e3c5e3fb1aaef30902846d46438b30e739e144cc72aea0126626901e656443d0

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 628KB
Sample260721-eb17lsd12l
SHA256 e3c5e3fb1aaef30902846d46438b30e739e144cc72aea0126626901e656443d0
MD5 dea0005b782960e46f995d49545ae02e
SHA1 147b47bedcdb4733aec6f33a172632293ff6673a
SHA512 d2e84edbe238a253648384632179425c4f386b19d4b21ed8e689c256488520ab7351a4783dc262353992c8fb1285e9fa06ec38694bff9fadab9cfa664a149fd8
SSDEEP 12288:LAlk3K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rW:LAcKY8fMCBTFKJo4IPpZThwS8K
TLSH
T1DAD4236239D9C032F05752725539E600BF34BDA21D78D24E3B58356F8EB82D5EAB6323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5496	elevation_service.exe
3484	elevation_service.exe
2896	maintenanceservice.exe
1564	OSE.EXE
5228	PerceptionSimulationService.exe
1944	perfhost.exe
5132	ReFsDedupSvc.exe
2032	SensorDataService.exe
6044	ssh-agent.exe
5728	AgentService.exe
1928	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ee54d235c618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000093ebea97c318dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000345d5998c318dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000069162e98c318dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053533799c318dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000036bbac98c318dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000baedb9d9c318dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5496	elevation_service.exe
5496	elevation_service.exe
5496	elevation_service.exe
5496	elevation_service.exe
5496	elevation_service.exe
5496	elevation_service.exe
5496	elevation_service.exe
3484	elevation_service.exe
3484	elevation_service.exe
3484	elevation_service.exe
3484	elevation_service.exe
3484	elevation_service.exe
3484	elevation_service.exe
3484	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3192	2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeAssignPrimaryTokenPrivilege	5728	AgentService.exe
Token: 33	1928	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1928	SearchIndexer.exe
Token: SeBackupPrivilege	5132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5132	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5496	elevation_service.exe
Token: SeDebugPrivilege	3484	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1468	1928	SearchIndexer.exe	100
PID 1928 wrote to memory of 6128	1928	SearchIndexer.exe	101
PID 1928 wrote to memory of 4332	1928	SearchIndexer.exe	102
PID 1928 wrote to memory of 5436	1928	SearchIndexer.exe	103
PID 1928 wrote to memory of 3416	1928	SearchIndexer.exe	106
PID 1928 wrote to memory of 1876	1928	SearchIndexer.exe	107
PID 1928 wrote to memory of 2384	1928	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_dea0005b782960e46f995d49545ae02e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3192

