f6c8d786b9338b7402ceace9f9192a96250
MD5 61b5936ed07f517e7ba2cc39009da62c
SHA1 fdc3a758ecff347a8f6466767079a7a009f7e24e
SHA512 3c776f9f3af47f2330140031b4c244d96443fa56d04a5f451f93648c24f0bd1625aacc283fa9f693d39d7bfda39e9b16f8f1c2e862f90c486fcda8671c6b1546
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWn6q8wyuLdCN/j2GLl3iFSE33b9:D/ezSC6vUzPveHjy3N/j2U4FH
TLSH
T1B2755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7f96b4072f4bd7d99a9104fdd67dbe0f0974905630790546b34465309ac7de98
MD5 064a5f83139d32dda63fb6bbc27a721c
SHA1 382bcd5ff0e6be325e354375f965e9c3f6d2ed47
SHA512 1c4433e68f4fb1256d6be5ff130f5c77a312f5b3b85b068cc8543cc06ca1fb77e55f3d175e3453e5cb07b2c729262cbdfa56e276a8a6bbe9c54918740185d7ff
SSDEEP 24576:rVbqPb88hv/l+YudCN/j2GLl3iFSE33b9:rVO88hXl+gN/j2U4FH
TLSH
T180559E66F5748331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 5bd6d136caea62d1b85f57eaca0a3c69f268afed17b7fd211967941b3f881029
MD5 1378dfdecc3c2cc7413088a86ffd14d1
SHA1 d09e62d617cf7f8856c6648525f10d080a91a743
SHA512 450ad68c351a9a8f3ef7bb6af81769710e1a53ad7487b44833485e741b5bb08b69b976e424241d1c6a81f795e639726e54ce41c1746a38163becfd8f11cb6653
SSDEEP 12288:DLpJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:DLtdCN/j2GLl3iFSE33b9
TLSH
T160452360DAA5F565F2AF837903ADAE655600FEE8E525884785817BEF117CFE8C032063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 c4dddad115705826c1966c4a3345febe6e8cd3120840280e0bc074e67344eafb
MD5 b35d11a6bd319bf62cbea8f52db5bd5b
SHA1 fa17b7dfdda2a81e8e9349ceaf72d70b0d946527
SHA512 41f4148756d51c4e69ce477ceebdd00f6c3fcb9174ae0a30c7c9887098e182520442805adba9a0eb68995c7621a9de5c4902c481668da754b48849696b82fd35
SSDEEP 12288:DeBNUbTVO86UKJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:DJIU2dCN/j2GLl3iFSE33b9
TLSH
T18E65CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 47027ddd040898a8c9aedb19dfdd8fce1c47d3482d173521ba85ea86a0c86d5d
MD5 64cb183b8d67b57efc8dd27fa035783c
SHA1 32a7c951d067e2f5b3f3658541bcbdff343db28e
SHA512 7f5382f43c972b60ad001be29b744ff6780536632c0d7bc8d22a777e6719e63c0bf0f5787418601881bffca144fdccb8e4a3b25bf621da1a32e622525ec948be
SSDEEP 49152:cQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THI:cQvGAdlCEL8c/DRNw5CEj2jF
TLSH
T195266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 40b384c1c129b38e46855feaadd879f8be404830aabbdeeb67d68fa9225534a7
MD5 9b077ecb87ac7717480b896ae1c26ceb
SHA1 aa684fb9b627841cbb37f32d9c6954ef9c1540f9
SHA512 f4507a4c89fb5345c8b9942e44c3c7b731a41b6778cb09ab0b1578e4c54a8d8814a5c744aaa9cc888f049ee8045bd3297a6560fd802f52288b62f738825ec355
SSDEEP 12288:CAwSfxL/2Dc3RDLLmt0LDQewsAj4JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9c:H0ewsAj4dCN/j2GLl3iFSE33b9
TLSH
T13175E031FE74E036C2BF0DB61B36D716142CBA608B6119C3E3E84E9E59346D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bf86bac6e5becf6ee1f84a5538e35eb9b312f5fb0bf6695a1bbc33a8712101e4
MD5 6f658ecf320587e95d5a9701767c0090
SHA1 d8ffc896236a31def962223b39c5ffc7b2257d62
SHA512 1bd8afbf3b493a2b58c2760b1d6b4066b2dc4335597e9f65c4d75786f912dd422ab9e1eb0f2832032db754a6e476cda069be3c25dc144156764b951de131ac96
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHV8F:5UEtQevvqc2W1cpV2tI32V
TLSH
T14D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 667f0ad7538f5290c7699822604f5937a4017569829753528ec41ba7fe7d5ea4
MD5 fafa4a4038a5e4a8b82911440051e4ce
SHA1 fabe5d4c20a267bc5a648923d3e4223c1c8ae43d
SHA512 2bd991078a3ee5654aee37381e48ec141999b39fca489d42b931732d18a5db00fbb648b4d0a11ad0ced74a75a5dda0130336df9afeb526000d5172ca38c0240d
SSDEEP 49152:qCbRquA/m2yL5zTfFiV+XenmE3/zDN/j2U4FH:foquVjnmAj2jF
TLSH
T172D58D1976B8C2E4D1F6C37886A2C647F37178158B3197EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 cab8da197198289385e5ee185b05357e58ad83ecd459cf71b766dc255b4fc650
MD5 e76a44c604e53f3e1d214e1e39c73ff1
SHA1 e58704a49c24b227f87a87edd6d120f60bfa5c88
SHA512 b55132a8efa7884dd16480304497437aa5c6c2ba13bdf358aad836ea6f2be9ac1e29b52c13164a042755ecf7fffd01ba3ee194a2a4daa219e774cecb5f69aa9f
