9156ac82cd1f178a0d2f709bf2274d14d54a99cf31afbff1633ffe9eaccfa882

Analysis

max time kernel
145s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 04:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_a23683cf45aa53784cea14f9f23935c5_elex_redline-stealer_rhadamanthys_stealc_stop.exe
Size 667KB
Sample260708-ex4vmabv3m
SHA256 9156ac82cd1f178a0d2f709bf2274d14d54a99cf31afbff1633ffe9eaccfa882
MD5 a23683cf45aa53784cea14f9f23935c5
SHA1 6eaa073e0c4be74207b364083adcd12d1f9eaaa5
SHA512 29962f19ccaf3a89836b0104e3911a7a4fb0999ff7db08a739ec269cb2124ef7ec5b12dcf0654726a45cfe4f10e40631139f02ece98161e15457dd125c396832
SSDEEP 12288:oYmIjE5U2p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jt:o5U2p8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T13BE42215FAA1C831E8C0093026288859BFBF76328869860F77986B5F5F613DCDF66717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 12 IoCs

pid	Process
3204	alg.exe
3392	elevation_service.exe
1512	elevation_service.exe
5056	maintenanceservice.exe
2548	OSE.EXE
1004	GameInputSvc.exe
3676	msdtc.exe
5648	GameInputSvc.exe
2544	PerceptionSimulationService.exe
3144	perfhost.exe
6096	ReFsDedupSvc.exe
4804	locator.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\820caccd2468fd14.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_a23683cf45aa53784cea14f9f23935c5_elex_redline-stealer_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_a23683cf45aa53784cea14f9f23935c5_elex_redline-stealer_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_123281\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_123281\javaw.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_a23683cf45aa53784cea14f9f23935c5_elex_redline-stealer_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{E2277D6C-6395-4EDE-A8E8-FCBB9350102C}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{3C81180C-59CB-4E95-A820-1821E70470EC}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3896	explorer.exe
3896	explorer.exe
5648	GameInputSvc.exe
5648	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5760	2026-07-08_a23683cf45aa53784cea14f9f23935c5_elex_redline-stealer_rhadamanthys_stealc_stop.exe
Token: SeShutdownPrivilege	3896	explorer.exe
Token: SeCreatePagefilePrivilege	3896	explorer.exe
Token: SeShutdownPrivilege	3896	explorer.exe
Token: SeCreatePagefilePrivilege	3896	explorer.exe
Token: SeShutdownPrivilege	3896	explorer.exe
Token: SeCreatePagefilePrivilege	3896	explorer.exe
Token: SeShutdownPrivilege	3896	explorer.exe
Token: SeCreatePagefilePrivilege	3896	explorer.exe
Token: SeShutdownPrivilege	3896	explorer.exe
Token: SeCreatePagefilePrivilege	3896	explorer.exe
Token: SeShutdownPrivilege	3896	explorer.exe
Token: SeCreatePagefilePrivilege	3896	explorer.exe
Token: SeShutdownPrivilege	3896	explorer.exe
Token: SeCreatePagefilePrivilege	3896	explorer.exe
Token: SeShutdownPrivilege	3896	explorer.exe
Token: SeCreatePagefilePrivilege	3896	explorer.exe
Token: SeShutdownPrivilege	3896	explorer.exe
Token: SeCreatePagefilePrivilege	3896	explorer.exe
Token: SeShutdownPrivilege	3896	explorer.exe
Token: SeCreatePagefilePrivilege	3896	explorer.exe
Token: SeShutdownPrivilege	3896	explorer.exe
Token: SeCreatePagefilePrivilege	3896	explorer.exe
Token: SeShutdownPrivilege	3896	explorer.exe
Token: SeCreatePagefilePrivilege	3896	explorer.exe
Token: SeShutdownPrivilege	3896	explorer.exe
Token: SeCreatePagefilePrivilege	3896	explorer.exe
Token: SeShutdownPrivilege	3896	explorer.exe
Token: SeCreatePagefilePrivilege	3896	explorer.exe
Token: SeShutdownPrivilege	3896	explorer.exe
Token: SeCreatePagefilePrivilege	3896	explorer.exe
Token: SeShutdownPrivilege	3896	explorer.exe
Token: SeCreatePagefilePrivilege	3896	explorer.exe
Token: SeDebugPrivilege	3204	alg.exe
Token: SeDebugPrivilege	3204	alg.exe
Token: SeTakeOwnershipPrivilege	3392	elevation_service.exe
Token: SeTcbPrivilege	1004	GameInputSvc.exe
Token: SeBackupPrivilege	6096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6096	ReFsDedupSvc.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
4420	sihost.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe
3896	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1880	StartMenuExperienceHost.exe
3896	explorer.exe
5300	SearchHost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 3896	4420	sihost.exe	98
PID 1004 wrote to memory of 5648	1004	GameInputSvc.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-08_a23683cf45aa53784cea14f9f23935c5_elex_redline-stealer_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_a23683cf45aa53784cea14f9f23935c5_elex_redline-stealer_rhadamanthys_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5760

