2b05de7f3ea136e3fad07b899224406b7074f65bb44ade194113e6ee2a443d88

Analysis

max time kernel
138s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_13ecae6012be85218fb3fbbb084b9ae7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Size 770KB
Sample260708-fm7dfabt41
SHA256 2b05de7f3ea136e3fad07b899224406b7074f65bb44ade194113e6ee2a443d88
MD5 13ecae6012be85218fb3fbbb084b9ae7
SHA1 d5e4c85e10fd9622aaeb3c8e09f1ca7747d1d2a0
SHA512 6ea70885bea9112ec61f3fc17f639c8c5af1b2a54082a8c11bf67c1da3265bec72de2551032f66a2cae86d03fefbb4c3d2c94caca127ee0c5311e5fd02540990
SSDEEP 24576:Ru6hc3OSP/T7Tp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:Rq+SHTnWS1SZBnHTAsi
TLSH
T116F41221E2C0C471E557053189B8CD606EBB7D7A8870450F2BEC7A6E1F733E94669B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 17 IoCs

pid	Process
4768	alg.exe
2692	GameInputSvc.exe
2812	GameInputSvc.exe
4816	elevation_service.exe
5980	elevation_service.exe
4952	maintenanceservice.exe
6092	msdtc.exe
5812	OSE.EXE
996	PerceptionSimulationService.exe
5520	perfhost.exe
6132	ReFsDedupSvc.exe
4684	locator.exe
3444	SensorDataService.exe
2628	snmptrap.exe
6024	ssh-agent.exe
3264	TieringEngineService.exe
1896	AgentService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in System32 directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-08_13ecae6012be85218fb3fbbb084b9ae7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_13ecae6012be85218fb3fbbb084b9ae7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-08_13ecae6012be85218fb3fbbb084b9ae7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-08_13ecae6012be85218fb3fbbb084b9ae7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-08_13ecae6012be85218fb3fbbb084b9ae7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-08_13ecae6012be85218fb3fbbb084b9ae7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-08_13ecae6012be85218fb3fbbb084b9ae7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7d2ec3f5f4cf0ea5.bin	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-08_13ecae6012be85218fb3fbbb084b9ae7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-08_13ecae6012be85218fb3fbbb084b9ae7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-08_13ecae6012be85218fb3fbbb084b9ae7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-08_13ecae6012be85218fb3fbbb084b9ae7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-08_13ecae6012be85218fb3fbbb084b9ae7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_13ecae6012be85218fb3fbbb084b9ae7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-08_13ecae6012be85218fb3fbbb084b9ae7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-08_13ecae6012be85218fb3fbbb084b9ae7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-08_13ecae6012be85218fb3fbbb084b9ae7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-08_13ecae6012be85218fb3fbbb084b9ae7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120750\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120750\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-08_13ecae6012be85218fb3fbbb084b9ae7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_13ecae6012be85218fb3fbbb084b9ae7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2377119455-1173575704-3843639301-1000\{B5986E79-1C34-42DD-B579-305C7F52BD5B}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2377119455-1173575704-3843639301-1000\{7DD887D0-8B64-4AC8-B649-F64C11C1C618}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2812	GameInputSvc.exe