SSDEEP 24576:5AhGL3IFoiwtA5l7S53fdCN/j2GLl3iFSE33b9:5AMUFoiq58N/j2U4FH
TLSH
T16D35AD80EBF955D4F5B3AAB899B69571EA72BCA95E31C20F1150D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 7a954e8c956db6656eee159c36e48e8280efc1766bba7b75a2232a040a356137
MD5 78d62466c9fc524b3d2a9d48f81a4830
SHA1 ff7907ebafb8eda82487916f6695282583b6fa4a
SHA512 b6617db336e9d238bb066f664cf71e3c08ad71fcb32de9f7bf68610e50550e8f80f8642ed12bc9b01a5ce0db096013f530bc9648be09b42ce21919c2cbfeddf8
SSDEEP 12288:umw5HEjsChNVBFgl0WDm+CTJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:nwu4OWsdCN/j2GLl3iFSE33b9
TLSH
T18365F14577E41CF9E56782388697C536F7B2BC512A21CB0F03A0C69B6F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9db2ce219ae500907e33ee4cbceb7449090ed7617b3d6da5bea7a05dda3a4369
MD5 a21ff727406db6794b985941c8b6102f
SHA1 02c11faf3c54617a4c2269e688f4542914758cde
SHA512 747c5e35d68efa9a222693297e27438038fc3efc1cf2eaf34f0a9ce2476d39aa843acc541aa701fb5074db7e7e7f468f2ca4915b3bc7513ca9996a707dfd0e7f
SSDEEP 12288:5eZ1IyIJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:8Zu5dCN/j2GLl3iFSE33b9
TLSH
T1D855125937E471F9E1A7827C8AE59A05D321B8A5A73243CF025047EA2F36FD58D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b0efb72dc803a8b936854cda45e67f33ea0416f6213b7258987611e91a73ae48
MD5 b5401525b9e9a84e9327827d6b94962a
SHA1 86ad69878a74e76f03f6eeee94fbfea24fd71345
SHA512 2c60199e6fbb0161990011138dac7a45bb912ca6b37c41d8b2948d09d7fb2d764b12038a8c7378527e892a8e8178f3f8b0044a9bc7b7bfe640dafb088da743ec
SSDEEP 49152:/j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Us:OQRQyi36YOcPbLvw2gAf+PN3jj2jF
TLSH
T166667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ca4f3c72b92d81466935e59fe01b67898bc7522184ea52d56079f6cd382e5719
MD5 55d02a5e4010de12685eff97c3ed939d
SHA1 9866fe79a63db01097496a1b4a9d22adba3b5dce
SHA512 9e1b5d8a79471dab44057f39103ffffb140cdf7942ceef074a20ae21a033d714f1cc9970fba54b2b597e8a8590381dcdf422f7b4414f1db8ab09291dc68cb98f
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Us:uQRQyi36YOcPbLvw2gAf+PN3jj2jF
TLSH
T1F2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 94ab71b53e1efcb929d5de13a04fb5628ad4939d275d4577f3de52e66316f465
MD5 892639322013b7b460c8661e884aa2f7
SHA1 da3ffee8dc852d2e780c4c6e2fc2496a07b9d31d
SHA512 14292a75da0489be785a4f0eca3fe4f3bcedbcfb8aa45ca02a49eeccd01e838ade6d88597c971f5402d79cb7c8ab0d6c21fdc2e0cd46930d9bbd895adac9cae3
SSDEEP 24576:WwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0JdCN/j2GLl3iFS+:A68Qg55nhceWu7PNU3/zN/j2U4FH
TLSH
T144B54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8541725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2c14009679d820f6bc94c83f0bcb6fa6f8b26b0bd52e5c599ae09f8ab88b5b2a
MD5 d4a495dccd839acc76c359fee6623f10
SHA1 39d5922bd624339a66e4eb2d81324464f231c607
SHA512 f10c9148d85fc5707b14cb6d42cc540837d21c5cf42be5e77436708449fa0dc50ecf45b6e9f5133a1df24c12e50ec7fff548cb98405c108a1bfcec573a1e6653
SSDEEP 49152:Q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk996:dy5112gYy5azzVvt69nLKnhZSj2jF
TLSH
T17C168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c62da0649445970cdf7431e3289de689a085583c1ae88bb84bf4e48b951ed62f
MD5 bcc605f05e8ea0bd81a3f38fd713aa37
SHA1 dc0ef2ab8669a5688f1374e7f816bece058da441
SHA512 cde2b787ccd3d9a1ed7dea70977d0aaf894dd3c7b918486b9e81b1ccf939ffad43de372f4dc1744f489824d406b81887a16b8a302d5dde65791248e81aef7397
SSDEEP 49152:dB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gltN/j2U4FH:Du6Jmdxd2dDj2jF
TLSH
T1C3D59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 63941d4a1ece4d8fc74379068fbaa0c01d268b19e6772b46b7ad85e3708e4ef5
MD5 4b6f5c3c9e28dd4734a182fc51bdfedf
SHA1 e3240dc5743f268a778bcc8fa9a19acd20e94a01
SHA512 953bc6ead834616abc718ea8b04b3a03eca2e5bad64a56cb806189e933877af62db17725f317c226004b015bdd349fa25822b59a13cb0db7923cfc41991135e3
SSDEEP 49152:91hpsNoJpF1A63U44CwH7R4xZN/j2U4FH:9mifPWRAj2jF
TLSH
