cd4c9b4d9cdf31448720182fb59c959ea90ea2bc8362cc6e3ab6a3a131a2d8e5

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_31ae9eba692d15ecc295fd503c6a939e_elex_redline-stealer_rhadamanthys_stealc_stop.exe
Size 667KB
Sample260803-db2mpsxbrf
SHA256 cd4c9b4d9cdf31448720182fb59c959ea90ea2bc8362cc6e3ab6a3a131a2d8e5
MD5 31ae9eba692d15ecc295fd503c6a939e
SHA1 fd534ce4fd3af600421d2b8c9859b8e8f947a826
SHA512 93656931b7e18bc6e464c9c98e0578a23b51756245a8574f4ce60d41fd38ff21d34bf03d4564bd0abbd6de82d61dc2935f075f16f8a697388527ea5f957633ad
SSDEEP 12288:oYmIjECINDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:oCIx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T168E412DA3262C439D4EA1136540C93F1DB7FF83061DAE607B34C1B768EE5AA4C24A75E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1360	alg.exe
4088	elevation_service.exe
3512	elevation_service.exe
5564	maintenanceservice.exe
3508	OSE.EXE
2884	GameInputSvc.exe
560	GameInputSvc.exe
5780	msdtc.exe
5460	PerceptionSimulationService.exe
2312	perfhost.exe
5992	ReFsDedupSvc.exe
4156	locator.exe
1008	SensorDataService.exe
4576	snmptrap.exe
1168	ssh-agent.exe
3016	TieringEngineService.exe
5772	AgentService.exe
5296	vds.exe
376	vssvc.exe
6056	wbengine.exe
2984	WmiApSrv.exe
5216	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_31ae9eba692d15ecc295fd503c6a939e_elex_redline-stealer_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_31ae9eba692d15ecc295fd503c6a939e_elex_redline-stealer_rhadamanthys_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\85519f4de05f6396.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_31ae9eba692d15ecc295fd503c6a939e_elex_redline-stealer_rhadamanthys_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
560	GameInputSvc.exe
560	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2036	2026-08-03_31ae9eba692d15ecc295fd503c6a939e_elex_redline-stealer_rhadamanthys_stealc_stop.exe
Token: SeDebugPrivilege	1360	alg.exe
Token: SeDebugPrivilege	1360	alg.exe
Token: SeTakeOwnershipPrivilege	4088	elevation_service.exe
Token: SeTcbPrivilege	2884	GameInputSvc.exe
Token: SeBackupPrivilege	5992	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5992	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5992	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5992	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5992	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5992	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5992	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5992	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5992	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5992	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3016	TieringEngineService.exe
Token: SeManageVolumePrivilege	3016	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5772	AgentService.exe
Token: SeBackupPrivilege	376	vssvc.exe
Token: SeRestorePrivilege	376	vssvc.exe
Token: SeAuditPrivilege	376	vssvc.exe
Token: SeBackupPrivilege	6056	wbengine.exe
Token: SeRestorePrivilege	6056	wbengine.exe
Token: SeSecurityPrivilege	6056	wbengine.exe
Token: 33	5216	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5216	SearchIndexer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 560	2884	GameInputSvc.exe	98
PID 5216 wrote to memory of 2988	5216	SearchIndexer.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-03_31ae9eba692d15ecc295fd503c6a939e_elex_redline-stealer_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_31ae9eba692d15ecc295fd503c6a939e_elex_redline-stealer_rhadamanthys_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1360