2812	GameInputSvc.exe
3328	explorer.exe
3328	explorer.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5132	2026-07-08_13ecae6012be85218fb3fbbb084b9ae7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Token: SeTcbPrivilege	2692	GameInputSvc.exe
Token: SeBackupPrivilege	6132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3264	TieringEngineService.exe
Token: SeManageVolumePrivilege	3264	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1896	AgentService.exe
Token: SeShutdownPrivilege	3328	explorer.exe
Token: SeCreatePagefilePrivilege	3328	explorer.exe
Token: SeShutdownPrivilege	3328	explorer.exe
Token: SeCreatePagefilePrivilege	3328	explorer.exe
Token: SeShutdownPrivilege	3328	explorer.exe
Token: SeCreatePagefilePrivilege	3328	explorer.exe
Token: SeShutdownPrivilege	3328	explorer.exe
Token: SeCreatePagefilePrivilege	3328	explorer.exe
Token: SeShutdownPrivilege	3328	explorer.exe
Token: SeCreatePagefilePrivilege	3328	explorer.exe
Token: SeShutdownPrivilege	3328	explorer.exe
Token: SeCreatePagefilePrivilege	3328	explorer.exe
Token: SeShutdownPrivilege	3328	explorer.exe
Token: SeCreatePagefilePrivilege	3328	explorer.exe
Token: SeShutdownPrivilege	3328	explorer.exe
Token: SeCreatePagefilePrivilege	3328	explorer.exe
Token: SeShutdownPrivilege	3328	explorer.exe
Token: SeCreatePagefilePrivilege	3328	explorer.exe
Token: SeShutdownPrivilege	3328	explorer.exe
Token: SeCreatePagefilePrivilege	3328	explorer.exe
Token: SeShutdownPrivilege	3328	explorer.exe
Token: SeCreatePagefilePrivilege	3328	explorer.exe
Token: SeShutdownPrivilege	3328	explorer.exe
Token: SeCreatePagefilePrivilege	3328	explorer.exe
Token: SeShutdownPrivilege	3328	explorer.exe
Token: SeCreatePagefilePrivilege	3328	explorer.exe
Token: SeShutdownPrivilege	3328	explorer.exe
Token: SeCreatePagefilePrivilege	3328	explorer.exe
Token: SeShutdownPrivilege	3328	explorer.exe
Token: SeCreatePagefilePrivilege	3328	explorer.exe
Token: SeShutdownPrivilege	3328	explorer.exe
Token: SeCreatePagefilePrivilege	3328	explorer.exe
Token: SeShutdownPrivilege	3328	explorer.exe
Token: SeCreatePagefilePrivilege	3328	explorer.exe
Token: SeShutdownPrivilege	3328	explorer.exe
Token: SeCreatePagefilePrivilege	3328	explorer.exe
Token: SeDebugPrivilege	4768	alg.exe
Token: SeDebugPrivilege	4768	alg.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
1460	sihost.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe
3328	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5132	StartMenuExperienceHost.exe
2044	SearchHost.exe
3328	explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2812	2692	GameInputSvc.exe	90
PID 1460 wrote to memory of 3328	1460	sihost.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-08_13ecae6012be85218fb3fbbb084b9ae7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_13ecae6012be85218fb3fbbb084b9ae7_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5132