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3484

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2896

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1564

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5228

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1944

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5132

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2032

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6044

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5728

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1468
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6128
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4332
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5436
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3416
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1876
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6f43d599d4f2c36a1b5da62f33728a9964d3f233308b9b21e5cd84bfe3c115e6
MD5 7f988960ca9ec1b90657d0b1fd54fd93
SHA1 d3509fcdf690768fa20a4f782449b02f7c896687
SHA512 8d640ad3aa62ead718b17e7b2637a4e3fef3254c742b1b2415944d4ad3f7858f5adc4b8c4d7d4998991ff393be39fb334da7cc4e79da483d9dcfda0b8b51b0e9
SSDEEP 49152:Hb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnnsZBAqvpZlw:13q6HjBxtA
TLSH
T1DED59D03F2D900E9E06AD178D7469133EAA1BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 a1b9c9829eab64229e63b5e8d911250d199f5df9fda9db917b66d22b24f90199
MD5 a0ad8a43fcd723640bb080ffab8cecd8
SHA1 4d53363715736c1ee06a7018a187731613b53da2
SHA512 02ab6c51bfabf59c4ded67be8571bf9b7f94bc0683dc969580d7672efd3a880701abb95c1bdf4a9dbf0ece11a3521c454efdbc5c5043485f7a41cc12f3b87f0e
SSDEEP 24576:sXYfDtczA6KY8fMCBTFKJo4IPpZThwS8z:LtcJsZBAqvpZlw
TLSH
T12005012977D409F5FD678139C8A2C501EB32B8910764E78F03E4992A5F372D8AE7EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 d5d7f8f4b70840c0bc1fc38ced93769be028e603eaeaff47694e3c1c13b1f0af
MD5 b60c8b67afe1c8bfae4eaba80bd9600b
SHA1 ffb798146b0ccbc4603a6c2030a078d96de691fd
SHA512 81f6e950714e76fb66d97be05623b9a8c11b5206ce66a1459b055c87da99c450a68104aa1322d3ab9eec7915810cd1e5d0ecda523b8aafd52bfe172aede60bc3
SSDEEP 24576:B0Le5ji0hmxirM/KY8fMCBTFKJo4IPpZThwS8e:BPji0AcQsZBAqvpZlw
TLSH
T16E359E66F6748331D073C0B9C5D2A69EED7130861B308ACB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5b7ed7bffbf56ada1a7d75849404e9e2c3edce58f13d47121d7a4c5c1510a07c
MD5 028a47dcf6a9052e9dcc6fba9274c3d8
SHA1 51feba46bd3ee14c0a415a78655bea9c3d445cb9
SHA512 d95347f3c8300d2df86fbc25e917f208be20763b8213e61b3d27155ad7aa614a7d5209d35adc420f004ef2441928316753cbb051fb49e6c3e84c8c3cae477fa0
SSDEEP 24576:ha7/ezSC6vUyD/aqgrvWE6q8wyuZKY8fMCBTFKJo4IPpZThwS8F:g/ezSC6vUzPvxHjycsZBAqvpZlw
TLSH
T11C755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3690d219422c84cab57f8386b475de46b60a030b0073796118596e0bdceaca3f
MD5 3cf193e6c14bb0f53cc3ba4c52c890ec
SHA1 8e8502ba387449d066a993e65c419b8e9f3c0282
SHA512 697d359b57236ec0eedede697cc4989eb2df1828ca9fed95bb3b532ef93c9ddfc37291182145ee122a952fbb89677d126215a9ee35bc12301e756d2e6a0bc05f
SSDEEP 24576:iVbqPb88hv/l+6+KY8fMCBTFKJo4IPpZThwS8g:iVO88hXl+LsZBAqvpZlw
TLSH
T162559E66F5748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 e684b43971c391d49049371e3f59564c6a8dbadc25611cdf8ea3817774c0e211
MD5 2dd62ad274b91a3c7ac89d105a73d4ee
SHA1 50576b0aad0b6458d0d59053e11320c5f7e3c89b
SHA512 c0a7f2295a0884d68f4d9db45038222f5085a838e155ee13e2b3f6296d83580f1fa621af614e51cf7f5798aa7f67e273e93963cb931f22bcaf998fbe1e7cfbee
SSDEEP 12288:bRzK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74ry:bRzKY8fMCBTFKJo4IPpZThwS8W
TLSH
T1E1C423A61E495192F2478573A16EFE08BB70BD91084CE7081254B85FD8BC5DAFAF7342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 d8f62f05da6095c6434ea935382f7e3860dc5a37e791f12d3e467fc39bf14f2a
MD5 08a3fbe9e7639505b0724847211e8305
SHA1 95f95787ee29d4500ae9fb90fbd14da8390feb51
SHA512 89ae00cd2d2181f45c0d2999699ade38b67aacaae679397557812e2109f17c5efae47b482a8030849509e32222064ced07b6e0d76029a7ae693f44eff6bd38eb
SSDEEP 12288:LeBNUbTVO86U2K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rF:LJIU2KY8fMCBTFKJo4IPpZThwS8J
TLSH
T18205CF3BAE28FCD2C27A8DB95691C600E77278704F11A3CBD164C20EDE275E15E7AD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f67b6923d8fc35dc8c4475ddee3e34f4f516b3ea04c2619773961dfe515f6725
MD5 f295bf0be250c86ba41539533e291f50
SHA1 58f4a921d5c4fccd45fc66e8681f5182cb6d6ef6
SHA512 6137bb7c637b263a5312ebe04ff6e42ed90dcca8d6b06efd5d6a11ca596f88b72178cfcd5eb9267a39a8d6f242c0ad292acee10392f583fa74c04ca55207fc47
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH0:OQvGAdlCEL8c/yRNw5C4tA
TLSH
T102266C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 749e4f392b6cf66e3dde5be2a1967fd7dd956e4b04b09f0f2a0b05a20921a019
MD5 783f8a89ed593aba78f73886c930eacb
SHA1 b3f28d2d66a73799256bdd5d825f8c2bd15be976
SHA512 6767a50cff5ce8194091c3521af8f2fa2468b2b27024dd63a12dc2514b6eeafcc6ed506aaa7fc7d7126f5f86f8290951fffc98b0e097efd7e6126d7b5546fa87