T160B5BD13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 142cbb42a0e07dfa6a2497620d83fd7fe8e6cc4e801ea2f8753d5b3ddb116b67
MD5 fa0ad66436b3400b525c170304efd59b
SHA1 5809bb7982aab19d0ef51399672c6b2f651431ba
SHA512 0dd8da912f582f633e01d10465cce67963516fa3033445d6b7399a6438306725178c7baacaa21f6c5c769b3ea36fae9ab27fc3dd9a456f5b46de526951e83840
SSDEEP 49152:OSuZQIY0Be2KcRVtOnks6NMHqON/j2U4FH:A5dKii612j2jF
TLSH
T177C5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a6228c5e971ace88d4640c6e0ad782a487f1e2b577b764a2042e492fb0b28c97
MD5 7480912517fca1996d0374f73c6fc074
SHA1 3ce582c1816188ddd6fd47c6cc6d197379245826
SHA512 2984349679a430a92b6c8152104a5859b9a87d313568be65c4ac395cb43b744adfe3ed4cd6950e86d66af921c69a67ae4a79402a418c290bcde10272b1fd4f1c
SSDEEP 49152:8htSn8EApI0fig3giDn0AP5wFN/j2U4FH:9X2imphMj2jF
TLSH
T16F95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e3885837b3a8b84f7305698601f08df1498e87d7b55fd78e55eda701d0375931
MD5 884ae225e436d909e548706a3168e092
SHA1 79e13f632081349cf35306a86b95b5ece2b84e48
SHA512 965f94780e415992ef2cce40f02f1b6ed78c4284b1a611ab6d493ea513dddab05ae447e85ea73fe46bbfc73ca6906d64081c848961644719ec1ee5ab0c9c7857
SSDEEP 12288:eBJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:e1dCN/j2GLl3iFSE33b9
TLSH
T170452364E9F6F669F15BC37D43A99B555200FEECF6264447828116EB237CFEC8032462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f1f248989512be561ce553cc93707d152bf6a2676c1d5dcef5f595688b100ae8
MD5 a9531576f6cb17795263cc497dca46a5
SHA1 36eb2d846255dcb2f323c88b2f8cac08ccccf111
SHA512 56f2bbe2bcce84f56ed30e6d584c1d055ef36c47bac819ad821896eac988bc221662096e10ac0b588d548b6ec4cfde40c8948d3b55e4d80881a062ea9d5e785f
SSDEEP 12288:LsJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:LEdCN/j2GLl3iFSE33b9
TLSH
T1E8452364E9F6F665F11BC37943A99B555200FEF8F622448786C15AEB237CFEC8032462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 324a8772fcb157d70f578d835c6f3f3a3ee9e06ec7417868bdc4123838d70115
MD5 8be1c1c89e18e798cc56509107818b84
SHA1 cdbb8ad31fa4227e7085c6aab64b4711a4e663ba
SHA512 c2f1b73349dac958f4a75d9f1331095c0ac6ea9461ea068283ee254e0b6f19fd8e3be30d111d5796a46b0cfcd4de1ddb22126a380ab7127f76c05c5e7d96d9d2
SSDEEP 12288:hiJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:h+dCN/j2GLl3iFSE33b9
TLSH
T13A452364E9F6F665F15AC37D43A99B555200FEECF622444786C11AEB237CFEC80324A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 916edd928958e24d3343428d3ac14eee6ec0720cf4d643847fe5a36cb3d49c45
MD5 34e9da218844c12e782ec953bfa5db4d
SHA1 20060edda8566a2e4480147589d9b4253b835a31
SHA512 2e972914c620a0ea6763e220d1aeab8a8209675ab6982b11e39c33c0ad6055e9b24ff6dfe0fab09b7392299e1df5109a2621c506fbba5b3f34acf1bba2fb26bd
SSDEEP 12288:kVvJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:6dCN/j2GLl3iFSE33b9
TLSH
T1DE452360ABF5A1D5E06BC37D83B59A11E320FDE8E732458F87401AEF1B74BE89431562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0e322f4d5cf60b8737a0cd7d4febb8a0c9e500dee74801cb5ade3becca6fe06e
MD5 c8c733b7cf444c03e4bfdd65fc9e6d55
SHA1 912e1cdd3979dc215c5a48d5aeb856a7e656d4b5
SHA512 9e4934db8f7dd5a714faef6d16dc6f076adddf807026b84a4b6e54a75536a0fe89dc5fa795c1ed131c033be7d83498534de712d428682c0a187e8ac2ed49798d
SSDEEP 12288:7XJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:73dCN/j2GLl3iFSE33b9
TLSH
T111452364E9F6F665F15EC37D43A99B555200FEE8F622448786C116EB237CFEC80324A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c31b317cacc2930ace2f8a0a5785e503db81c5435498243b30ff1b39debb0758
MD5 e80c65c45dee1b423c4059c3549943e1
SHA1 94bc395033876108c5129aef3cd18ed97547c1f8
SHA512 0c934a5595c42781d1bd0101547e30b62ee166ebffcfa48a130ab136e87d09dc98e1062c64cb273c01dc6488c70fd97e97ce88cf7472b0e120512c8da76c5526
SSDEEP 12288:hwJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:hAdCN/j2GLl3iFSE33b9
TLSH
T18B452364E9F6F665F11FC37943A99B555200FEF8F622444786815AEB237CFEC80324A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 3b1b3b886808a976068d30f10bd1c87e4182eabd321b8130601c44c1b577a7b7