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4768

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2812

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5980

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4952

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:6092

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5812

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:996

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5520

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6132

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4684

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3444

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2628

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6024

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3264

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1896

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3328

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2044

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 01d660639b280e0c9dca6a4739784fff00957d664118ab5e84034f2b8911412c
MD5 320d785922cbdf691bfaef169b5ea8d9
SHA1 cb5d4d0f1ed16397fd3de4d2948fc1f8b55da031
SHA512 95d1c84f76469ab3a5e4f22a302404fdc3494b955f3057e6f5209541549d9db46d950cac506f338ef89c78c69281a5aeea0d3bd4e148829e068b572bf0548fee
SSDEEP 49152:pb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnryWS1SZBnHTAsi:/3q6gjB1cNzAz
TLSH
T198D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 242d463dbb1aa75030237d6466ed7656ecd7fd3f04ba29b77cfc4fe15d5e5ce3
MD5 abc5feb352d6b8e2056ce218fdf0c2ff
SHA1 e38a23f5c3e6ca5c4a47cdc12f311726ec5a0adf
SHA512 944dcaa02f4e2110df986fa945b159c73b247776cf582b2260ece12a5daae30a240332368ca7fd68ea04dd3f9bb4f793cd2e19c98c8fc1046ad1cb2334e13c9a
SSDEEP 24576:6XYhztczAnmp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:LtcmmWS1SZBnHTAsi
TLSH
T19605F128A7E009F9ED974239C9A18405FB73B8518764E74F03E49A6A1F233DC5E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 01ba8c00f5268a44b327142dbafb1202740cc4d86e1c4651e7e6bbc4b57a8cb2
MD5 299e91c743d62d2d726814aeea8db65f
SHA1 1c83dde90efb706b9063602e50c93fb587745025
SHA512 673c8dd1ca85903ab1a59e788749b255584b65300276e1b10e4119ee6a2e256d53a4f998184eb898e91e61fa340941a9413d5b8a2c35b5c7872d086f866190d9
SSDEEP 24576:UwusOWjUp8SXdo8ke5i5Xh6wnBLTHTAcZQ:UwfOQUWS1SZBnHTAs
TLSH
T15B05F14967A40CF9E9A642398557C436F7F3B8122A25CB1F0760C75F6F33365AE29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 86fba781cfeac921fe8bb4b84000a75a58cb22edd552b29ca3b8bc1d192435ab
MD5 bf4c6ca10bd3ffe6b29a839c07bd6ba7
SHA1 917e21bed73145bdef44050c0dacbfa394916816
SHA512 335c381cbcf4e29c30284f24fbfcd948bb495434ae1d8b68d7b228f6cac5205e0308c82e9f709d7e9cadc601d400da43490ea4a098b3ea38f9114cccd239dd6a
SSDEEP 49152:+B+taZ3usBWOBr4tEGp0bqx0z+n217aau1glqtWS1SZBnHTAsi:su6JmTxd2dAcNzAz
TLSH
T171D59D13F1DA01E8D05ED478974A9233FA62BC490B35B6DF0A9073562A77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 a3c55e94355b43995400450a3f464554fabb122c8dfc987caa24e8aada330995
MD5 f5ca90fbc8f26c2fc2a8f13965289676
SHA1 16da17fd6b0cbbe1c28a54305a7bccad27705c06
SHA512 3cf39112bc0f4d64ff985fbe3fc0d00579af2d7759dee604e9712dda26334741c27756d2fc5308de149f0b4dd5b0d543599bb323387e04b6e1349dbedeaf7247
SSDEEP 24576:lfwvtk9RX6wkyAITzp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:eMnYITzWS1SZBnHTAsi
TLSH
T1AF35D029EBD848E5E1B7923C99B7460AF6B178691B31C3CF0299536D0E33ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 e392e07524c0ebdc884885b2acf40a9ccc08e81c783a3c207d7115dd212c7062
MD5 62cc6a35a7544616d16b8cecedb8b142
SHA1 92ab06cec38dc066e2fd23923ba2de3b02d49516
SHA512 fff9e01de5e72c731e1754a95c8a853300341b83f396135e18e4ae2fb70be9e0a49427eab4ba300ac6566704247a36e8acfe76aeb7b6b67d454ccbc45dd88119