SSDEEP 12288:pAwSfxL/2Dc34DLLmt0LDQewsAjgK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwj:adewsAjgKY8fMCBTFKJo4IPpZThwS8j
TLSH
T15B15E031FE74E032D27B0DB21B36D706683CB9600B511AC3E3A89D9E99742D26776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9881725563b02389c542b8161c69d17bf3424cc510abbe77bfc10ad2249ee67c
MD5 5368a427c187b2bee4139d8f86d3edf2
SHA1 860cb977eded327aaf7e9ccd79a139af4c761b18
SHA512 468dcb8e41161dd245ab33edf91d2be33ca81e3f40e109d37e716e7f08886d142dd8fadfc84eafdf5307ccab5045087a67243bac29fb9f0c430625a9ee36a3b7
SSDEEP 196608:IUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHj:IUEtQevvqc2W1cpV2EI32j
TLSH
T1E1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6afad894762b6c3e6b26f38057e01c04a27e9d35d3dbb92d0ddb0aa318039457
MD5 28b50f986982b0f57630a6408151f143
SHA1 d0bea7c5970975b99b8f896f80cad3ab0cad97ae
SHA512 e58ad6ca9ca3657e688af572520f041ed59efa471d3d5f2628e14694990cbdab1e19708fda4bc40e648ef55d295d5cb3eaa8fc7d9c4539dff2f214310e1d3d85
SSDEEP 49152:ACbRquA/m2yL5zTfFiV+XenmE3/zAsZBAqvpZlw:JoquVjnm0tA
TLSH
T184D58D0976B8C2E4D1F6C77886A2C647F37178154B34A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 456acf53d016741c4e9381408d6d66466c2f629f1b9674ff73c69aa69bb2f437
MD5 447f36f0f12ae590753194d874149438
SHA1 ebfa31d0e16a2172f84c4ded873bad209284593e
SHA512 230fb8ec868cf5bde041cb89e2a481ac2522de58e7d6199c1fccaed9e078239d0961b681d4dea46fa67a7b58fb9b3abb9598e8a7f8713b7a471165975ee19212
SSDEEP 24576:SAhGLJIFoiwtA5l7S53FKY8fMCBTFKJo4IPpZThwS8P:SAMyFoiq51sZBAqvpZlw
TLSH
T1CA359D81EBF955D4F5B3AA7899B69570EA72BCA65E30C20F2150D11F0E37E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 1c816a18a157fa1d140644243a5be761b74c1258af4c0203064f52c3f7d19cc5
MD5 e7090afc03b828c6f11de69978c7b8db
SHA1 37bbf8f3e934595d142e15685c46cf2240b6e4be
SHA512 ec28ce67e21c16638d11159817ac3c03a017d8ff2bb8919f201393fd53e2a98fcb9e7a5181e6f4425694285c131930fdabfe173a7d7929b768755a7bc4d38c75
SSDEEP 12288:tmw5HEjsChNVBFgl0WDm+C5K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rX:IwuoOW8KY8fMCBTFKJo4IPpZThwS8z
TLSH
T1E205F14A36A40CF5F5678139C697C535F7B2BC022A25DB1F1360C65B6F37261BE2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 b923a3c801e00c4a0d86d5318842ff0f9a73f0c18b9f6adcffefaebf2c615ee4
MD5 8466428aa75ad078e4f200f5683615ab
SHA1 b62e5dbcc0862b5422e8e61b0c916842ffa64d0c
SHA512 1516f1e1444ad7ffd332181d4f8bad4bb5ae90272f6a9bf0fe69ee38694db8df3e2ac2fc4423e537f7a8a34a9ce63174960905f5276c09a778108324c9559077
SSDEEP 12288:tBZ1IywK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rN:LZu3KY8fMCBTFKJo4IPpZThwS8Z
TLSH
T18DE422AA37D420F2F1538139C9F99A04F7707892173583CF1224556E5F7BAC6AE7A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 73ea44fad30c5905890948ceaccf2d19a3d49ffac4e5d80d8794ad078d23f02c
MD5 512597de9d84bd8fc925ea97576295e4
SHA1 9a33320cc434750534c25cff43b5ef9d52bc67cd
SHA512 61ce126d265d953508aa14ef868183e0e22fbd64bb8b884a16da3d55431d2897aaf0b5c5b3b96966c94d0bf7f321cade3e6ced77d94170407e8fa280d9a28fda
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uo:QQRQyi36YOcPQLvw2gAf+PN3FtA
TLSH
T12E667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 55b141920d1c29fb9a7e942b9e143f6afe1379070b3630367e120e182d49b014
MD5 05777053b9f7dff51bb150aec096e508
SHA1 e7fcdc80bddb84f0d52b942066bddb64fa194a10
SHA512 afda1215c870a5518222163aba333b788f08e4d95e883e5eb6b52e31cc22ef835eb7c43e4eb331b2f61e86ce0b2d4ed7e53b4a789e58a1673c923b910101ee09
SSDEEP 49152:Bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uo:IQRQyi36YOcPQLvw2gAf+PN3FtA
TLSH
T19E667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b19243aa906f0d78f1065e379a2c00dcf788b4b075027973d2f7f22984ff0550
MD5 1ea80516fed5f13225e5c33460d57bc4
SHA1 4a19abba6a0e7f61f3f6e08414200e36d62cb67c
SHA512 3a71478da230e1bc3442f8ed686ee2a68d70052cbccc4da281fada74ebaf4aa8f2acac6d61e5d0330b80e68e6a0f134a824cdb65bfcb315a038bd0ea402e7f82
SSDEEP 24576:4wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0nKY8fMCBTFKJo42:e68Qg55nhheWu7PNU3/QsZBAqvpZlw
TLSH
T19DB55A33B2F60099D44DE1769F4A972196E17C718FE0E3DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b7410f11aa77c9af1a51ce0eb9e1acf8a622ea2787df6baf157982b48882b5b1
MD5 6862c4e111e8d047207d3930576eb7c6
SHA1 46bed7f6ab4c01e32b6080b2007910633a3251a3
SHA512 dd7a99e7b11fe7597beb600976607c32903cee5933fe1d6f9a699b5c041f960257dae1d5df3b35ebce556482f6c14fd72756d77a9b9e639e3411feaf899bb1ea
SSDEEP 49152:H3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99G:qy5112gYy5azzVvL69nLKnhZKtA
TLSH
T1DC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e68c404b66dedd9d6d8ce6b5d27e1c7adc85065ee070693682edd8c28601aa2e
MD5 ec5a765d61d2ee6b086644a4a47d618b
SHA1 b2437a401ecb36eb35c47b8ce645fe2010335216
SHA512 b0abbb31daa79a0c968d0bc0acf0033c29a589d5fdfc689de5faa5f9e506e6e5248162b0de412883062bdffc4713a57826763df66eb56a0ea8de56278a78c562
SSDEEP 49152:OB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glqsZBAqvpZlw:cu6JmVxd2dttA
TLSH