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3204

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1512

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5056

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2548

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3896

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1880

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5300

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5648

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3676

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2544

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3144

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6096

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4804

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:4664

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:4584

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:5660

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:3248

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:4996

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:5284

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7228fdc0517750bc0a9a098e592224272e68a9a3579cca18d792e4c0af9fa712
MD5 154a43ec92e9daa7a9b291ea7e66bb44
SHA1 c4ad7d891d9d1fe01b19ec5d9752add235d9f4fe
SHA512 f08d7d12a931adfa6bfea9fea27d39cdf6fdda60f3dd22f3045176747ee25fb20f17206ed82c81a806f804ae6609d276ddb439a30e2a4585e43bfb4b0e98b902
SSDEEP 49152:pb+632BuPkFKRrdE6oh7stBhuXjfS4LWxn7WS1SZBnHTAsi:/3q6gjBQcNzAz
TLSH
T12FD59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 61050a9be3ba89374eb5ae8b29a7a85e3c61b2b0081ff21c2852dc4ef907df88
MD5 fbea574527e95faed8178f9c8b64953c
SHA1 e26d4f63af79ef7a1eb3103aa3b5672823929f1e
SHA512 95389a76eb70cd643e691c91d95082e9e1ccd9b9af63556350abd78c8a1f525655f6e1841d7c6c807cbdfa20682259627f6a003290bd1057d89d27f6b304e0f2
SSDEEP 24576:6XYhztczARp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:LtcUWS1SZBnHTAsi
TLSH
T11905F128A7E009F9EC974239D9A18405FB73B8518764E74F03E49A6A1F233DC5E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 a3b4f9ed11789db5f3bc95a2a485da4196c8f437cbeb69c720b88513297655e3
MD5 14c446c584e10bd8cda0b4bbf5f1ad36
SHA1 37e7384112e38df9f76e4428e2a6a50f6befe45d
SHA512 d43f42e46670f62b983a9a06459d37ffb71553c8ce8ae48b492b7cef038bda54f5e7d53da0abca6f03b35ae309bdb3ef2561b3dcb5b2fdf1ca96c2d3adc8e00e
SSDEEP 24576:UwusOWJp8SXdo8ke5i5Xh6wnBLTHTAcZQ:UwfOKWS1SZBnHTAs
TLSH
T19105F14967A40CF9E99642398557C436F7F3B8122A25CB1F0760C75B6F33365AE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 01ad24ec55124a9e78d8f4a46488a2a0c8e0b03697d995eae0f2535c958f89f3
MD5 3a793cdfd7bba096ba30ef8115ccc4fc
SHA1 192f060fdc447a08a559f00146fd75e3bf7bf8b5
SHA512 532c8a2c6a8d01d67ec02fae533fcdd2d7d4ef21d4803f71a94a2c86068babc48e5ffdc14539d0b52f190e80150762b6ddd9849e92bc0bd6e9c8698da5bec1d7
SSDEEP 49152:+B+taZ3usBWOBr4tEGp0bqx0z+n217aau1glDWS1SZBnHTAsi:su6JmTxd2dDcNzAz
TLSH
T174D59D13F1DA01E8D05ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 d233307db25914a66a7d27646f89473b24f7b0a25cd625521c65055a1716e484
MD5 6ab4750cb9a517ebf5ab1e0ffcc49bc9
SHA1 33f6ae9d83c959a5c51233d05e1d51b19446cd97
SHA512 2d4d7d40788330120f52fc7fbf4311782ddebddabe0e2e14f85f8801267f237bff7c82cd34a40d89794f4b234c2217075fb5c9f225b2991506f9ae3cbcb61e10