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3512

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5564

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3508

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:560

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5780

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5460

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2312

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5992

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4156

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1008

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4576

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1168

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3016

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5772

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5296

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:376

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6056

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2984

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5216
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:2988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4fdf2950c0585fc0e15d59bd4c42f4ade2f2f9c54f3a4ae9dbc0219705a75ccc
MD5 2c3ac4898a6286c521e440751ef7531f
SHA1 995d5302d755044a2daaecd8d7d4b8b75e25ac3d
SHA512 dca9b2a9b59b923bc9e8b7081801f05fa9739a204997acd6c014d2ff918be603c837af3c26a4905aeb6c9c63321482652e26798f6e519bbb30e3ff7a501be2ea
SSDEEP 49152:Bb+632BuPkFKRrdE6oh7stBhuXjfS4LWxn3adt0zYyC:H3q6gjBsktUYyC
TLSH
T106D59D03F29900E9E06ED178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 53a7c63a4270d052ba46cdb13ce851612e12318e4e64983f8df69fb91aa6c743
MD5 62cb5c91cf40faacd0c7cb429141e8db
SHA1 b17fc3b3da0b34f28162170f2ef9557426082328
SHA512 3c3c634e04c19bb877b88ed5ebca75a4846e85ae5c2f29cf469ddd52133a5021df10b095466a23d51b4f15e847a061d4dde17834d31a766e2efb17c1362e7445
SSDEEP 24576:tXYKttczA9x1vudUXRpdkrmXMLZHuSwyfyC:ptccadt0zYyC
TLSH
T1C005016963E508FCED6B813DC8A28111EB73B84043A0E79B03A899754F636D85E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 2693067c28d41b14bd8dabde24224aa8b378111c37417e0e3297d70e03bd4c4e
MD5 a69d962cd321acee10f67345a22d1407
SHA1 8b94a1f5d15285f66b4bc95e7dce5ff9b77cedf1
SHA512 6044fe53f01199fc9443f74e6782b4b20b8af5077502aeb45935eeac41f9d6cc16ba20df89dd2e404364a02f9421621eab903eb166ff72b5cfbe093a623f0f84
SSDEEP 24576:803e5LJ0QmxOrMqx1vudUXRpdkrmXMLZHuSwyfyC:8DLJ0/oHadt0zYyC
TLSH
T17245AE56F6748335D073C0B9C5D2A69AEE7230811730CACB4286D77C6F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 213da71239a5f962096d20705028e225710b1dd331f1b7733769da4f01f3e374
MD5 e095b711121ecd992364f8ca127a71a6
SHA1 9938db773ad0db16f65fd96a7036cce14e270b17
SHA512 924598dfe50d46ca3da67d657f057d7e8d3a960d4c9c01926debe50ef4a6e8cf167121bcc1c916fff740982ea4e8c3077e2a4be08eda72b1666b4eb6f9edc453
SSDEEP 24576:KR0/ezSC6vUyD/aqgrvW/6q8wyu/x1vudUXRpdkrmXMLZHuSwyfyC:x/ezSC6vUzPvuHjy4adt0zYyC
TLSH
T17C756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 89b22e434d355ea15f8fc31e58b23d555619f7fbdcb1b5ac83b4a3d0aae96bfa
MD5 c2cd8d0e4ce3f7c808ca023542cd6463
SHA1 23587864a8d16bbf7f0c7817f7167f708010a16e
SHA512 5ebbb93a34d166ded452fff1ede8fa6662e7205e6d71d9727a095b228ac6794608aadb7d38fda89492b1129120bb20d8e64b194b6d15164094d4387246d68786
SSDEEP 24576:wabtP1Uo/v/l+d3x1vudUXRpdkrmXMLZHuSwyfyC:waDUo/Xl+Fadt0zYyC
TLSH
T16055AE66F5748335D073C0BAC4D2AA9AEE3234415B31CACB1246D76C2E677E6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 b9a188dab050939fd2b91270ba254e6d0978c16d2765e485e4456559841cdf81