T16CD59D13F1DA01E8D05ED478974A9233FA62BC490B35B6DF0A9072562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 043d30e650bf6b0801a0bcd61a216f63aa5ec9206e29b4349c2482ef7e2459f9
MD5 98e452d5a5adadb5f06078928f72e3f5
SHA1 c704155c8b9383e854f704d73bc334e046d15c33
SHA512 450b8659bfb8a38ea5b95869137fa689fd9e8469c06c17f73a3ff078303f2e5fa5b4429fe70fba3ade882e0937a76cceb2591469475d8420d2d89ed78f4f8182
SSDEEP 49152:Q1hpsNoJpF1A6UU44CwH7R4xWsZBAqvpZlw:QmifPbR0tA
TLSH
T164B5BE13F2D900E8D05ED178875A9632EA71BC460B34B6DF0A90B7961F7BAE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d65015ce08f1e354d60fea781d05064e6f655a06cf68d686469d8c8f7750249a
MD5 db4d363e91a936dcc515103ae2871fb2
SHA1 5b2c9f264b99d565b9a8a2166a17430b33a41055
SHA512 d0bcb7ccada54d20e665c152d1605b1f3436ba99229f983cf3a493826c56926e4460e3c313e0866a39f73effdbc447fcf53c36da83affe09c7592e5c8f10fdd3
SSDEEP 49152:+SuZQIY0Be2KRRVtOnks6NMHq3sZBAqvpZlw:Q5dKTi61utA
TLSH
T190C5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 65e0a2f1d0b565ede7cacb5102a44fda7fc7705bc943f345f769f04e1df83de2
MD5 816655d6d121d34b4c316a7aeafa22d1
SHA1 f690c214c1ac782454e1379bf072f97d247d71f2
SHA512 f5e48bbbdcd939c7f73052fd1fad64c0b2b9399819583cead9a685485d008e742e5a944c22f3c1c1ae81171c214185efb006a439f75eb7d3cbac85933ca22de8
SSDEEP 49152:chtSn8EApI0figngiDn0AP5w6sZBAqvpZlw:dX2iyphwtA
TLSH
T19E95BE13F2D900E8D05ED175C7568632EA72BC160B38B6EF0A90B6561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 dee1b5d4215983ceffd10eb675cbd702797b3f27415c3412fafffb7a422d0ed9
MD5 94478ea0cdea6575469814352dfcfbf2
SHA1 46750674903e3889efa6caaa5e6aa24ca72657d0
SHA512 4aeb18199ee885bfaf4ec370f55f0f9d899328a89744e5f6671c185d91872955280f4e41911edb73c7911fb1727cc2018a23dcb673bcd3b05ad30417f389304d
SSDEEP 12288:1LK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rx:1LKY8fMCBTFKJo4IPpZThwS8d
TLSH
T102C423AA1E494192F1078173E16EEA08BB707DD21908D34C3358B41BE9BD5DAFAF7385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 a52afdfba411705f50e7dd007da8e6c811803f7ba5832ec33f7f05508f00583d
MD5 d20e1d7966803253d21e237ad9797dc6
SHA1 11e5fc0b42fa42fba6406cbc015962f23020c791
SHA512 b34917309b5559da5c25dcda623061e550ff57ae24b0925afdad98403358ec6ba0555f03a1c1f41f86e4cea0ab456ea2eda084d584577af35dce836cbd65f3a3
SSDEEP 12288:MEK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rx:MEKY8fMCBTFKJo4IPpZThwS8d
TLSH
T113C423AA1E494192F1078173D16EEA08BB70BDD21908D34C3358B81BE9BD5DAFBE7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 5ba023c5431c6eb8fb922fa76c0c0f31956e01f0e0d1c0018efdc00098dd44e3
MD5 49f173c133d80191cd410ea97384ce23
SHA1 1d41925995f635406d369f4a69d7cf3d2b986f25
SHA512 01a1e0ec0f65916440e15d54973c7ab0be8d9fdebea85b7752275830ee3653ab2b287236fbd91787d889ee861ddc743f09a8d50a6b6ba5be294ed8c1752aa979
SSDEEP 12288:quK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74r8:quKY8fMCBTFKJo4IPpZThwS8w
TLSH
T1E7C423AA1E494192F1078073D16EEA08BB707DD21908D34C2359B41FE9BD5DAFBE7385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 ec2931e504a58e81cebdb205906fc6a116492096bb9a2047d8f2ca74a7caf422
MD5 85618bfdefa8def8f21574c1c4e327df
SHA1 75131ef913ce1c5a3f00d8ea1ec2b106aa94240e
SHA512 18ec439a7f5015d3dcdd768b848e380cea57f22432ab630f327f70effac8f60c5eea83e79992d021b4fb1cc6a719e47fefc11b174fe7bb475f2b71910d63b5bd
SSDEEP 12288:GVlK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rd:YKY8fMCBTFKJo4IPpZThwS8R
TLSH
T153D423662F5901D2F017C172D16AEA04FB70BDD21A29E38F2700681F9DB92D9FEB6741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 0722112b17167a41a607f27f343424d2ab78a023231741063dff3bd0802ec671
MD5 ba4561deeec607bcfc8612fbd1b001b9
SHA1 18a7409ce5f537b63ae7d248bb9aac4e17853de0
SHA512 b79c523f9c5054f1eeac5d2315e6865539c3637b3535e3ccd4a311feb8c7b48e57a1a97f51dd2d6a87b5c51fa932fbd804f0d8a20be2a1ffcdf45bacb5150dbc
SSDEEP 12288:VNK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rE:VNKY8fMCBTFKJo4IPpZThwS8A
TLSH
T19CC423AA1E494192F1078173E16EEA08BB707DD21908D34C2349B41BE9BD5DAFBF7385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 83264807f9e7d1b37e28a36e18e59ec537dbc64441e472e7d07247c7e8165ed7
MD5 a97443b5c3e112976521f7965696e0fc
SHA1 e70effb29a24779ff55276888578395cc9cd7f30
SHA512 a1f2fb9fa174df5684aeac2008684ecf57695943949caeec9d5d95123e1a6ec48fce16c0d8e1ff3826eca03b72022f24d38e5af0ad39397faea5848a0b9fe971
SSDEEP 12288:94K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rY:94KY8fMCBTFKJo4IPpZThwS8c
TLSH
T1FDC423AA1E494192F1078173E16EEA08BB707ED21908D34C3358B41BE9BD5DAFBE7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 d2961e5e5106bbcd63005557f6875a149c432517e2c226e0c1d56c6bc7fd178e
MD5 f99f5c604e2802f736d1d2fb218752ba
SHA1 c84d0abadd742490047f5f00d6ae318e92c52a6c
SHA512 f33ea5bfc15b9d14f4c16fc0246d0d6410a437524ba02f0e5a127c4d22872b390ee530d6c1d3a93a99152897aed3e97ccb8e3d21314c44b1985795a2df5ac8b9
SSDEEP 12288:csK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rA:csKY8fMCBTFKJo4IPpZThwS8U
TLSH
T1BBC423AA1E494192F1078173D26DEA08BB707ED21908D34C3358B81FE5BD5DAFAE7385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 de6eba96b012c1ad7e189d1a2760ed739da1156d660bdaef1cf011bc25f2550e