SSDEEP 12288:jl7pp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:Jpp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T126D42319CFA58E24F4880630357C480CBBBFB371CF29474F66586A4E6A726DD5FB1A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8c74f9f29ba5b2ad5890e550079010c303f8cd031f6749ce851c29ec011d09e3
MD5 400c84a8bfdcaa73ee8649f8c333ff57
SHA1 7d30642f610bd5af38e03757470cc7d010feeb00
SHA512 881afdc3e307349cd698a7d8afaab70a8b9468f68d2712ecf41152dc72b69ed7ac3abdb3be145ada98bf76ab85d41cf89ca8b6c4eb849640636230d66109dfcb
SSDEEP 24576:Lgb6bmBIi49WNNFpg1rSvFv7bYvp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:Lgb4mBIBhGF8WS1SZBnHTAsi
TLSH
T1BD65AE1E22EC02F5E0F9D2B89DAA4417D6B378164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 00cba49319ff21e6b2dc95ab1ab0c0730b3a9298911dda79f29bc4a855e52093
MD5 b7f179a5da631dd8e650f75c9eae4a50
SHA1 767a2645bb073fd2484ba003796c15cb82d83834
SHA512 cc7177b4d132d270ef7ee1cbb2af718aadcfb592d3fbb9d31717053b4dc08feab742031c9810a654c24923234ccb63b687eac9bf1912646ee4c64e0ef4390167
SSDEEP 12288:7ZGvp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:tGvp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T149E4231D8AF549A4D86847356534480EBAF333708B2917DF0AE4E63E9F226EC6F39D41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 af0e1f56154cd2f8adf884f107d5ba6a9aeae031ee59d88e4450e7b7cd3673a7
MD5 fe8107c245c590ccd923806a90bce109
SHA1 a651585910abb57c99feaec531a74abc9e54b125
SHA512 087c0d00fb2ae9bf3b15d598c962fe26e01a01b690cf783c824eaa88b6981aab968020b5788db826ff0594d693f5e17b4b0512f4db4b0013912dafc9adfbaa16
SSDEEP 12288:SIp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:SIp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T142D4230CCE658E64E5C40A3135384C0CBBFBA362CF6E07CF1698A64E26636DD5F71982
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 20a39d612d5c46e5c8a16f0e4d5fe6952293829a7ed32a9f54abd8a1e5dd4cf3
MD5 8e5b17352e8adf9c823afb60395e2925
SHA1 df33b069a7b1815ff91f06adb0b2b11f0f2a286f
SHA512 2fd695e3095073c63c287cf1af114168a7da808add9abd18594cd6b7253c5914052ded94dbc6a087250978cff977a9749732a48dff7aa49baa2712d2b0cda766
SSDEEP 24576:dAZ8u8FpJqH14zria7/mSp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:yeZFPqVna7/ZWS1SZBnHTAsi
TLSH
T14535F165A7E101F0D47BD1388A464667F6B2B4210364EBDF07AC8B551F23AE90F7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 68433a4728ffcf9e5f7c28f1626c317738ad93aeeebe7b26a8d8654a324d9748
MD5 184cb069961bdabf86b86d916ddb5e5d
SHA1 0c57dbde6bee42e99cc5b5a1395e8dc58693199d
SHA512 7d3952c7f9c77cc665f3d049b324f0de43f6915f2e63e1f5056d1c29cc6e51c33315850c07a82ddee4171fb176e7021ae0734766543e9963f5446b962d1c52a6
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjlWS1SZBnHTAsi:OG05lO43bgcNzAz
TLSH
T11ED5BF6E62EC01F9D1BBD17CDA864A0BEBB23415033556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 56a25876eaca91f102a82cc6fb38b8c22fa9a584f5db5e4a0443de66b6b84446
MD5 68abd87870452405ff9e94c8a4b5077c
SHA1 f9e133cb7f83ebcb2f8f30182597292bb8b4cf80
SHA512 40a09fb73e328ab967b0acbafe7ec64d3f45af12e627b34b0c47c90f3fd3fb82e2448850735be9e84978c881b204e04010beca3adb69a7f964aa0bb6047bf70a
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7Fkep8SXdo8ke5i5Xh6wnBLTHTAcZQ/:HNc/zEOVHFtWS1SZBnHTAsi
TLSH
T1F7858B1622E901E4F1BBE1BE89779546FAB17865533486CF0291811F1E73BF85C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 51d83b10777a34315fcc447bb83fe06e1766f5a2c0487a23ee1b451c073bf7e6
MD5 551b7263af03cb6cdd92840c1b98870d
SHA1 cc77b31a8ce5427e41ae4ad65355219585274770