MD5 d23d649d26ea9b5b5eef84721fd616ef
SHA1 16010afd1724a0f3e302a717f04f9d7e07b2c64f
SHA512 3e7c7fd002645b792d3c5505b20d48e4164f2f336e624ec2dc9ca527f8c094554ca2f7f1287c5c963480e16f06ad719907c2e206df39a5e9b7f05c723e1c3c0a
SSDEEP 12288:+15NDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:+15x1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T180D423CB422B487CE6BE2137744C32F5DBB7F84461CAE71A60093EB4C5E9864C14A79E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 1825c967c0a62ed1107cccec4b635685c06d637e936904a83240473e5176f971
MD5 8684113da27396b5b4f54dfbe3f5d7e9
SHA1 abf00a7a2b547b3b9ed00a451d24724e212be153
SHA512 ae05ba77785afbd801cdcf3669b0a947db159b30fbfe6716865280bdcf68958100077ff67bc57699c99be4aa45f6a5b82a08ef0bb59005f74cd233eca93595fe
SSDEEP 12288:qeBNUbTVO86UuNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyR0:qJIUux1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T15115DF7BAE28FCE2C27E5D795A918340D772B4304B52E3CBD165820ECE535E05E7AC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 68e32cd757011d7e891ad3ac1f1d8907b7bd9ff4c1a8db3a2b946c959715b295
MD5 2771c5c7b404f9b727b32eeea3b70547
SHA1 ac54a28e3b859b959ff1579cf544b3150e8f17aa
SHA512 52ae42d87247d65b67e6fe9a16610ee45824f6b41915b032b4b77ecfa9f93e024e08658ff6fe0a937483ff503fe0cc1acc140e46e32cdc5c8f2bbfb8cf797c07
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJN9DN5JaNRV3THe:5QvGAdlCEL8c/NRNO5CsktUYyC
TLSH
T15C367D656BF880F5E0B7E138897A85B2F7B678420D31EB4F0291C66F2F736904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 1523f329d552fc38475f03f56edfc193ced4790c15b24724ff3d3ddb43c607e0
MD5 831cca2decc1647d87871f8f70054431
SHA1 bcc8461433281e990434555e5c34f6bcb58a24fe
SHA512 a761eba5f9338931a1bd3bc41504e1d0ddc9c80004407460e626b04d932b6cc196d2e098a963529ba1bbbf871e3d7e8a1c622cce800d8543d15005f0346ce903
SSDEEP 24576:FmewsAjAx1vudUXRpdkrmXMLZHuSwyfyC:QljAadt0zYyC
TLSH
T12815F071FA75D036C2BF0DB21B25D316587DB9204B921AC3E3A84E9D49B41D22376F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5ec1c5969bb850b174cf7f8058edaa9f6a6d2546144380682675223ae964dd65
MD5 72faefcde69f95ff4cd233c590145b85
SHA1 34416f3ebf65b3710b816432ba8e9a5d7b71eb0e
SHA512 740131e97e1c891b0ef428c1865557102e9100001e920c954851bc7fe040c85a0100d60ed81d4c6e3a22bdcc132adf793c7cd8b789c8bb020d2ad86694506783
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyXr3dPlbuJHqzyC:DUEtQevvqc2W1cpV2XrN20
TLSH
T1A4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 797a9a5018421fe76b0c507e427431ee043d9c18bafedcc97aacf167ca7cb81d
MD5 dbe6bebd49fb9be6b64b620831a077e5
SHA1 9aee35059441295195eab8befb7b0f3c895ad535
SHA512 84b357581ca548c516166583175219fe47cdc52fb52d8607f45a231224c17e3b40ed725138b197e12fc90c9b2d0a546c1823076f4febc79de406651f84123187
SSDEEP 49152:d9bRquA/m2yL5zMfFiV+XenmE3/zradt0zYyC:Loq1VjnmoktUYyC
TLSH
T149D58D0976B8C1E4D1F6C37886A2C647F37178154B35A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 97f7d41d8de4ee6deaa311bd3941893726807ed7428946887f4e475cb01e5267
MD5 3c78273d72090948b7b088c02da76364
SHA1 8f09056e0a957a288924a89e123725028adeef9e
SHA512 268c78a07083e31169827365a62962d10814b4fa2004540e25ca4122c9c29d3ce4d88bfe34200cba320955017484ace45038a3165629337258b255d70bf9705c
SSDEEP 24576:bAhGLvJFoiwtA5l7S537x1vudUXRpdkrmXMLZHuSwyfyC:bAMtFoiq5radt0zYyC
TLSH
T11D45AD81E7F945D4F5B7AAB8A9B69170EA76BCA95E31C20F2110D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 7e8c146ab04825f358f8f05fd39dd120a775f240e7d008a4fb635c8d1d13aba6
MD5 aa3745a2a57466190c5cebfed49a00f0
SHA1 3f07b28582e94efebc252785a16a918dd2dda0a2
SHA512 5abfab279973b226c5fd8710ef5ca23ed07a2df643f9b7f207ef8f1485809a27aac7059a9c21a304ca4730163c5237b30e09690eb01e7bf7d33cde295672adc6