SSDEEP 12288:jl7enp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:Jenp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T141D42319CF658E24F4880630357C480CBBBFB372CF29474F5658A64E6A726DD9F71A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 dd26602e7378b046100070f0dc19182a7303362a42a8073e69932e3f8d27c06f
MD5 61c8f051d27f30e702784ac093625698
SHA1 cc99c69e13b83381083228ac3c31bf744c6234dc
SHA512 03958c2c22cc71f8ab311538e49f5d15270251377c342ecc492f3d2480c5a5d39c5c81b4887116b63abcae41055b27b513a71ba115ba27add181124f4012f195
SSDEEP 24576:Lgb6bmBIi49WNNFpg1rSvFv7bYBp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:Lgb4mBIBhGFOWS1SZBnHTAsi
TLSH
T11165AE1E22EC02F5E0F9D2B89DAA4417D6B378164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 b57bc8b8639a243ddf97608cd769ed9e1da3cae28fb2eb94c6d258e36d4d0399
MD5 a30009457d028c6482b4fd6f07fed61c
SHA1 e3db9cfca618eb119cbe5807617483e58fd9b27e
SHA512 b2d4563c4570f7905242a11a144a9418afc956ce9bb947a3d378568b9af2a7fc0c03ae76ab4d1ef6a771af7ca79b0d9c1d84243b1c5deec8f85ef511bb3d264c
SSDEEP 12288:7ZGfIp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:tGfIp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T19FE4231D8AF149A4D46847356434480EBAF373708B2917DF06E4E63EAF626EC6F39D41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 1bcf3cb9d45faf26e0b951ea03186ccdd56d7a0c32dcbbd623618925a4574e0c
MD5 63b74634a2e8a95b9deabf5f6c115762
SHA1 7d083b87893c1a826ec35e028ec08d1eec9661f2
SHA512 535ff5f48e840f943c2272810e3e1c4f17612b5a4d658b7880ea87fe1ce5bfdca4c52ad5a7d14abc56789075f6fb2c4348d1dbda5fdea66cca0084d2aa596b86
SSDEEP 12288:S8Jp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:S8Jp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1DDD4234CCE658E64E5C40A3135384C0DBBFBA322CF6E07CF1698A64E26636ED5F75942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 9fd20722369c3b19ea3140067fdc7075a2397578939496a965a7c69786d3c788
MD5 a3d46a9d7e126f322c3d654e06bb1b98
SHA1 8c8eeeae8d5867a2044da0f97801a5f68071707e
SHA512 70a70006abc20da676db1a2099a6e2d863f0828a20d3408dfa08755482bc5fd797d9254868ae5e3228c3a739759a13554ac63d1663256c9c759d8f86365ebec6
SSDEEP 24576:HG88u8FpJqH1Qzria7/m2ozagmQUYinICoaQq1aI:m7ZFPqVva7/ZozJUYIIdaQq1aI
TLSH
T1EB35F12576E101F5E47BD1388A824663F7B1B4250364EFDF0BA88A561F237E14B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 b528ae646d1fcd7cb0061682737e775b1f47f4ad8c2164a0c34ffbc178d4cd2b
MD5 9e14fa40f0869b41be5fa352957ab8e7
SHA1 b29e01bbae3833dd8ae188e8cdedf1b00dca5945
SHA512 d28c167ed9f71fae8b1f8e65aeb90c33b5966e1107a72037cd86a37bb510e526ca54bb5147d43d35db0c466fe0b9b3e0fa4b78792173d1630d6cb82203a29c3d
SSDEEP 24576:iPUr+NQ4Ep8SXdo8ke5i5Xh6wnBLTHTAcZQ/:iJQ4EWS1SZBnHTAsi
TLSH
T16805F11F66A90CE4E676A13D8955860DF772B462471293CF02E0817E5F63EECBD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 40cb6bb0c0eaba557be1ef9ffb6fa6a484379d386e64e7225a9d6a4533d33eff
MD5 c937daebb1cf33715249382feeb3b2b6
SHA1 7eb339991b4fa9d723dc7a820360311ff35af5fb
SHA512 721a69a295cbee5968d191809920076f5ee066459e42e41e4986b9748c959a2366b4a1fdf0c271fed4e44481630659f00b74de362aded622bd30df62f1d15b42
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjEHWS1SZBnHTAsi:OG05lO43bdcNzAz
TLSH
T10AD5BF6E62EC01F9D1BBD17CDA864A0BEBB23415033556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3faddc2010dc7b87419bfba48933e7c43c5d9ab83f38b5d1f5ea7b55e087e267
MD5 396aff40bf3557312602f6ae673fdb7e
SHA1 5d63dc069cefa1208dd5d86e2438a8c54ae3d5b7
SHA512 351ca43a213a0b278d8b3cf01470879b59404d119ae0e1835deb9abd3f3593cac5b3ddfb447ceea34ceefb72091c882b5fcc6ab11a75402f03acad0430830bda
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7FkF7p8SXdo8ke5i5Xh6wnBLTHTAcZQ/:HNc/zEOVHFy7WS1SZBnHTAsi
TLSH