SHA512 92b378cc717a67fc5f9a8a76ad5f5405bdd72d74ebf64245a03ff3503e0e05e41b4a56e0542e5236605a5b3ff62095ae947025ebc2c4e4b9e138b6f5fa15596c
SSDEEP 24576:MJnJPbzB4SAp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:MJnJv6SAWS1SZBnHTAsi
TLSH
T17D15E03DC2A810E8E4B7C27481191A59FF71347D2F266ACB19B4D5353F12EE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 1.5MB
SHA256 e445a6bf0d408f8a335797215536bd49231e86bfe6eb70fd82dbae9817ab4d9d
MD5 7137109538f5b060e897f6350e8ec4cf
SHA1 6ec1dc221488db7872e3b10c1c31f4a3463792ed
SHA512 012fce5151d3597b0cf7f93a2cdcf20ffda6f0644d3583916b495032c66fbbc1c72b7c0f1d8ac3657ca9ae3422fbbab76216d6b3155b95e1bde4a6a3a0119445
SSDEEP 12288:bIC0wHGLYRvlWaEU6ohtqzvfm104wKBQwZo5oYdaku8puwZ9C3jCmklF0yBn6XWT:8CLHGL0MoeVtFumTijCmlKQWDkap8Sh
TLSH
T115752905E7EB4184E8F3CAF5CA2694169A327C549B34F7EF4A80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 1f767e1fe060927240059394d681d865f1a5234ee89e2bda5cb318f30a65457c
MD5 3c8cd5e73a237917afa6f6e3da603ed0
SHA1 25076cc59867a56f00f4c1ab06dd14fc8efed834
SHA512 404e1bdd760bc4219c87ded1127dfcee2467cceda2abb208954de77445f6cf2782d2364d68b13e8a8a188245f30c66261618ad32ffab7baa08fe51ced7e71e1d
SSDEEP 24576:W6DID6p8SXdo8ke5i5Xh6wnBLTHTAcZQ/:W6DID6WS1SZBnHTAsi
TLSH
T112F4F15C637A01F5D0AB903E96920405E6B2B171C7261ACF0BD8C57E5FA3EDCBA39E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 b4e1be4ca141afea9318f0c88edbce6f768d17530f3cc9f989e0a3c7151c4301
MD5 c44e207a6c21b5a076746575eb3812d1
SHA1 61c91fc5d64cbf8ce7616ab0ef8b368f70b198a5
SHA512 a664018c4ec8497531e21db2a56f95929683e912a70011b47f2c5914bed33435eb0f1911abdd973cca8294d30b23ffcc5266a8fb1888dfa5b65807e94b824882
SSDEEP 12288:dG6kyKp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:ktyKp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T15CF41208879449A4F9A80634AA754448BF76B9208F2657CF16D0E72F2F337DCAD71F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 edf213dd22321f340defbdd26fde7af91f79183fdcce32502925658e3a3df072
MD5 232c2b2b5dd1423b30a21e7867e993f0
SHA1 a4927726c965abac7d89a73ded8b24518cfaa23b
SHA512 5b1bbd1c95b51e232f64cfbd5c67292df3ad7a9ac786e4aba99b987679bb47febdadaca2e265c0fd35e82301adde9997de537c1ecc2176ad2d90bd50ab089db1
SSDEEP 12288:LIhp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:Uhp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T121D4235CCA658E64E8840A3135384C0DF7BB73718F2A17CF1AD8AA6E5B232DD5E72D41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 c2ce70546407b51606385e23e14929d1d080fafad90007fd5b691c465a02369d
MD5 1bba9e8303a4c266baf2a9cf7936709b
SHA1 adb60439b0a7771c7777158d6243b41a2acfc6ae
SHA512 3dc09382e6212bd2db981724ed35589773799c942c9df5b2b317ba155b756ce1994a80d55d719289a193fd1e754321757990130808d9638b111e2aa1b8314df0
SSDEEP 24576:tMgdLoTfaidZ/p8SXdo8ke5i5Xh6wnBLTHTAcZQ/:egyTrZ/WS1SZBnHTAsi
TLSH
T1A7558C1DA7EA09DAE2B2D635D8621493D633B4315772C6CF2448C03A4DABEDCAE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 d87fcb62982f47bbcfd8adc2d90b105352ea50f4acbea7c5c3ccf52ecfec21ba
MD5 bbdbc567e60b62a3117f2841a003ab47
SHA1 87e3eee422046e1f1514bd1af0acc1dd865afecd
SHA512 03523470b56c9ae4e1b62df7c23c2120997257454f13fc37e899e5934464803ebf020d2f7efd0530c3e01e14b78b0b6165403ec04a23acd3aa9e318cf177756e
SSDEEP 24576:iPUr+NQUp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:iJQUWS1SZBnHTAsi
TLSH
T11C05F11F66A90CE4E676A13D8995860DF772B462471293CF02E0817E5F63AECBD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1004-524-0x00007FF7EE4F0000-0x00007FF7EE5B8000-memory.dmp