MD5 6feb359deb3b7189dcd8d683b248147b
SHA1 d0dddb4acfa14e7aff0d0b8f7f8279fc9bea4e18
SHA512 b1ec0399a5e9f765de052abf5f49267e8e42b5b3bc0c43879195d0357d956ff2766d0fac6196392e875e39288e503cdb1ecb2c8eca1eadce7ffed66ac4cca3ec
SSDEEP 12288:C0JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:C8dCN/j2GLl3iFSE33b9
TLSH
T1F2452364E9F6F665F11BC37903A99B555200FEE8F626444786815AEB237CFEC80324B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 7e6da5be77ad218c8cc3f562fb14650c2bfda27f262d41b6536b077d40232533
MD5 9749de0020ad1833f0a3a9fabc941425
SHA1 09e186542a9f3514644e3d8ad6f8949f194d8a51
SHA512 a9781f909cc73fda857c8b5aa5cd70518149fdf22a9de68aba61fd98ec6898f5ad708335be834d7107f3449d92ca417b050c30b0d2fc14c52e2272a6ab18fc7c
SSDEEP 12288:miZwbVzzFEoS2cPvyMJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:pZMRzFVSOkdCN/j2GLl3iFSE33b9
TLSH
T1B66502A4B3A058F4EC67823EC9658906D2B1BC594770C60F03E4366B5F377A15C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 4f23abe94cd847d1dcc48ec3944ce0f3d65293a5107083c3fad0b734a87e9c16
MD5 49996953369a11cc8f82838d59e93034
SHA1 aaa25e8a93eeb5767af18082b0f4defef0f34c50
SHA512 00ea448398c17d41e61c3e7ad70da73e6c6ca4e8132fefadbbd4d20e702252b45563c1e881579aa0ff3f5e90588e53f1c1dce0894928a942cac5897e06caa475
SSDEEP 12288:h9JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:hpdCN/j2GLl3iFSE33b9
TLSH
T100452364E9F5F665F15BC37D43A99B555200FEECF622448786811AEB237CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4db2d7d7b4b4f181252a56fb159e382a72edd0dc5c8013ee9a004f4ff891671d
MD5 bfc8b6db90b6bd51971487583240355d
SHA1 2de80a9072e17d15e555e7cfdcae9f781eec6b88
SHA512 db8e4cbf62424d0b14392228de5311531b28e54900926862b08e116482f4ca9fc1865befb18f478986964c1d7dbca2703b563a33604b2e33ebb67baa97e1717d
SSDEEP 12288:w5JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:wddCN/j2GLl3iFSE33b9
TLSH
T111452364E9F5F669F11AC37D43A99B555200FFE8F622448786815AEB237CFEC8032472
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 dc9bce28f9246a45e895d4d271116f33886f14be6e97cd0b59a52abff8fbb9ae
MD5 416f6142e984e0408962d3a7137d853e
SHA1 9223365e2bae261a2dfccfbcec742374803c01e7
SHA512 57243ad4c2556efa1bb8d8dcbd110b32269bb713029d9c7a9311cfc2c27aaa4f0d7690c12909498119806ece287bb66dba3f51596901f39063827e099fcf293f
SSDEEP 12288:yyPz5L8IJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:vzyodCN/j2GLl3iFSE33b9
TLSH
T1EE550217B7A130F9D177823889A65A01F331B87597208A9F439007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a3a310e4574e00feb80c138befd737094df181ff6b8e64da8961ef22f8819f6c
MD5 8cbf8a4eeaed32c0aacc400c5bfecc40
SHA1 9b810e6a369ce1de04ea618efc05d6f380561b74
SHA512 f12d124e8ee586ce3fa12d86ac45cf1834d60674a057624d9bd13da9030ecd23e81dfa6027eed16423bdd956736e9edda30588e22460dfa7958c9e45aa0c477f
SSDEEP 12288:29JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:2pdCN/j2GLl3iFSE33b9
TLSH
T14D452364E9F5F665F15AC37D43A99B555200FEFCF622448786811AEB237CFEC80324A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 3c751010f45a68509d51c18b8958feafbb8f058ce5994b4243b92b1027bca7d2
MD5 b97121d782944deadbf1c149eb82d5c0
SHA1 3e23dd2d3616605f77a39a47abeb8beb32931a5f
SHA512 62c2375f50bc4c9d1a70f3cdf0a054cec4a7180c6ae4ee14ec1a9005fece6ba76924628f47571e651c068f1a312b49c83eba1fe7dbd9f5fa826f04ce750e49bf
SSDEEP 12288:X9JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:XpdCN/j2GLl3iFSE33b9
TLSH
T1CE452364E9F5F665F15AC37D43A99B555200FEFCF622448786811AEB237CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 981e647f85442b1d9b2c035effb7bbf53e3859d5b9925dc0d56f263d1c6e1b75
MD5 761e7aa12af6438100f83a84c7a68059
SHA1 a358126a0b6a01085935e4af653e05da43aeaed0
SHA512 3234f6632715227ea5edf31592d83ff9fae3e5d511ecf3e53e87512e7271ece538d3a9081e1a20f14ccf3bf6770106e081284a1cee09b2b65a468ada2d782a1f
SSDEEP 12288:vyPz5L8IJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:CzyodCN/j2GLl3iFSE33b9
TLSH