SSDEEP 12288:5mw5HEjsChNRBFgl0WDm+CpNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZ2:UwusOWax1vudUXRpdkrmXMLZHuSwyfy
TLSH
T11A05F18A33A50CFCE9BB5239854B9136F7F3F8002665D71F1360C66A5F67261AD1EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 678KB
SHA256 ac760a752e25932515d257564f918fe89b6201876bdbac4783fe68c5530970dc
MD5 b72682954d3769a4f8ee02c2ee608d31
SHA1 911c8f877cb12c10d2df33774f3d9850bfe9a2fe
SHA512 b0d7ed3721df47da640d095cb501fda723b2d54137d10ff93dabf41aedae585d933149521f49114774545160bb21e8bda1087a50a538f00341fd068c1d798516
SSDEEP 12288:pUG1IO2NDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:qGuvx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T120E412CA23A510FCE1BB123E98991295D7B3F44063B6D3CF211806B54FE79D19E3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 56daf60b493dce59e4eeaf10f0e53bfcc9ca7267c937ca60acc9b8c160160b81
MD5 ffba438c1ba8f0d474897348c0814375
SHA1 b4bc9b8195349b9ebf7b3c846cd696ecbdae9b39
SHA512 35cb29c180770e35ca564ea81d92007f408ae92572b8467819627d7b93ca82e489b1616cb9a25fe80ce394b8ba47e0e048ae8d798ad4ee1ba103d6313a820576
SSDEEP 49152:ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Ua:BQRQyi36YOcP8Lvw2gAf+PN3tktUYyC
TLSH
T168667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5dc618eea316cbcc1cafb1913cf7b108ecb733453fa52420be8c0aa90d6c3d08
MD5 be7ac7345e3d24a5d65b9f8b265702ed
SHA1 5be616c22c53b187df7e51976ad6da3ccd49577b
SHA512 777cf89597b2d4b8c2cb72d020bf5b8acc9e66f05090a5dd625a886509616d32231fa5f3eeba32856099d6ba294b91f5fa6709f9f4f5744509ee0afe3657ed11
SSDEEP 49152:ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uh:BQRQyi36YOcP8Lvw2gAf+PN3OktUYyC
TLSH
T185667C43F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 05fb82aadce99b15ead91399e69c4b75d3c324993687f345ee01db8411ceb2e7
MD5 ffefc757e08e69e5f1d565d2ccd249dc
SHA1 8f1d642b5110722cc546dcfcf9aff6502272c288
SHA512 c223c33a8981e58f24b7375d5b0975b539d081c195e75e0d93d88cfde39a54e1139c31f9382d9769ecea709e923afc6a4ca0d1bb2bc1f2566395a5a1fd77fbcb
SSDEEP 24576:rwvLof6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL00x1vudUXRpdkrmu:D68Qg55nhMeWu7PNU3/hadt0zYyC
TLSH
T12FB55A33B2F200A9C44DE1769F4A973196D27C718FE1E3DB850572161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8cd1d8b5f93575f15fccd24576cc70074480ed3ba9fbcced8ab94778f382b8a2
MD5 481710b2e0a4476b159c86e29c5de4b6
SHA1 97acf0417a9feb91fdde5d14785b0dc9d1e5cb59
SHA512 3223e830dd7d799c3ca974aab79e1780d49533a101db1fd81bd657f12434e96abb22f8c14447d53b5e7208301858ce140c7a86e29232ef7e0ffa8d22b295583a
SSDEEP 49152:t3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99p:8y5112gYy5azzVv569nLKnhZrktUYyC
TLSH
T184167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1174cbdbfab750cb77a4ff3bc1c367367c3bf9550572bbb222e74a169a666e81
MD5 754da06fea9f5ef5c3b1386a6dde17b1
SHA1 20076616d2d59464dec6d65003b4e0ffca612472
SHA512 210323469588debff0ca604e2a8e39aec4589c8ed10021236bc4b8022d09fc415d9ad52c398ecd5546412217342cb5e4a016e2103c68639d2461e9514206a2f0
SSDEEP 49152:dB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glQadt0zYyC:Du6JmTxd2dQktUYyC
TLSH
T115D59D13F1DA01E8D06ED079974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 35c2c056a144ea5bad6e6065b2f34c7c08f76ea81195a47a94446e69ade8a1f1
MD5 9d9e5e500816d9b71f4b020a15877261
SHA1 0ae0d61bd91bf680123c35ecba97b390f0bfb2b6
SHA512 0972031c0040110b7c713d116b7c0ba9603292e85faa44032de6ff771306748f6753761025f3230837428a09e12653c00987fdaa469712a5d7d531abbed7d567
SSDEEP 49152:i1hpsNoJpF1A6UU44CwH7R4xcadt0zYyC:imifPbRdktUYyC
TLSH