MD5 36c291198ba04e51887e7be2fbb822f7
SHA1 e1ed73036c4ada4937c747d37415f6f7c5ec5570
SHA512 efe9472eff7c1ebf2ba7fa18b5995f5c24086412357953ea9835375cf4165a07e07327e84b5248459186771d3b0f2f11c7e215d7098c14157f3599b616596b44
SSDEEP 24576:7ZMSzFVSOkKY8fMCBTFKJo4IPpZThwS8d:7ZMSzfIsZBAqvpZlw
TLSH
T1340501A5739008F4FC67813EC9259905E6B1BC5A0B60C70F13A8362B5F773A16D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 fc0fad19aea3d6c14e976068224c3af839a4b13733bfb2afc3d1e062bdc52f62
MD5 aa6876d646a259e8b6fea6eba296f6a0
SHA1 396a3c581eee5fc89aed1d2c1aa048a77dc48065
SHA512 2a2f8feb646290d7429ed8a258e6890c10813d222942e77031c37b8a8dc9ec4534698164a0f0d5845bbd36f6e6b9146b9b345b458d3b4ebaf1d557652f2e434d
SSDEEP 12288:0HK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rB:0HKY8fMCBTFKJo4IPpZThwS8V
TLSH
T152C423AA1E494192F1078073916EEA08BF707DD21909E34C2358B81FE9BD5DAFAE7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 949aed7f4bb9e91cf3911bb87425926cafac0255a0d93022afba0a304de1ac58
MD5 8782630c8215126f9739c34ebb42a63e
SHA1 a68b210db9eaf77468ff37001fae5a02a81ad1e3
SHA512 1ca0cf14f52436fbaa8c0a88d01efdec98408ab4fa1e54cf7a672bdbd57f998620d5c173f481af4517a52f8d9ee697fee17a86be58ef1ca7d7d0f715864a2cd2
SSDEEP 12288:rDK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rB:rDKY8fMCBTFKJo4IPpZThwS8V
TLSH
T10DC423AA1E454192F1078073926DEA08BF70BED21909D34C3358B81FE9BD5DAFAE7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 332b8d8e48732ccf55298a102adaa363b76ec8ed6e98f44c25158cf0c13af9a5
MD5 13f5652b287b6786cef75b371e359e56
SHA1 680c74197f7a7dd5898d7260d587773acd5c481c
SHA512 f566026334ac3190691f60bee2c22a183bafe0fe3e83264bafb282c448046b048dc0f23cbb4dec44dd096c5e8ea1a0c39dd2f063587cef08dfdc7a0df943e6a7
SSDEEP 12288:oyPz5L8wK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rD:pzywKY8fMCBTFKJo4IPpZThwS8X
TLSH
T1B9F4125737A130F5E1278235C8665A01F770B8720B24CB9F13A4567B6E3B2D1AE7BB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 2a46eced0a90d7139629b67e6ebfed991a0caea9a201df58ee3dadfb4428c38b
MD5 5449021e8411015b6e7de83f218c58b5
SHA1 ff1246cd1c5a941c221c39847a6f12c17bd5eaa0
SHA512 a467839b5efcda412b1df68c73ab9909124c193115f93578fac4b6e52132e98b5009042e1be693011d308e82491e47e488529906a45e758b3d101719f3eed5af
SSDEEP 12288:QHK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rB:QHKY8fMCBTFKJo4IPpZThwS8t
TLSH
T1CCC423AA1E494192F1078073D16EEA08BB70BDD21908E34C2359B41FE9BD5DAFBE7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 c5d1c7e97baf601d77ef6867056f61e74ade16cbb00d19e2a9e1fd3113fcb344
MD5 00e366dcbcd3d90ddd20313c18a63fed
SHA1 29388160f1444b418c6753a8f54279034e05eae3
SHA512 f5db2c8030600f7003e2b460bdd0848194ce07d8e4451c57868f5f6a4b2e92e4d8f8ac888c2e0289b9f4ee17ff591e63d8b092cb3a956e87604b7b0c3b48c67f
SSDEEP 12288:BHK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rH:BHKY8fMCBTFKJo4IPpZThwS8j
TLSH
T17FC423AA1E494192F1078073916DEA08BF70BDD21909E34C2349B41FE9BD5DAFBE7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 6c2d9792f4691649807a5a7c02fe8cc3af598c4eca0bc3f052ea3572a1ef4d8d
MD5 a69da444174916b50e1bf7a0a164944a
SHA1 876a6d2b0aad124ae4edb7f1c3b1ce03e6b03127
SHA512 5f82ec4129f5a9a279e7e13d457a5c842d31e77cc0c59a3a294bd731e8b15b16b83659614d194dab7885dae56d51c1d1073a463aceaa78c2f626aaaeac96e473
SSDEEP 12288:7yPz5L8wK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rf:2zywKY8fMCBTFKJo4IPpZThwS8b
TLSH
T1E1F4125737A130F5E1278235C8665A01F770B8720B24CB9F13A4567B6E3B2D1AE7BB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 1e66b7b5052ca9724294656dc85d6b00d9dba33196b6cd50cc00fe841e1119ff
MD5 67b858fa5855ec92181d9210dfd179b3
SHA1 4ecf6ea6b3218d42abd4741d1129598989f1f226
SHA512 0039e30ce5323c326a03cc66db8d8f91c7ff7cfd65bea825bc58aa5f449698b2d6d9744a7afadd9f92587fc1a8d30f334e3a593e68e5e72ab9b9d3f05f25bdae
SSDEEP 24576:XTHaLl3z0zDeKY8fMCBTFKJo4IPpZThwS8S:XT6LljZsZBAqvpZlw
TLSH
T13D0502A5735018F4FC67813EC9268906E6B17C5A0B60C71F13A8362B5F373A16D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 4bdf207907a32caf38ccb8134ac939b749664cb9cc66a0a9bb7004d563a0905c
MD5 061bbc9aeb4e38ee751a1b2733fce81e
SHA1 f382ef6545985dfca9355db83926a47ac2f37f81
SHA512 e809734e0b12b59668b8f1a74f4d3bb4279140d235a13e74d6613a9e7bce8f704a0a7c96956f3679cfc14b5910092ce7922e17dc8b48927772c50e31452435c8
SSDEEP 24576:b37d9CHKy7GZyKY8fMCBTFKJo4IPpZThwS8k:77d9CHKyaIsZBAqvpZlw
TLSH
T17E25CF90F3E410E4F0B7CA35C9769511DAB67C9A1B31DA8F03A8651A1F336D19E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 91ca6547f4c748bcd96eb0b77b426996fc4ddd03350a09a8fb1caba586cf3ed6
MD5 6776c0de0454a75aaf543b0f78df674d
SHA1 98c10d23274f4473344b5d7723bc1b99f5778a75
SHA512 94711d6585e5796df9a3eb5afdd57b75f532e6d55ab2cfd251336470eb4277b5eacb05a71590d82aa330c0be8f63c6908f95a8373d7024b889c83e18e755a519
SSDEEP 12288:qOK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rY:qOKY8fMCBTFKJo4IPpZThwS8c
TLSH
T1F5C423AA1E494192F1078173E16EEA08BB707DD21908D34C2348B41BE9BD5DAFBF7385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 6d05db1e83a978d3931ae47b55b06df17972de4e947a457add69482c2c12c8b6