T156550217B7A131F9D177823889A65A01F331B87597208A9F439007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 73faa1b5116396f480d11539445ee14ab050e6bb91358add66fe7e14851adde2
MD5 612cd27bee137d6d5aca137eab443d1a
SHA1 1760d258fe706079db2b235427baf4bbb6593c83
SHA512 d6abeb9c4eb2f32d45dec50f0fc0788e2084a492e4ceb8acc9fd8201ddec86d76c9684acb2517b891f5533ef8d4decc676a2e8e3cca1b7cb333d741d69a3b3e9
SSDEEP 12288:bCd9CWYoaLHF3z0z04PDvhSJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:WTDaLl3z0zDOdCN/j2GLl3iFSE33b9
TLSH
T1836502A4B39058F8EC67823EC9658916D2B1BC694770C60F03E4366B5F377A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 2236953026cabca64851911bf5d66dda6f4be495ec4a87389c2d55099c4b4bac
MD5 ddfe6f0a31fd2e1bba58f603a6add282
SHA1 796e43f85673c60717f59b7d557c1cc6ff6bc64c
SHA512 e6f116b9814617218c453cf7dc4c7fe1d92cc4b8bb5c769941623f547756858db9194584e69e2573e14ce99e86b8b36ef5e1a12e967bb09da633832e857f9834
SSDEEP 12288:pi4e7KRdTfgwCHKy7GLbbdIvbJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:p3vd9CHKy7GZKdCN/j2GLl3iFSE33b9
TLSH
T18675CF90F3E414E8F0B7CA3589769511DA767CA95B31CA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 9d638863107735463d6160a5f56e680a5326f9c22178d9f0bdad7fecefac9bb0
MD5 1e667faf69e7dec6634b3f8018350e89
SHA1 3019c1d8fbd1ab6036e8cfe1b09f1aec9f1feb79
SHA512 a668944ec29c034f81cb60829647259bcc64c20587b7fd9f8204580dd742b3d714eff3e66cf7a8f33b27a609238522c8181567944b0602f513ee73288cededef
SSDEEP 12288:MCJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:MedCN/j2GLl3iFSE33b9
TLSH
T136452364E9F6F665F15EC37D43A99B555200FEE8F622444786C116EB237CFEC80324A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 e8ae0995692bd4ff0ed52b024ea0e8102ff8d9856dc9f23a13707b2c8f98f084
MD5 da67e7979325b579ef27483960edc129
SHA1 3083a9ecc22842fabe337745301e64a3651f1616
SHA512 e5bdc0f0a4bdc2bcb09c9820bcbe8fa9d56c7ea331a2dd1668dd81191e2eaeaa14d14d4a53a4559eb13cecfca8df79a4e97936f1a46b5f48b71aba917af6d657
SSDEEP 12288:SoJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:SIdCN/j2GLl3iFSE33b9
TLSH
T1B8452364E9F5F669F16EC3BD43A99B555200FEE8F626444786C11AEB137CFEC8032062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 0cb70c1ffb5cfc92a0ee58a357bf6df11b8d95d74a60253784902e160c0517dd
MD5 37ed17abf185c636c9120f5bf92b004c
SHA1 09eb1f32379d2ee8d0dbe7c608f151ccbef334cd
SHA512 cad54c5f489e2c17ab3f60f4dddc3dc7eeda70a4e044b97763a5b4c5269272a888bca992896d0552987c159185f76f69a5ca0ac63c1cde96eac150699bd44ace
SSDEEP 12288:XbJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:XDdCN/j2GLl3iFSE33b9
TLSH
T190452364E9F6F665F15AC37D43A99B555600FEECF622448786C11AEB237CFEC8032062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 471b01d78c54033bfba55b06e8b8dc77d937ac90a42734da61d4d7de17ac7493
MD5 e8d16d9104e95f35702e4b5fd25cdf15
SHA1 e2859b152aea2e264b0c09349a6851503c07eabb
SHA512 c17c0ffb659df8db2ffb6b9b69b3bd248c2d2c1b76e01cbab03716c04c06262d76d5a725ffbaa28f29f4e11c08d1aabe795560ab98d12dd4afdc0244fca8945e
SSDEEP 12288:49JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:4pdCN/j2GLl3iFSE33b9
TLSH
T1FD452364E9F6F665F15AC37D43A99B555200FEECF622448786C11AEB237CFEC8032062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 82495463e7595c1ff63b533d9531b463c99bc365574a33bfbf4a99287edfda61
MD5 dbfb9633f05b9d1ef1dbe49169c579b1
SHA1 3a6bf23bf12c14101dda4d9a14084a9767cf6521
SHA512 b8f4ab04aca93d367f15b795a9e6f2910a2bbb5a43e683877a43fc5241403bf7a3eb6c2cc6058a6722c2fcbef796b5c87de560f5f697d8c7d7ec4d04e3eb8642
SSDEEP 12288:lCJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHS:ledCN/j2GLl3iFSE33b9
TLSH
T1C5452364E9F6F669F15AC37D43A99B555200FEF8F622444786C116EB237CFEC80324A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 e709b1ce1c9406f6107536511f0715f16526913390a568f08c50c1340d8b579c
MD5 ebfc87bf76064e620989ab47d15547d8
SHA1 714c6543cf9f87688f78538b2c61cfdd442cdd2c
SHA512 e59bdd86d8f17f13cf1b3097dce44cfb042920f5fce2387fbfa0c08d9c3bf41df01476f529ca3b73b164cf148953d318ac568ff0cbc29e328ee58883947a9dd2