T1CDB5BE13F2D900E8D06ED178875A9232EA62BC450B35B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e9c9de9b82f745efa9688b34647975610d0d25bdabf6666db444de3f0a7bca5c
MD5 d7cd1fd27e31a746e269fdb3f1316193
SHA1 2111ab28d63958257d792aecd0848c6953fe38c6
SHA512 d1ba29cf23d0e08dd4582c05e740251d208e16ad79912f2df7a24171bcaaff55f6adc5a7e0a6ddd9dad7cb7f25fa8aa6cac05956f6637890f68b14cd66a89f95
SSDEEP 49152:bSuZQIY0Be2K6RVtOnks6NMHqFadt0zYyC:J5dKoi61FktUYyC
TLSH
T130C5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 eeb3323184b8e91829e6c78787da358a2633f37357cfad441db0a630af1ce46d
MD5 ecb6dbab670d0fb1f04dc74c00d093e8
SHA1 c65659fdea607c943e9cd608376dab59c77d2c06
SHA512 3a9b2589df3ba1e4def1c240ad5eeb55f196308df20bb53da4773c3dbfbac47e4c6b0490f24ae7665d45fff77ae0ed29f2a74d50d6fd0eca675240a1f736932e
SSDEEP 49152:DhtSn8EApI0figTgiDn0AP5wSadt0zYyC:iX2iyph7ktUYyC
TLSH
T160A5BE13F2D900E8D06ED179C7468632EA62BC050B39B6EF0A50B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 1442f9fdf942014498a5c4977b790bf5622e64b10240a4401c3c568a466875de
MD5 7fa5f247f3366e4b6110172c978e10ad
SHA1 ceca641f4f1fe5cc3bc50b562fc086251438aa9a
SHA512 351a584bba06d13c7ac7fe3d61bd2cde9d1d9c20ff600a159cb3105ff4c97f4bc352c2f983764bfe6f29c8be760e052e49cc7b2f20e8d9c6922f67339d8ccc9f
SSDEEP 12288:rcNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:rcx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T1FFD423CF426B497CE17E2177644C22F9DBBBF444B1CAE32A310D1970C6DA875824AB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 53ad5f676b7c08917d61218b664cd1cfa5600eda530cddec50ac73d0364604dc
MD5 66ef13b3c9f36dcfe1817c6e7fffe4c6
SHA1 037c568edbd06f80e7f3b183667bfe3082ed5cb0
SHA512 6ef09dfbef95b39bb9279d3eb8272ac9b8f98193f30654f28b4d0a23b3ab9be8c5701c0b7d03e01838b2aacd0a05d4349f152098a8627784beabe725bdf1bc97
SSDEEP 12288:BRONDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:BROx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T1F8D423CF526B497CE17E2177644C22F9DBBBF404B1CBE32A310D1970C6DA865824AB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 1e4f601ad90d0ed2e747b9860e205197e8d995e82a7d6eaa3b558175dd0aee30
MD5 004051306117c801b91c27acd8b40816
SHA1 a5227bdb0ef86b5c5826a4d1246cd292109a6e5c
SHA512 2797aa50b3e1a059e674e00d6a545c6f107c0ef66920de5ba6fd30b1cdc1254c52aeeb579a90130ac586954a4533d6b89622ec5fae0d1c819ba75b6265eccd34
SSDEEP 12288:DxONDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:DxOx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T1C8D423CF426B487CE17E217B644D22F5DBBBF404B1CBE32A750D1970C6CA865824AB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 622KB
SHA256 3a9c1a83f5a2492065c795d882d7f78ce48d4c6dfc2d43962c4c0a76f2e4b31e
MD5 d0aa54b32422a0b90389d95225aa58c9
SHA1 8cc2ca179a4694808579630e3756dff40a7745f2
SHA512 510a0d9e05f06e6a1f7f250f739d2146193cfe0679f0a947d9e93cf2120beb2d56a918ec3b85ea52ec33799484cba757ff6fb18e1ddcf1c60b2f1b2733a31a8d
SSDEEP 12288:vldNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:Px1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T1E1D423CB136B04FCD47E613BD84922F5DBFBF844B296E32F610819B48AE65649109F9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 c6086ec48dd49b74fda4bc9db1d08cbea93c4262c59b09bf33945dc8b1e4a151
MD5 92205708b07fab04513ca8783d7f28e9
SHA1 23b890c8da54148c9edb9cd07608dbcaa9897494
SHA512 6673c2a2eb66976f6ec481734a80114792a2cf6cee61061c2cea3032a513aa044a1ad90fc94aac12e58081fb6c558413cd1e0c5a0215a06e934b79a371af102d
SSDEEP 12288:SeNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:Sex1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T10AD423CF426B497CE17E2177640D22F5DBBBF444B1CBE32A310D2970C6DA865824AB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 4cd54c69740c92393c4c26b68c7f8bccd17f9f4e9cd668331221d30df07e338e