T11F858B1622E901E4F1BBE1BE89779546FAB17865533486CF0291811F1E73BF85C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 9c1590209b3ef46579ac561d2b438b636e38d8f1f42cd9ba093806aa7d5ba1cc
MD5 abd6bdb6431e61067fa85f1066eeb7c9
SHA1 a7fc44aa65e72759ba4c8a247fb483a617992458
SHA512 c07c129adeb6aaab8525563f41fa9efb7589b103b3c77ead04e6c0fba0b8adc886b4e944f554d6b81cc0032ae309b3a28d49d75b2445e9dc418be43ce536c0f4
SSDEEP 12288:+THPJnJP6szeCs6Rl28dFgAozhLAF7mlKTQUYPa/tI/mrcC+ZaBCUv1aIU16:AJnJPbzB4S7ozagmQUYinICoaQq1aI
TLSH
T1C715D03DD2A410E8E4B7C2B4815A1A69FF31386D2F2669C719B4D4353F12FE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 5479710d1caa4b12695531f90f5c06dd848c074354e891667851a3844dee945e
MD5 5b0c4cb0ccb11350fc44bb95d4fc3a4d
SHA1 f854c011f67793992d18e77cc4b7687f9e542b65
SHA512 167674d7a222dbac87e39413602c7e5133f6ec7138dc2400b784073ce5075435533dfc417547565e6b1e93b9a82bf484c7f7c47ccb0a6b5a64e04f1e4681fc32
SSDEEP 24576:W6DIP7p8SXdo8ke5i5Xh6wnBLTHTAcZQ/:W6DIP7WS1SZBnHTAsi
TLSH
T1F7F4F15C637A01F5D0AB903A96920405E6B2B171C7261ACF0BD8C57E5FA3EDCBE39E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 f612ea932f70121fecbc0e4cc9ce38d7a5bef88928bef3a3a3bb6b133191bf67
MD5 a1269e79302481a5442c39499c812443
SHA1 3986d49d33abb3f8fbbe22cbe8f56b9b2c94e6cd
SHA512 5262b3624c2ce5e8cb318f322a4b5c60c4d6d3bcd5f42299fce24c8e5a0948d3380b9402a43da05ebce55a40aaed9190e025b7b4bad697dd69fe992764d576ec
SSDEEP 12288:dG6ky1ap8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:kty1ap8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T193F4120887A449A4F9A90634AA754458BF76B9208F2647CF16D0E72F2F337DCAD71F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 fe6202178291e8666a8e00d1a1a249b5937bf99d98640888419369e751a16533
MD5 ddfb1f0cdfc005c1cf8845c234d6dd1d
SHA1 556908c1915f0656c86a5e73e5e1a64793a002bb
SHA512 e54cfce4ae763fca33440cc5cc480989f3d1ad41ba28479e0c49a8ed55a9ffda5a1e68c8c1b3ae96b8e360d2010c6d99911c03b89ed0eb5ab2fc8741874e3b08
SSDEEP 12288:LI6ip8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:U6ip8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1C0D4235CCA658E64E8840A313538480DB7BB7371CF2A07CF1AE8AA6E5B632DD5F71D41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ddfc096fd30256e882daf800b1c4e05509e1d195c51d981e1cc8304be168ae5b
MD5 d93bc15d614252a7e3023558af7f8a73
SHA1 6d77e3185289603516119aae9b65f46001bd4f00
SHA512 2188c9f87c8fecfc27757304b5f7623e58cb0176643b89de54109b802e0a3cdbd24ddc0d1081776effbcf5b1acfa764ede48dcbaf86d705c2c6c49547e18c1d6
SSDEEP 24576:MTkNvNnaFeYhJNtmZBmEup8SXdo8ke5i5Xh6wnBLTHTAcZQ/:MTMwBtOmEuWS1SZBnHTAsi
TLSH
T11455AF2EAAB846E4D1FAC6749D238516FA727461073253CF5390C13F0E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 988KB
SHA256 139f361ac1d9aa042f3195460e5d12216ef2fa0d1921e1d93aef0dfcc5f5cd16
MD5 6c43f84914571fecd6bf4e59eaf77e2d
SHA1 5a8314e3c2aef457db5d8afa485cda7605bfa6c4
SHA512 99c7bb4c72f164d8632fa4a9061da95234b313a605f5d27aa89a0a415d1b998265ea99ca5d432119db116ad2ff81167ec537f79b535ca42ad9332a11a2acd253
SSDEEP 24576:sD3FHshBIYQgAYKp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:sDVHeBIAAYKWS1SZBnHTAsi
TLSH
T19F25E17DDA9C04E4E57AC17CDA638906F7B234A9072256CB02D481BA1F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 768KB
SHA256 cdf550dd20fa5923812baf08e2ddc8b3c51c5b592215899dc1d19715e8079ed7
MD5 29958f278485d8b8be548734a28144a4
SHA1 097c171afe7fff17a3eca0ae04b8171d53893aae
SHA512 fee4785e33f16288effa6f092b0a9dcb9a207e1b4235b06e66c2a7d3f196a32487f4474724793d379f14c84631df947ac12a8938c9c8a93e0dfd135714f0c203
SSDEEP 12288:JyS6b3IkxjbBz/vp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ4r:b6Uqjp/vp8SXdo8ke5i5Xh6wnBLTHTAz
TLSH
T1F3F4124D87D048F4E4680230A974801DA6B6B9724B7A57DF22D8D67F4F32ADC9A3BF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/996-99-0x0000015EEE540000-0x0000015EEE5A6000-memory.dmp