SSDEEP 12288:0FJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH2:0BdCN/j2GLl3iFSE33b9
TLSH
T15A452364E9F5F669E15AC3BD43A99B515200FFFCF622444786811AEB233CFEC8032462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 351215893e6286ced7cb8f5d3df2337fa222344dfcf5c26b483994990b934401
MD5 793746c25e4e072d1ea0e2b2b6ba3919
SHA1 a5d8a54967cd2081603448fb3382b46139b89772
SHA512 9c5edf99801073d6cc40e3c1227f72ba389724da7dcd9caecbc0fcfe203e228ad05d088746d6e6ea9a19e059c440f7b02bac4685a6b17d126ea8b13c37b5f76b
SSDEEP 12288:iXJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:i3dCN/j2GLl3iFSE33b9
TLSH
T179452364E9F6F665F15AC37D43A99B555200FEE8F622448786C116EB237CFEC80324A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 75fce284c00d94e1501191ef76d1a0002195ed0a00560ba0581b084f54ee963f
MD5 cf4d555a0d6800e8cb428b6dd4f35483
SHA1 10551f141ae9aa33870c9c6e433d27994eaf79f6
SHA512 c01f0a9a0d38a5257d988413754930e19249e0646cb7352cc6aa84ed4219c73c7d1a483262399d79f2195a252536f4db7a9a66edd53e5e2e70babf5b9c7b5000
SSDEEP 24576:sfwvUk9RX6wkyAINdCN/j2GLl3iFSE33b9:IMnYIiN/j2U4FH
TLSH
T13D85D029EBDC44E5E177923C89B7460AF2B178685B31C6CF029A53AE0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4ab01af0de3949ea36fba03dbda60d85ed781d87430a8343ea136333db9d149a
MD5 d67e7d74a7350a86327266c15b30c615
SHA1 5b26f6cc0794eb9edc5816b97f3ebcbfab4d9e37
SHA512 6e8183174d81542c5adc35ff2636dfdae9c3514f288a914138664576bc101b4df80de1ee61be51ed3ec024f738c5c8bbb81e73f3a8488a62d33b697c07f7804f
SSDEEP 49152:LYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0lN/j2U4FH:OySzPDj2jF
TLSH
T112067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e467a472c5f7bd1292a8f3a556eef0702e8df1920c3183dc37569841b158fdc7
MD5 c8ee72cf5e18a3e1ad455d07347574d9
SHA1 292180c323ad3b26704e9e54ab185d8b888da488
SHA512 199e3a92090104a42c13ba3e2e97839370d8ff3d33694ba637bd86d228ac81b12e130b7cda8712706d3ec602671f9100b8884f2a8f601217d258512568822aba
SSDEEP 24576:b47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYUdCN/j2GLl3iFSE33b9:b47JUQjTirIhCnDHUPfF/VN/j2U4FH
TLSH
T15465AE1DA3EC01E5E1BA827885158A5AEA71782D5F31CACF1270437D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 3110d80c84420c4d6526d16a428653c1e28a1c685126bde03a807559c2e30cd1
MD5 a709cbc1525fe6cf59f3c30c9fd3e53c
SHA1 719919eb3f3b40e0163b5e450e70d4176474f1c0
SHA512 389abc0930417dd28c73dfac6c0ec3f8e9f3beecd1c72a69373783654831ba95efe6ddc3c3cead87bce854d9f8ede5b996baa10c578b55f38c161eef08b2813b
SSDEEP 12288:jbsftJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:25dCN/j2GLl3iFSE33b9
TLSH
T164550119D2A452E8D06E9279C7558A41B323BCA493E1C3CB43C0F5BE1F39AD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 544eeebb6c4ae7d477edc056d024cb7b3bd72411f6073266db7f8c09dbd312ee
MD5 43907b6c69c9eb5abf94f816e1a2706c
SHA1 4524ac1b1b6d71b4e3d92775f58366680c893af9
SHA512 414953961cda725ab6bc9341b11f34e87cd8b17fa74bb03ae055148a72295ec464f882dc590268c3d1bd773b07e7afe69e040961d16d0f2605204824af13fbd1
SSDEEP 24576:oG2JVUPBqSAwlKEuS11Q+VbhDsrFHT0e0/tuum:wVUJqTqKrSPQ+5JsJHT0e0/Zm
TLSH
T1F94518007626DA8FC5A940325E36D6CCA7707D42FE046F0773C9973F9476A59BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 8KB
SHA256 b43e3f64faa1a68d71753f2a6b02ae9cdb09b280f5567306522a9cb6dc8def1c
MD5 1f37dac03572f9016766256adbb99ec3
SHA1 96d5198bbfa288361b7338349a89620c7a61a8a3
SHA512 46bf6e58e0369dab209b86f9e2d3ebf89486521a1b1c5a28135707930d6bf755f94ce9e58ae39673435d60ea84939a2840753ba56172cb1724d99c176e8fd930
SSDEEP 48:xz904w13Xll5sWXCll5d3UUREK0kENRu+UKnWgnJ:xzm1Xll5PXCllP/+LRTXWK
TLSH
T197025651FBA0F533D86B02768CE5B3ED2729F8A45C010343754026AF8CDD5814D6AAB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 909KB
SHA256 0f4c5fb2cb1d03a7643af6f80ce6ad63992f898b24b2bf6382369e6f352380ec
MD5 5e9790e4e238642bae0961e8e2180a4c
SHA1 3cb234bb1b2dd5587087ad1b2475aea97d9817a9
SHA512 7e60136717de66e14de46fcdf12638f0d24eda6f22be8e7fb49df007da7a0b5083ce332b5efc60a4851276796beae3f184d0dd7ad6dc92f3cf688953dd0fb5fa