MD5 0f9b599df5db7c11a3997ecce019d335
SHA1 e8d5b69a626b7d98284288e73ec300d6b20358e0
SHA512 6dfbf1c81ce538a33b49734150ec5f285c412d18da406814e04425b4e93470771dda2ff1f3441ac60b3da19a058a9a2195241edded2b1b25966f0d58de86057d
SSDEEP 12288:RNNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:RNx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T1A3D423CF426B497CE17E2177684D22F5DBBBF404B1CAE32A310D1970C6DA875824AB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 5d79f15b19d7ebef85ade21a4ba7100326af07fcccfc613c43ea1e7123feda42
MD5 bb9923f5468381f498cd42fa49a2bf00
SHA1 2c2ccfee2561cd93d12ee1a3f34f0114d226582e
SHA512 d0e414a731096b2d4e7be8c3de5bdfa11ed3820ecb109d8127de9ec55663bc9feda9491290822faa116b00ac23d5c1d1f988e20fd1260a0e9f65b205a681a2ec
SSDEEP 12288:mINDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:mIx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T1B0D423CF426B497CD17E2177640C22F9DBBBF544B1CAE32A350D1970C2DA875824ABAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 f394889aa469d69df50e7adc69cbcbd3e13e5336def6da0161057166bfc29e27
MD5 3e5b48d97e689d7254d3c49fd13318d7
SHA1 c178e457573293808f8894face73e1acc95bd8c6
SHA512 6ecfebc3ec62dbf1a8b53f88df48b59ba9f3cfe2601f02bf83130b46453965911c348eacffe682cd9bc4c530d33422d9188259ff2ff760398f215bcb2e449f84
SSDEEP 12288:uiZwb6kzFjdSccPvyxaHtS3uv32LVRo/gLtNCiMP4gAbF1StiQmlp8sBFgYs:RZMVzFJSIxYtSe3uLtYeDYfWBu
TLSH
T14A150295B39018F4ED77413ECD668902E6B27C1A16A0CB1F17E836275F337A11C2EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 b6824b7811c3f4a99e595415f58bdde8d93289c74aa961bb1918eb927557cdb7
MD5 0c4d7298c7af5c073caf33c81d42d52a
SHA1 5251844ae471f4dda80e821c02fbd22486a3fae1
SHA512 e135ed4abd0d84ebd0f1514bc7bc60b50b8b6ad53e46b8ec6997ce2ef9be0f78e6db4f4cb1dede36e26aa841e518d566eb54dd5473bc8de108fb0c5348525021
SSDEEP 12288:j8aHtS3uv32LVRo/gLtNCiMP4gAbF1StiQmlp8sBFgYs:j8YtSe3uLtYeDYfWBu
TLSH
T194D42357D0E68622F77F05BDC67B4052F9B6330635C2ABA33FECA1224361A9758894C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 3f324ee1d40db17c4296cb9120d35cf5d7665785f551f2109418254b08c15b86
MD5 c3970033a55180acd6e71842e50c78f9
SHA1 7149b37f87fffdd49a2055f47a1fe2d1bc3e6b9b
SHA512 7c0a5790dd0ce2e9a4094ac00a19a77514f7f6990c8935ab783048a949e8b3abfb1c1e3912051db8f925bafffde597738f57506c085d36ac1282e556288b0822
SSDEEP 12288:Z+aHtS3uv32LVRo/gLtNCiMP4gAbF1StiQmlp8sBFgYs:Z+YtSe3uLtYeDYfWBu
TLSH
T1A1D42357D0E6C622F77F05BD867B4042F9B6330635C2ABA33FECA1124361A9758894D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 abc547a35f9b1b795629b4246b89b112e1c0b8375488b7db09bd397608616025
MD5 888ad9d1b61ab5d9012a2edd86319945
SHA1 c95d1815c67a56323a4371a9052cd43038c94942
SHA512 cd91b2cd2760a0726a8605b11a8e36400d36a6420a4a75be46815cec10a09aaddace8a74a224cb584076b99b6122c9e86d4d756378fdc934604ea78b56c29aff
SSDEEP 12288:tSPz5LCzTaHtS3uv32LVRo/gLtNCiMP4gAbF1StiQmlp8sBFgYs:0zIvYtSe3uLtYeDYfWBu
TLSH
T1D8F41247B2E531F9E27B423CC9621502F7B2743217509FAF27A847361F237A19D2AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 0fb11cbb366f60c420712921da82963a23d603de4a27c28c3450ca9232675569
MD5 1d842057c592eba5a11546c96afa6f8d
SHA1 6e3b2c7276671e3eb9789250888ce3ac47c1be27
SHA512 60758c958c5959ae112b4caa532d7283f5027545e9c648853c98111e2fd586076dfc3f2fa2b4bc83f2fe6d41c1755c8318b03db84acaec6f1df99876e28a97c6
SSDEEP 12288:T1aHtS3uv32LVRo/gLtNCiMP4gAbF1StiQmlp8sBFgYs:T1YtSe3uLtYeDYfWBu
TLSH
T1ACD42357D0E68A22F77F05BDCA7B4052F9B6320635C2AB633FDCA1128361E9758894C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 e617920634e09e67c3319a6d9ae7d928b9e622b5b42422d273cacf8565778c1b