Download

memory/996-98-0x0000015EEE540000-0x0000015EEE5A6000-memory.dmp

Download

memory/996-151-0x00007FF6EB6E0000-0x00007FF6EB829000-memory.dmp

Download

memory/996-96-0x00007FF6EB6E0000-0x00007FF6EB829000-memory.dmp

Download

memory/1896-181-0x000002B70CD10000-0x000002B70CD76000-memory.dmp

Download

memory/1896-188-0x000002B70CD10000-0x000002B70CD76000-memory.dmp

Download

memory/1896-190-0x00007FF682AB0000-0x00007FF682DD0000-memory.dmp

Download

memory/1896-182-0x000002B70CD10000-0x000002B70CD76000-memory.dmp

Download

memory/1896-187-0x00007FF682AB0000-0x00007FF682DD0000-memory.dmp

Download

memory/2044-341-0x0000021583ED0000-0x0000021583FD0000-memory.dmp

Download

memory/2044-333-0x00000215801E0000-0x00000215802E0000-memory.dmp

Download

memory/2044-379-0x0000021594240000-0x0000021594260000-memory.dmp

Download

memory/2044-351-0x0000021583DC0000-0x0000021583DE0000-memory.dmp

Download

memory/2044-340-0x0000021583C60000-0x0000021583C80000-memory.dmp

Download

memory/2044-334-0x00000215801E0000-0x00000215802E0000-memory.dmp

Download

memory/2628-147-0x000001A52FE90000-0x000001A52FEF6000-memory.dmp

Download

memory/2628-145-0x00007FF736540000-0x00007FF7365F3000-memory.dmp

Download

memory/2628-146-0x000001A52FE90000-0x000001A52FEF6000-memory.dmp

Download

memory/2628-198-0x00007FF736540000-0x00007FF7365F3000-memory.dmp

Download

memory/2692-27-0x000002666B2C0000-0x000002666B326000-memory.dmp

Download

memory/2692-26-0x00007FF7E0D20000-0x00007FF7E0DE8000-memory.dmp

Download

memory/2692-29-0x000002666B2C0000-0x000002666B326000-memory.dmp

Download

memory/2692-60-0x00007FF7E0D20000-0x00007FF7E0DE8000-memory.dmp

Download

memory/2692-28-0x000002666B2C0000-0x000002666B326000-memory.dmp

Download

memory/2812-36-0x000001CC09830000-0x000001CC09896000-memory.dmp

Download

memory/2812-35-0x00007FF7E0D20000-0x00007FF7E0DE8000-memory.dmp

Download

memory/2812-39-0x000001CC09830000-0x000001CC09896000-memory.dmp

Download

memory/2812-75-0x00007FF7E0D20000-0x00007FF7E0DE8000-memory.dmp

Download

memory/2812-38-0x000001CC09830000-0x000001CC09896000-memory.dmp

Download

memory/3264-164-0x00007FF6E8590000-0x00007FF6E8725000-memory.dmp

Download

memory/3264-165-0x000002A06AC60000-0x000002A06ACC6000-memory.dmp

Download

memory/3264-166-0x000002A06AC60000-0x000002A06ACC6000-memory.dmp

Download

memory/3264-204-0x00007FF6E8590000-0x00007FF6E8725000-memory.dmp

Download

memory/3328-499-0x000000000DD80000-0x000000000DE13000-memory.dmp

Download

memory/3444-137-0x00007FF602810000-0x00007FF602C26000-memory.dmp

Download

memory/3444-201-0x00000248D8C10000-0x00000248D8C76000-memory.dmp

Download

memory/3444-202-0x00007FF602810000-0x00007FF602C26000-memory.dmp

Download

memory/3444-135-0x00000248D8C10000-0x00000248D8C76000-memory.dmp

Download

memory/3444-196-0x00007FF602810000-0x00007FF602C26000-memory.dmp

Download

memory/3444-136-0x00000248D8C10000-0x00000248D8C76000-memory.dmp

Download

memory/4684-192-0x00007FF75F300000-0x00007FF75F3AD000-memory.dmp

Download

memory/4684-125-0x00007FF75F300000-0x00007FF75F3AD000-memory.dmp

Download

memory/4684-126-0x00000204B5D60000-0x00000204B5DC6000-memory.dmp

Download

memory/4684-127-0x00000204B5D60000-0x00000204B5DC6000-memory.dmp