SSDEEP 12288:wCouugouR/i/uuXiSHceKno5/6oBMPHrDAbKZKXF+VhGl:wCoNuR/i/vyOV958zGl
TLSH
T11815190561B7FB0FC5B650335235C6CEBBB49C07E64A3F1573884C38D85AA1AA6E27D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3403c734660e11a48599dba0145c55617c37bd8e25f4dcf33ae897e666b54c7d
MD5 217bd22c00afc874153508e802ca153e
SHA1 7a50c62a724e495d213be4a92375103675ed85f7
SHA512 32af1eaecb1960f2e4d515c83149b252ea6a8d0f8a67bc61c4c226a9371c615cd80979459fdc1a3545c72451954bc5f9a0d0e388b9a51dd4780ea5ea2d9dad22
SSDEEP 12288:F071JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ORdCN/j2GLl3iFSE33b9
TLSH
T140452360DBE5FA55F17E837802ADDA256200FEF8DB1184C7C54126EB6278FD8C932563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 536187a11ff89526c9d73f4d64f11ae0f81044c8963894e2b019ee3b632a56df
MD5 2413aa4d539fdf2aa6279421db2a2d82
SHA1 6bb14450f77c832915c8471f2b9ebcd311a69b73
SHA512 d5eb02ef2e2dd7636ceb3567ac85e86d17e9d30ea4fc282a788894fad53c0a983c35d34d901e474e2a3e19d5910f3a7bd537aeca3bce769208dd20bfc946f28b
SSDEEP 24576:dgb6bmBIi49WNNFpg1rSvFv7bYLdCN/j2GLl3iFSE33b9:dgb4mBIBhGF/N/j2U4FH
TLSH
T13665AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 71d751c5d35086f3e329bf52284767de608f972387c5cae17cfd1d0282e28127
MD5 2ff6f805aa7fa1b59a455747077c49ec
SHA1 9546b7c4f97f76ce05ad481497b4f6729d9e282c
SHA512 09e67c2bdca3f8d56e90f19bc14052984ab347a9fd29cc466f3153da8f69a74b5d61e06287dc89e7e9f5634bd3a4d9acd838392e064c6df4a068505da85b15e0
SSDEEP 24576:DG88u8FpJqH1bzria7/mkdCN/j2GLl3iFSE33b9:y7ZFPqVea7/gN/j2U4FH
TLSH
T17A85F16577E101F0D47BD1388A864663F671B8251364EBDF07A88B961F23BE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 ee465d0fe9b4246a82d196d54b8febe7fabb4ec86c326623c273d34a5b757419
MD5 633c8b86d7efa33d27b4e67f93558bf4
SHA1 4d6e9242ea8a2d9b4706eae5e7d2f6aa5dee7121
SHA512 d3f6f07878fa0ae161b1c790736951d44a175fabe39be9252c0712e939aa9af6798c028eef6072a5a415b19897ff700edfb6660ee492d201c1329a3876e946b6
SSDEEP 12288:FHvUrBFrEjwaQAJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:FPUr+NQwdCN/j2GLl3iFSE33b9
TLSH
T1F465F12E66EC18E5E67AD17D86868719F731B8615312D2CF02D0817E4F27EE8BC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 52d4fa3e36c9e7aa436980f598b399e190f875a0333a491743265ee0fd950395
MD5 9c64b56399e926f752d4416f54ec99ff
SHA1 415be171a84907ed3e0412b84750072600f978ef
SHA512 de495046c786257137f52b72f37969b0f43a51c9cd4b6e5968c274afad111c16d3a335e89dd62c2112cb27759b3f85265859138b139ae5b0b4d8fc3e52504c76
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjLN/j2U4FH:eG05lO43b6j2jF
TLSH
T144D5C06A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6ec645054046e55d3e95294ae46614cf29d743df8711613e8fb2e118c1ee1b20
MD5 cb426ffbcad5760f8caa69af41bb03a9
SHA1 f521a7d511ce59113a6041a0a4afc8960c24a477
SHA512 46311802afa9a2011952381c18a53e03dc48bfd191c6046f1aec6fa8ffaf44452d91de088db613140adf4f5bc911dcbefd9f0c6e40a8b019edf14cae26c61927
SSDEEP 24576:kfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnidCN/j2GLl3iFSE33b9:8a5POZ3BJt2pasx2+mzN/j2U4FH
TLSH
T18665BF5EA6FC01D5D1B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 22ee9e417ce468a67116ed9beaa78b1b8f037d025f0f7c7e7abe849f683af714
MD5 49bfae11a156adc692ab41ed5fc384db
SHA1 5857b2f5be344fd34a2ae4388c59e0c4494614ca
SHA512 f465a42a12c36f9a578d8da3133d83c056a40d5d5bf2a4c6431da6f55791aaf54d4cdd512a46c38ce55b2b47361f2b440291c089e8100630e4d4e7556d932641
SSDEEP 24576:/NcwHdjbyQ4nLC18lb/EOjowL7FkMdCN/j2GLl3iFSE33b9:/Nc/zEOVHFAN/j2U4FH
TLSH
T1F0857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 bf099aa887afd4c058e5671db0b2f475bbb58e76447cfd71116c4f5a0ab04b19
MD5 69bd1f3d56c14a217b38ede688b47c21
SHA1 82b9be476c2b04f485230236eea5e703859fabda
SHA512 0204c08872b9ae1e3d660f2aabd79c820b390d695b070616dc8aa38afc40ec5e7f1324e938f1fa4f21d719763796f7609e1588343bec6b17f01e700c0fffb7f4
SSDEEP 24576:YTkNvNnaFeYhJNtmZBmOdCN/j2GLl3iFSE33b9:YTMwBtOmRN/j2U4FH
TLSH