MD5 f838d1dd216474d46016fb462cab0b68
SHA1 25b5cf5261dfc291eff14802c36fd43f91a26293
SHA512 25bc9388e58f23b20525b1e8e2e0c26a5d1afff83cf4337c6cc96b83e58c1be5863d462a3e556a79ec1086d3a04877772e0d8dfdc1978155c50a7d9b701257d1
SSDEEP 12288:rZaHtS3uv32LVRo/gLtNCiMP4gAbF1StiQmlp8sBFgYs:rZYtSe3uLtYeDYfWBu
TLSH
T1BFD42357D0E68A22F77F05BDCA7B4052F9B6320635C2AB633FDCA1128361E9758894C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 fe79a91664bd69d6bb22d78a3da7047c64fca5595578f6aa7c34e3d9d57eaf1a
MD5 824f4be15f84575655090b1adc4aea62
SHA1 eaff24e464ad06f6ce7cedd632336c93ca2d67a1
SHA512 4ddf7db6fed2caab256a4d546b4dd85a909964a7dc1eaf27992056c3e42dd404e3328280b5218fa55776763961ff48974583cf7028712d7d73b5da37532e517b
SSDEEP 12288:0SPz5LCKaHtS3uv32LVRo/gLtNCiMP4gAbF1StiQmlp8sBFgYs:VzIKYtSe3uLtYeDYfWBu
TLSH
T1A5F41247B2E531F9E27B827CC8620502F7B2743217509FAF27A847361F236919D6EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 864KB
SHA256 00197f274740f2e94efbaf1da511a3483315cdc745174b4155c0fa75699a565a
MD5 0ef923a5a55e0c814cecfe0159dd900c
SHA1 8778d23348801ea7514c26893cc40f7f4b0e21d4
SHA512 533c86be966efa2c8ea78d045bfa03e6a3a7213e5cbb2718cb1b91e6c8e35ffd6196a7dab266dfea7b3a6b0e46e047eb9a120be6d40d7c04a68bddd5497966ff
SSDEEP 12288:RCd95wcoaLQR3z0zz4PDvhNaHtS3uv32LVRo/gLtNCiMP4gAbF1StiQmlp8sBFgX:sT2aLO3z0zKNYtSe3uLtYeDYfWBu
TLSH
T1F7150295B39058F8ED77417ECD668502E6B27C1606A0CB1F17E836275F333A11C2EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 2425ac7093fc6de21ec2ce6dc83e429f1c06f418b92321d7392eabdad2212a9f
MD5 14712057c216887914f1c91070e60b9d
SHA1 2aa24f4e350b740e6fa2d52c340e4f2576a22441
SHA512 a7b7736a634209cd3a15c22c7df8bedae560531442d1321a1f3e0f6d7d20b0c2f4e8dc0b3cb5b0fdd0fa206e14c24d5ffabd4b179e3fa90cc2a68975d2064416
SSDEEP 12288:4i4e7lRdAfgwCHHy7mTbbdIvGaHtS3uv32LVRo/gLtNCiMP4gAbF1StiQmlp8sBu:43qdOCHHy7mhdYtSe3uLtYeDYfWBu
TLSH
T13235DF90F3E410E4F1B78A39C9764511DAB67C5A1B61DE8F13A8261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 84034e9a588eab2c1d305058d6fb9d3bfc00264a0c3235ef0faa64c92d84f386
MD5 237834745f31a1d6cf244424ab05b97f
SHA1 63f6ac17f43f44d57a365e8b7617c81e29bd4e1e
SHA512 52a9e0a52c9edafa820e93f125e3c4ff9bc8dd7c6edf0e2bd5a92f823e408958b0c6a8487d32619e6e8ea8778dfe2546c8f812633000ccc867e4215780c24bac
SSDEEP 12288:rHaHtS3uv32LVRo/gLtNCiMP4gAbF1StiQmlp8sBFgYs:rHYtSe3uLtYeDYfWBu
TLSH
T1C4D42357D0EACA22F76F05BDC57B4052F9B6320235C2AB633FDCB5224362A9758864C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 603KB
SHA256 dfcce5242302a1178fd2a6a0864395b141f07374fa0b4dae3d02e2a03d70e50a
MD5 33448cabec864343ebd33aafc9bd4ff3
SHA1 e07a0c3ac65c6125c95a1646d734553c05910721
SHA512 7901646ef723024fff5f12a788c42d6e8531e98bdcdb53b11ba271c306cfed34d0beff2ea94a6b2c2894fceda6ff75770a42bd78c8bd6afa9b6287ba44b24aed
SSDEEP 12288:4laHtS3uv32LVRo/gLtNCiMP4gAbF1StiQmlp8sBFgYs:4lYtSe3uLtYeDYfWBu
TLSH
T1F7D42357D0E68632F77F01BD897B8002F9B6330135C2ABA33FDCA5228365A9758964D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 c182c908467b4b921e2e1723c9f27233682113fd931de67ef2c7806c294e1dd1
MD5 fd7ccb9b370e361cb348edb8f991600a
SHA1 be25de916b88cfda44116f1ec5a1cbc4ebac16ac
SHA512 74e8a7296075b071a3f5060b0672e1cdef3c0e8be82f4e34898a3838bf795964d512256d4cf43567fce431dbed5f5de0edd769eff262fd4fcebf64c0e9dbeb88
SSDEEP 12288:iWaHtS3uv32LVRo/gLtNCiMP4gAbF1StiQmlp8sBFgYs:iWYtSe3uLtYeDYfWBu
TLSH
T1B2D42357D0E68622F77F05BD8A7B4012F9F6320235C2ABA33FDCB5128361A9758864D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 33c76acd9a3f8b51650157c933f0d96e3493c77e4b386bb11ff54a98d70ebdca
MD5 c8efa4f94857096765606b2aacb7c78a