MD5 4d1f57e276ad5a95f257b6c0d15f3709
SHA1 e2f74d15b261bac1f1660a1b990224ace08dd468
SHA512 ca68d0bed28414b6cb89c81aa33a1d52d7b48f22b8822e8dc605e02e7cc2c64625747d70f53c5fdc8ef27184a591bbe447fab65b24166a6d87f1096f988aaf55
SSDEEP 12288:kQK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rB:kQKY8fMCBTFKJo4IPpZThwS8V
TLSH
T1AEC423AA1E494192F1078073A16EEA04BB70BED21909D34C3358B81BD9BD5DAFBF7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 02e977d7f22efeaaf90261c06a5437cb59134ff413092a110602598a76084e48
MD5 7a20a1d7d25b00a879fbd93d21a9e55c
SHA1 a9a1e91fb4851b03ec8d68a3786c0b277a0ed4f8
SHA512 63724f377d9b229307e8a754b2c8f906f0b9df4ba2f99ead79fb6ef6929ab966f686d89a5ef4433f62d58c34500bbe826f99387db77d4e1bd4cf5b375ce7d7fb
SSDEEP 12288:KhK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74r6:KhKY8fMCBTFKJo4IPpZThwS8G
TLSH
T165C423AA1E494192F1078073926EEA08BF707DD21909D34C2349B81FE9BD5DAFAE7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 bb7187a3d4c6e6c05f3a6c68f09d2873bdc892a7833c76ccf247b39c6eb1adfc
MD5 2e7b5b275120e663a7945c5e8da0c581
SHA1 51c9e05e40e462b43733bcd7800104bcaefbb8bf
SHA512 c21e93533b5246a733c3d10d865bdd6518c9252417fd260ca2ee575669bae5f1f2b9f1eb8da067b6ddb4051a872c19e4d063d44631715c37fb47dacfde78d652
SSDEEP 12288:bHK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74r6:bHKY8fMCBTFKJo4IPpZThwS8G
TLSH
T198C423AA1E494192F1078073916EEA08BB70BDD21909D34C2349B41FE9BD5DAFBE7385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 607d7a9d0f7ec8c2092454a1a4ef7f60afd1ae33178975d3aec8d58226b51be3
MD5 b6ed2a51383b992a09a007af367e06d1
SHA1 d27399e43f07496f82b95dcfa004d50fce244411
SHA512 b45932b5dace8f4cec336e527ac063139087d2bb58cd68af30dde06f1edd4cbf7047ad7e48dfcfb265f85361c00621c0ef007c03ac7915d4bba315eb48cfdfa2
SSDEEP 12288:YOK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rN:YOKY8fMCBTFKJo4IPpZThwS8J
TLSH
T14CC423AA1E494192F1078173E16EEA08BB707DD21908D34C2349B41FE9BD5DAFBE7385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 d7ed42beeed11baeee52d32d6abd33ca06342909bf9e83550fa20ebe28170fc2
MD5 68671b4b76659825b9e2b580866ab2b9
SHA1 ae13c4b0064a82cc0cc06b747eab86cda1f6d06e
SHA512 0d4b3f0064e63d7d9ed66322b475567a2809c4fbd3722b91425d50fdd1dd1a3e9803506062f9632ed84ae304c7d6d1923b48c5ceb294bd85325c6d0f329c8107
SSDEEP 12288:pvK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rh:pvKY8fMCBTFKJo4IPpZThwS8V
TLSH
T177C423AA1E450192F1078073E26DEA04BF707ED21909D34C2349B81FE9BD5DAFAE7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 7e6965d49637686c7b0ded15e556fcda8035ed0dcf9a9c9d7f65f34a3724bf62
MD5 9077be165150298c3f4a4eb650a4309c
SHA1 1827d6e14dc1eb79f54244905dfc5eef9cc13c89
SHA512 68b7733c892f51f15cb965442ff898dd5189c88d51608b6f13a21a44c9e3b5adac85412cba17baee666fdc5566d4574ccd25c999d02a02588d81ee47d7895fe0
SSDEEP 12288:uNK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rA:uNKY8fMCBTFKJo4IPpZThwS88
TLSH
T1D7C423AA1E494192F1078173D16EEA08BB707DD21908E34C2348B41BE9BD5DAFBF7385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 7b777dcaaf5ec808eec9afe562b145fd6ff98f14b28038c425237fac89245a48
MD5 d1d8c116623427e9083415c4d765d9cc
SHA1 2d0594ce26b6a33259abaa65a49c316f52719a97
SHA512 fe1442fcf8dc3a4b7dcf7d9a6ad09ca442aee003d99a91929bff16836afec6deeb880d813b8aa4ffd147e22f95b538e37eaff3d20f8b53589fcfe6408758073d
SSDEEP 12288:uGK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rM:uGKY8fMCBTFKJo4IPpZThwS8w
TLSH
T195C423AA1E490192F1078073E26DEA04BF707ED21909E34C2359B81FD9BD5DAFAE7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 10858eede22a65d9031888b86eaff9417219ef0a0bf031d82aa6d96b462c492d
MD5 d9201826f8a92f33d5c0110a6f1ea088
SHA1 abbffe9d55806e76927d6eebb775f4859476d6d0
SHA512 2ff7f65e321391c19a0ba9ccadc181112dea86e7985004afefcbdd9c9b3f42f672598401fb9f56253db94163a7309dd7e1f747067e06b8fd5b4288e66fc4ea6a
SSDEEP 12288:qNK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rk:qNKY8fMCBTFKJo4IPpZThwS8Q
TLSH
T152C423AA1E494192F1078073D16EEA08BB707DD21909E34C2349B41BE9BD5DAFBF7385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 7d7954afbb679b0cc6e018ad7922c4564ff2caa41a2c08e85b157e61456dbff8
MD5 858318ce01293fc6cea03c56085c183a
SHA1 b35c5cc4a9d73d1c4e01cbaecfd41917303e6e43
SHA512 843d2787f8435390829b6bd4e5ece3b3fa64c55eefaf11550314612c09b30478b8daae5de9dcd3e52050ff2d372b42fe8e249934f2584d2423af2fb05920b60a
SSDEEP 24576:/fwvok9RX6wkyAITKY8fMCBTFKJo4IPpZThwS80:ZMnYITsZBAqvpZlw
TLSH
T19635DF29EBDC04E1E177913C99B7460AF6B178591B31C2CF129A536E0E37ED4AE3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 91d66b8e6fca9714e312111ab5395502e8760d304bb2925f723259ec3716f205
MD5 8cd741b36d8c12c6328d4267cf851a6d
SHA1 28d62dfdd36b4640ba21b7c4a4c9af92cda484bd
SHA512 8c82caf86619556839d24170a40833898580328916d0f5c80c80a6d66c5819f1115f7b7b9638698ac560285c9530586267f02f82ffc6157a7d1db7cca0e0fbf4
SSDEEP 49152:MYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0asZBAqvpZlw:yySzPltA