Download

memory/1004-446-0x00007FF7EE4F0000-0x00007FF7EE5B8000-memory.dmp

Download

memory/1004-447-0x0000019A26050000-0x0000019A260B6000-memory.dmp

Download

memory/1004-448-0x0000019A26050000-0x0000019A260B6000-memory.dmp

Download

memory/1512-37-0x000001A1F0C80000-0x000001A1F0D73000-memory.dmp

Download

memory/1512-39-0x000001A1F0EA0000-0x000001A1F0F06000-memory.dmp

Download

memory/1512-40-0x000001A1F0EA0000-0x000001A1F0F06000-memory.dmp

Download

memory/1512-38-0x000001A1F0EA0000-0x000001A1F0F06000-memory.dmp

Download

memory/2544-478-0x0000020FC1550000-0x0000020FC15B6000-memory.dmp

Download

memory/2544-477-0x0000020FC1550000-0x0000020FC15B6000-memory.dmp

Download

memory/2544-553-0x00007FF65E280000-0x00007FF65E3C9000-memory.dmp

Download

memory/2544-475-0x00007FF65E280000-0x00007FF65E3C9000-memory.dmp

Download

memory/2548-58-0x0000021B2B4F0000-0x0000021B2B5E3000-memory.dmp

Download

memory/2548-60-0x0000021B2B720000-0x0000021B2B786000-memory.dmp

Download

memory/2548-59-0x0000021B2B720000-0x0000021B2B786000-memory.dmp

Download

memory/2780-576-0x000002B783A90000-0x000002B783AF6000-memory.dmp

Download

memory/2780-575-0x000002B783A90000-0x000002B783AF6000-memory.dmp

Download

memory/2780-574-0x00007FF7D5BA0000-0x00007FF7D6070000-memory.dmp

Download

memory/3144-570-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3144-484-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3144-490-0x0000000000990000-0x00000000009F9000-memory.dmp