T1FE55AF6EBAF846E4D1FEC6B58E238512E6727461173293CB4290C13F0E679D89D36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 ac6d8a959674c0cc489c6deb6c9d8f20d22042b913e3a56e67dffdc36eaea18f
MD5 efb24647c7586bc9e8bf7dfeeb224ff1
SHA1 34d689df8cddecff9221ca7572292ea4c8dfb2c7
SHA512 f20674760f60b2f9fd2fcfbf4ff2416dd8a0e27d38e24e8186fad1af636b8f8b9190843105e5758f85160ce13fb7855ca0b87bee0da266db833c25dff1392d9d
SSDEEP 24576:mD3FHshBIYQgAVdCN/j2GLl3iFSE33b9:mDVHeBIAAKN/j2U4FH
TLSH
T1C475E17DE69C04E4E57BC2BCC6638A06E77178A8433255CB02D481BA1F6BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-84-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/8-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/8-13-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/8-22-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1008-110-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1008-117-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1008-111-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1008-309-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1380-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1380-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1380-310-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1380-104-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1380-98-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1380-97-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1880-276-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1880-58-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1880-65-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1880-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2760-291-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2760-69-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2760-71-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2760-77-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3656-307-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3656-325-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3656-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3656-85-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3656-87-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3656-92-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3932-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3932-313-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3932-139-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3932-138-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4416-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4416-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4416-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4416-121-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4416-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4692-129-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4692-122-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4692-131-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4692-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4692-123-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4924-1-0x0000000002490000-0x00000000024F7000-memory.dmp

Download

memory/4924-6-0x0000000002490000-0x00000000024F7000-memory.dmp

Download

memory/4924-7-0x0000000002490000-0x00000000024F7000-memory.dmp

Download

memory/4924-29-0x0000000000400000-0x00000000005E1000-memory.dmp

Download

memory/4924-0-0x0000000000400000-0x00000000005E1000-memory.dmp

Download

memory/5636-306-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5636-81-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5936-54-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/5936-43-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/5936-51-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/5936-42-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5936-56-0x0000000140000000-0x0000000140214000-memory.dmp

Download