TLSH
T1BD067C96A16801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 726a9369e1ee07462d7a62c8b905d83f62160701c88a622feaeb309334c4f2f8
MD5 6b722e7ebd45b3e08b3e132e510caa38
SHA1 8df40cd57d5e06ff9b76dc03dc439c84a2c4fe84
SHA512 fffb4c5cd94e95ca00b7b0b320429ea3eede807fd50e81ad8fd18e64a8c580e6f167c81b0353062e32668512ae2786fb70e3622e44a62ae7b4aead3967a3c3b6
SSDEEP 24576:w47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY0KY8fMCBTFKJo4IPpZThwS84:w47JUQj1irIhCnDHUPfF/qsZBAqvpZlw
TLSH
T19765AE1EA3EC01E5E17A827885158A1AEA71742E1F31CACF1270837D6F67ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 58d692e051f5ae734c0c7babbc625cf1bbc7908823cdf6d66c514f2c1fc41cc3
MD5 980b1c4c53d03174d191a3fd99cc0dfb
SHA1 f22e8c7000b94eb5a2f960d5e30587f8af726dfd
SHA512 3f5bc4f45b9b52a3729be15b58833315b0555bd9c22421f3a72775f521edec1af84a435ac1929f019280de0652f957aac0495bfb8d1d4550ac66d3ff10166c40
SSDEEP 12288:8Nsf3K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74r1:t3KY8fMCBTFKJo4IPpZThwS8B
TLSH
T19FE4F05AD29802E5E06E9176C7569A00B7337C6147E1D3CB23C0F43E1F7A695AEEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 7392c715d9a553c0604938df5010e5db34de357e32eb9d744ee98fc549384436
MD5 179a4fd562eab2da2af7bf594e4b783c
SHA1 6289850030eeb4289ae8d3194bd0e795033fcd66
SHA512 aa2b323f881812ec49095b00c19a50e7d7ba5539a2e0fb381a4024e6a8c5f71f51725d74100b65cc4063d26ae0dac2cf73d1f18b079f0f7a7c167ff7893cc783
SSDEEP 12288:yCOGzsU3fiKVVdE7NgBXoxhg1JdaYXmabeu:yCOG4UPfBEK4WJdNJbe
TLSH
T1E8352850766BC75FC6A940321E36C2CCA7707D41EE05AB0772C8873FD576669BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 9129514e490d65558cb585f1a3dd9f12ce995622713ccedc2d589fd703186d46
MD5 9bae39d882e43b63d2f95b175550ece8
SHA1 737d567be47e9f64a8cae52c0f620ed852680b55
SHA512 bc4762c198916ec8e1210ead31819a362d3a585b825721b6b7c12315eb00506b258cdcf5104e9878c55531288b29270ffd4045660729f2e7c9dbb98de493652d
SSDEEP 6144:k0EYlI03QczVYC36OrrSDOwVk3b41qZ43RPtMx5v2v+vPi8iqizimic+p+j+I+I6:k0zluLku2R5Xq2J
TLSH
T17865D8815137A3DFD1FB6071072A9B4DAB64EC0777056F6673C8093AD82AB25B0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 84117bf673611f29ba08b25a508150c61d88b861fe424051de043fc02eac2656
MD5 5caa549240c81932965bfc1aba5d9d08
SHA1 404e5ad748c630d241ea22d6ebd974b80c8851db
SHA512 6a7132fff2b51ccaee8a3dc696d8493aee651cb19552e7d4525ba8b71059109b851698a63650676d5a1b5821e2d11bb7940cf7a525cd852f59331364b4c5b221
SSDEEP 12288:j07fK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rL:IfKY8fMCBTFKJo4IPpZThwS8H
TLSH
T1DCD423661F494592F02B8572916EEA14BB30BE910F08D2CB7204745EE8BC5DAFEF7346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9f559198a4a2ffb1b23097003f8c4e31c0206c7034e9853b83ba1d843412179b
MD5 96e483649a1a62004279e1903bba01db
SHA1 ba4287c0bc596d233e69ec8e4444358c44f64e6f
SHA512 5a13fe9fb98ca03a25bbc7f2286b495195bfc0caade39587caac683ed809ecf5851107bf0a71ab258203b6ad642a54e3ea94452047f9c2ea018e384dbdcfcd2c
SSDEEP 24576:Egb6bmBIi49WNNFpg1rSvFv7bYZKY8fMCBTFKJo4IPpZThwS8I:Egb4mBIBhGF0sZBAqvpZlw
TLSH
T179659E1E22EC02F5E0F6D2B8DDAA4417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 f2125f1666c7f44887ba58f8ee0b5d98bb085c9c5441cea71a494afad51fc1e3
MD5 a7ba257b460f25d0fa886d886bc23cf9
SHA1 0bcd33072ff77a550ad24714bcd96a0efe93cbd0
SHA512 98cef686d78c14ad070c2d313ea3a53dda1d3be6864b96220f849625ba8cc6ae7da65198a4406de76812a6704286f7eaddfd231f1a4fdfc882c2ee2fcb8a1d0a
SSDEEP 24576:IG88u8FpJqH1bzria7/mkKY8fMCBTFKJo4IPpZThwS8v:r7ZFPqVea7/BsZBAqvpZlw
TLSH
T11435F16577E101F1E07BD13889864663F6B1B8210364EBDF07A88A561F33AE54B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 39eac26e5c79eeffa859ce715326abc2e913cc7c867d4e790a01db899ae7c5d4
MD5 9a40cce9388ed700c31b1615f19704d2
SHA1 97b39294099d516dedddf1d9311546ac6d057a9e
SHA512 ebcae22e84c9d0f0055f2014196f751071f8921d22b7823b58338942aeaddd03d9ad640c46d8d84889163057271526544e17dd8986feccecec1f2f674ed9e115
SSDEEP 49152:sBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4sZBAqvpZlw:PG05lO43bCtA
TLSH
T102D5CF6E62EC11F5D1BBC17CD9C68A0BEBB23415032556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d452a15be606bcd65a91fd92842c07d85aaffd8389b217fd2f0ec2a28ea5c169
MD5 d58d6107ed01c09d7b01414abf6c568f
SHA1 0f645d82b1b20eb018c2f9f469acd310c72b63ed
SHA512 b66236d0f77c2ed6704389f4b0418dd21cef3c1307946ce1e512c13b76b852f166259a66410192665609d696902a3185cac93f42c33434f356be6dafc8758473
SSDEEP 24576:Yfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnaKY8fMCBTFKJo4IPpZThwS8J:ga5POZ3+Jt2pasx2+mQsZBAqvpZlw
TLSH
T1B865AF5EA6EC01D5E179D17DC583861AF5B1346213319BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 df6614fbb160f61cea5f7e7c5bb1fa094a1592bc48c2bfa56e83e6409dd12d0f
MD5 ec2700808279b165b7aea3db7e6b7bc2
SHA1 26d4c1ac2394cab9c0e74f9ca98f91bde85fb091
SHA512 e32aa50cbaa4fb8d9caa43ee5e306c6579274fe10ac9e4cba2275e387042337d2c8c88fffe0a89fa8b75a2ec353e19350bee09abcfb241a7c8ecef5127c2937e
SSDEEP 24576:0NcwHdjbyQ4nLC18lb/EOjowL7FkcKY8fMCBTFKJo4IPpZThwS8K:0Nc/zEOVHFhsZBAqvpZlw
TLSH