Download

memory/3144-485-0x0000000000990000-0x00000000009F9000-memory.dmp

Download

memory/3204-15-0x00007FF7EC4E0000-0x00007FF7EC602000-memory.dmp

Download

memory/3204-64-0x00007FF7EC4E0000-0x00007FF7EC602000-memory.dmp

Download

memory/3204-16-0x000001E0CB9F0000-0x000001E0CBA56000-memory.dmp

Download

memory/3204-17-0x000001E0CB9F0000-0x000001E0CBA56000-memory.dmp

Download

memory/3204-18-0x000001E0CB9F0000-0x000001E0CBA56000-memory.dmp

Download

memory/3248-545-0x000001E611A70000-0x000001E611AD6000-memory.dmp

Download

memory/3248-546-0x000001E611A70000-0x000001E611AD6000-memory.dmp

Download

memory/3248-544-0x00007FF79D000000-0x00007FF79D194000-memory.dmp

Download

memory/3392-28-0x00000164FE5D0000-0x00000164FE6C3000-memory.dmp

Download

memory/3392-29-0x00000164FE6D0000-0x00000164FE736000-memory.dmp

Download

memory/3392-31-0x00000164FE6D0000-0x00000164FE736000-memory.dmp

Download

memory/3392-30-0x00000164FE6D0000-0x00000164FE736000-memory.dmp

Download

memory/3676-465-0x000001F410290000-0x000001F4102F6000-memory.dmp

Download

memory/3676-464-0x000001F410290000-0x000001F4102F6000-memory.dmp

Download

memory/3676-533-0x00007FF6CF0E0000-0x00007FF6CF1F9000-memory.dmp

Download

memory/3676-455-0x00007FF6CF0E0000-0x00007FF6CF1F9000-memory.dmp

Download

memory/3896-267-0x0000000008C70000-0x0000000008CD4000-memory.dmp

Download

memory/3896-268-0x000000000F420000-0x000000000F49C000-memory.dmp

Download

memory/4584-526-0x00000218398F0000-0x0000021839956000-memory.dmp

Download

memory/4584-525-0x00007FF6C69F0000-0x00007FF6C6AA3000-memory.dmp

Download

memory/4584-527-0x00000218398F0000-0x0000021839956000-memory.dmp

Download

memory/4664-515-0x00007FF79CA90000-0x00007FF79CEA6000-memory.dmp

Download

memory/4664-517-0x00000252D5B90000-0x00000252D5BF6000-memory.dmp

Download

memory/4664-516-0x00000252D5B90000-0x00000252D5BF6000-memory.dmp

Download

memory/4804-506-0x00007FF7AD8B0000-0x00007FF7AD95D000-memory.dmp

Download

memory/4804-508-0x000001F92E500000-0x000001F92E566000-memory.dmp

Download

memory/4804-507-0x000001F92E500000-0x000001F92E566000-memory.dmp

Download

memory/4996-555-0x0000022C7D5F0000-0x0000022C7D656000-memory.dmp

Download

memory/4996-560-0x0000022C7D5F0000-0x0000022C7D656000-memory.dmp

Download

memory/4996-556-0x0000022C7D5F0000-0x0000022C7D656000-memory.dmp

Download

memory/4996-554-0x00007FF7B63A0000-0x00007FF7B66C0000-memory.dmp

Download

memory/4996-562-0x00007FF7B63A0000-0x00007FF7B66C0000-memory.dmp

Download

memory/5056-55-0x00007FF7EA080000-0x00007FF7EA1E8000-memory.dmp

Download

memory/5056-53-0x000001B43A720000-0x000001B43A786000-memory.dmp

Download

memory/5056-46-0x00007FF7EA080000-0x00007FF7EA1E8000-memory.dmp

Download

memory/5056-47-0x000001B43A720000-0x000001B43A786000-memory.dmp

Download

memory/5056-48-0x000001B43A720000-0x000001B43A786000-memory.dmp

Download

memory/5284-566-0x0000015795C40000-0x0000015795CA6000-memory.dmp

Download

memory/5284-565-0x0000015795C40000-0x0000015795CA6000-memory.dmp

Download

memory/5284-571-0x00007FF7B3DD0000-0x00007FF7B405A000-memory.dmp

Download

memory/5300-110-0x0000014601E70000-0x0000014601F70000-memory.dmp

Download

memory/5300-97-0x00000146001E0000-0x00000146002E0000-memory.dmp

Download

memory/5300-96-0x00000146001E0000-0x00000146002E0000-memory.dmp

Download

memory/5300-109-0x0000014601A50000-0x0000014601A70000-memory.dmp

Download

memory/5300-121-0x0000014601C70000-0x0000014601C90000-memory.dmp

Download

memory/5300-142-0x00000146146F0000-0x0000014614710000-memory.dmp

Download

memory/5300-98-0x00000146001E0000-0x00000146002E0000-memory.dmp

Download

memory/5648-458-0x00007FF7EE4F0000-0x00007FF7EE5B8000-memory.dmp

Download

memory/5648-543-0x00007FF7EE4F0000-0x00007FF7EE5B8000-memory.dmp

Download

memory/5648-459-0x000001A425340000-0x000001A4253A6000-memory.dmp

Download

memory/5648-460-0x000001A425340000-0x000001A4253A6000-memory.dmp

Download

memory/5660-536-0x000001E80E060000-0x000001E80E0C6000-memory.dmp

Download

memory/5660-534-0x00007FF7F99E0000-0x00007FF7F9C83000-memory.dmp

Download

memory/5660-537-0x000001E80E060000-0x000001E80E0C6000-memory.dmp

Download

memory/5760-7-0x0000000000E90000-0x0000000000EF9000-memory.dmp

Download

memory/5760-1-0x0000000000E90000-0x0000000000EF9000-memory.dmp

Download

memory/5760-0-0x00000000026F0000-0x0000000002858000-memory.dmp

Download

memory/5760-6-0x0000000000E90000-0x0000000000EF9000-memory.dmp

Download

memory/6096-496-0x00007FF701B80000-0x00007FF7022C3000-memory.dmp

Download

memory/6096-497-0x00000290BFEC0000-0x00000290BFF26000-memory.dmp

Download

memory/6096-498-0x00000290BFEC0000-0x00000290BFF26000-memory.dmp

Download