Download

memory/4768-17-0x0000012DD6C00000-0x0000012DD6C66000-memory.dmp

Download

memory/4768-15-0x00007FF7AA440000-0x00007FF7AA562000-memory.dmp

Download

memory/4768-51-0x00007FF7AA440000-0x00007FF7AA562000-memory.dmp

Download

memory/4768-16-0x0000012DD6C00000-0x0000012DD6C66000-memory.dmp

Download

memory/4768-18-0x0000012DD6C00000-0x0000012DD6C66000-memory.dmp

Download

memory/4816-47-0x00000160C50C0000-0x00000160C5126000-memory.dmp

Download

memory/4816-46-0x00000160C50C0000-0x00000160C5126000-memory.dmp

Download

memory/4816-45-0x00000160C4FC0000-0x00000160C50B3000-memory.dmp

Download

memory/4952-64-0x000002E89BE80000-0x000002E89BEE6000-memory.dmp

Download

memory/4952-70-0x000002E89BE80000-0x000002E89BEE6000-memory.dmp

Download

memory/4952-63-0x00007FF6707A0000-0x00007FF670908000-memory.dmp

Download

memory/4952-65-0x000002E89BE80000-0x000002E89BEE6000-memory.dmp

Download

memory/4952-72-0x00007FF6707A0000-0x00007FF670908000-memory.dmp

Download

memory/5132-174-0x0000000000D30000-0x0000000000E5C000-memory.dmp

Download

memory/5132-0-0x0000000000D30000-0x0000000000E5C000-memory.dmp

Download

memory/5132-37-0x0000000000D30000-0x0000000000E5C000-memory.dmp

Download

memory/5132-7-0x0000000002770000-0x00000000027D9000-memory.dmp

Download

memory/5132-6-0x0000000002770000-0x00000000027D9000-memory.dmp

Download

memory/5132-1-0x0000000002770000-0x00000000027D9000-memory.dmp

Download

memory/5520-154-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5520-105-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5520-106-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/5520-111-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/5812-88-0x00000240E7DC0000-0x00000240E7EB3000-memory.dmp

Download

memory/5812-90-0x00000240E7EC0000-0x00000240E7F26000-memory.dmp

Download

memory/5812-89-0x00000240E7EC0000-0x00000240E7F26000-memory.dmp

Download

memory/5980-55-0x000001C96AF70000-0x000001C96AFD6000-memory.dmp

Download

memory/5980-56-0x000001C96AF70000-0x000001C96AFD6000-memory.dmp

Download

memory/5980-54-0x000001C96C000000-0x000001C96C0F3000-memory.dmp

Download

memory/6024-158-0x0000028971BE0000-0x0000028971C46000-memory.dmp

Download

memory/6024-157-0x0000028971BE0000-0x0000028971C46000-memory.dmp

Download

memory/6024-155-0x00007FF78E9F0000-0x00007FF78EDD6000-memory.dmp

Download

memory/6024-203-0x00007FF78E9F0000-0x00007FF78EDD6000-memory.dmp

Download

memory/6092-77-0x000001C8CC920000-0x000001C8CC986000-memory.dmp

Download

memory/6092-78-0x000001C8CC920000-0x000001C8CC986000-memory.dmp

Download

memory/6092-76-0x00007FF62D9D0000-0x00007FF62DAE9000-memory.dmp

Download

memory/6092-134-0x00007FF62D9D0000-0x00007FF62DAE9000-memory.dmp

Download

memory/6132-209-0x00007FF6F57B0000-0x00007FF6F5EF3000-memory.dmp

Download

memory/6132-123-0x00007FF6F57B0000-0x00007FF6F5EF3000-memory.dmp

Download

memory/6132-118-0x00000243BC850000-0x00000243BC8B6000-memory.dmp

Download

memory/6132-117-0x00000243BC850000-0x00000243BC8B6000-memory.dmp

Download

memory/6132-183-0x00007FF6F57B0000-0x00007FF6F5EF3000-memory.dmp

Download

memory/6132-208-0x00000243BC850000-0x00000243BC8B6000-memory.dmp

Download