T158857B2623E901E4F1BBE1BE89679546FA717865133486CF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 77725408e17f452ee70143a5b45b87dd2674237c3625748428d6fa25c13913b7
MD5 ea20c9155498dc010c85198851ee0cbf
SHA1 815643a4b913446fc5c58c84c6536cafa3d59809
SHA512 c67ac9b7db83fc9be9b99bcfcca7097fffe93c627c4799050c7709b25730692f2302996d46969582c6222b51974ceba6a695bd28c8d026536f3686bf451c5b4a
SSDEEP 24576:T8kNvNnaFeYhJNtmZBmGKY8fMCBTFKJo4IPpZThwS8p:T8MwBtOmGsZBAqvpZlw
TLSH
T11955AF6E7AB806E0E1FAC675CD238512F6727461073293CB5290C13F4E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 c8b6118a2f6b5c47c3b4c1dac3513c953a974b49767df00d06546bf1905fe54a
MD5 1d281d6ed0aa149e7cfdef7a4aa2d5a1
SHA1 bd07841204b483329406972e9ab1abb8f300c476
SHA512 edf6e1280746be734f4db9175685af4e5237c88d15c9a74f62d3bc85784d8989379acb63472db381a12eeb5c271ce9d57684fab209e2cba4f128d244faefdc03
SSDEEP 12288:hHvUrBFrEjwaQIK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rQ:hPUr+NQIKY8fMCBTFKJo4IPpZThwS8s
TLSH
T19E05E12F26AC18E5F676E17D85868709F771B8620711D2CF02D0817E4E77AE8BD3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 499fbe341d0ae4ca2225aaaf121b9e8ce2f274ab8019cb42abdbc3eb72c8a997
MD5 8f336521ec2874b8ff49253001e1efc1
SHA1 f5f0b6e5f709ed30f253245cc6839d099661c04b
SHA512 f13d734f1df54bd1a8e1d5d53f1ad3c1190a072961a66a14793c9423e2c677a10af50b4ee35d0a539cac257ae04d266deecbed5878de003c875fd9baee4506cf
SSDEEP 24576:mD3FHshBIYQgArKY8fMCBTFKJo4IPpZThwS85:mDVHeBIAArsZBAqvpZlw
TLSH
T13025E17DEA5C04E0E57BC1BCD6638A06E77138A9032156CB12D491BA5F6BEE47D3AF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1564-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1564-168-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1564-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1564-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1928-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1928-363-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1928-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1928-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1944-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1944-274-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2032-362-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2032-95-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2032-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2032-325-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2032-360-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2032-101-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2896-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2896-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2896-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2896-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2896-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2896-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3192-0-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3192-1-0x0000000002230000-0x0000000002297000-memory.dmp

Download

memory/3192-7-0x0000000002230000-0x0000000002297000-memory.dmp

Download

memory/3192-77-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3192-307-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/3192-6-0x0000000002230000-0x0000000002297000-memory.dmp

Download

memory/3484-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3484-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3484-106-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3484-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5132-376-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5132-295-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5132-82-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5132-88-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5132-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5132-374-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5228-67-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5228-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5228-73-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5228-256-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5496-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5496-22-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5496-14-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5496-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5496-20-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5728-132-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5728-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5728-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5728-120-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5728-126-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/6044-359-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6044-107-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6044-109-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/6044-115-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download