SHA1 0b4e69a698190acf5186c5c06e2427f6c0665f90
SHA512 aa967a36d098991160a192187eb12347e16a26a6064fee42b0b5c840e358196fc54f09807f4e3d58f816cc5a87eda085cfe83c8f44e987d278541eded554cf51
SSDEEP 12288:RsaHtS3uv32LVRo/gLtNCiMP4gAbF1StiQmlp8sBFgYs:RsYtSe3uLtYeDYfWBu
TLSH
T12CD42357D0E68622F77F05BD897B4052F9B6320235C2AB637FDCB1228362A9758864C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 099a29e8219ff7c9356aaa16f2c90c91eb065cb8a19e4bea82b230fd8f3bb83f
MD5 d9896ff62c334a974966a4f78f701e5f
SHA1 22272e0ad6d4e3f39a4cfacd267d8ff20449595c
SHA512 5475b97238ee5aa81004856f74b93bd1045fdb5a717c724e0d6359cc777854868badb6c428e234a07378552c20c8a02e73f58e86b56d3c91cc1c8eba7cf0b357
SSDEEP 12288:y7sfkNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:5kx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T1E8F4018AD29901E8C06E613AC7491691F777BC1493E2E3CB22C4F57D0FBA5909DCAB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 f5e0735db9786deaea931dbefa101eb172cf03a5fc2f250bcc7e5287da89e78c
MD5 fab6d6f1b3e9be8e04a8a0e66c6e15c6
SHA1 239f2a3c23770334a8a8691b937d3a5fd3302ba1
SHA512 7dc4bab87731369324f96fa4cd3b4415cd30ac478bcf9a56b47a803afc0c95add910bbf51be338f278e6ceda8deb9429681f7e6f0de3fb263a34685e500aae2f
SSDEEP 12288:Ko7reNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:zKx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T1FAD423CB436B483CF5BE2136644D22B5EB7FF50467C5E35B700C26B0C5EA8A4854AB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c12300d2627ddc9b48b4dbc2c233c5ee7e36dcd857df8733a3029ee276ad0072
MD5 14e658307edc7c63c11883a286224a83
SHA1 b4877066525effa58d0bb5af2bc955a649caa3c2
SHA512 d63de60d60c376a2c5e5a89a482bb59d8b43396f22bb15bbe688b91be71ce0f628fa22c51bff31a3c95d6b33665120b981339cb73a4c780f878dd09248647f6f
SSDEEP 24576:hgb6bmBIi49WNNFpg1rSvFv7bYPx1vudUXRpdkrmXMLZHuSwyfyC:hgb4mBIBhGFEadt0zYyC
TLSH
T1DD65AE1E22E802F5E0FAE2B89DAA4417D6B378161731D2DF1151423D2F3BDE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 1346f859e45bcd3eb848de76099e9173883216ae6bef3f8b659dae0bdd21a6e1
MD5 a7ac93c7735fd0c82a5623f3ee145b13
SHA1 b2db31653a5ddecff835428693aa814d46ccd269
SHA512 2430d9c28bc99b75da55944bfdb916373c2fd79f6bc005294925555f806bc96c900cb859c64243a591ee1e1426db814d188c919832fcb0d56d5de3dc435a6d18
SSDEEP 12288:NSGeNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:MGex1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T1BBE412DE12B764ACC57E523A645822B6FBB3F0406345E2FF14889574CBD98E0923DE9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 5d85d5eac6f6830ab900ae06b731b2532bcdd85d9a06487165a4e417071efec9
MD5 0f2fd91b679da93a5c7e93f73c96171d
SHA1 954f2b3bec68c2ba6d32bc5560c2c73f4ca33bc3
SHA512 9cf2bddb76720d4fb0c6e895975c45e73ec1f30d0e619d72009eb0d6b5cc01d86bc838f5c48b6b4878dd3877affcb5838ea05b9dff32b7179cfe57037ea2599a
SSDEEP 12288:H5NDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:H5x1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T1CDD423CA026B487CD1BE2137644D22B5DBA7F50463C6E3DB700D25B086DE8F5827AB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 32291a4ae4ec1256bcf9c2c5bd314d65682d3982a85578305531e4542cde1e30
MD5 8d055eb6273d73fee9619e54c89d0f82
SHA1 a8ce82e1bb979b3d3218ae06277791ec88181272
SHA512 5da92266e8aa3f296a8d969cc9d7e2f685ba28cb440b763f4bcd40b81cb7207a879bc9e392d0df16af8977a8a66f684d5b7f9c26fc626d0c36dc3c4ae1f557dc
SSDEEP 24576:v/M8u8FpJqH1tzria7/mBnx1vudUXRpdkrmXMLZHuSwyfyC:HrZFPqVUa7/Kadt0zYyC
TLSH
T19C35F1A563E101F4D47BD138898646A3F7B2F4141364EBDF06AC8B611F23AE44B7EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 625d18853e8a6649387ff10e0106361dc7d92789153defb5cb7ff7a4fd6bca5b
MD5 42af0a07d890c574d010274ffa97c2dc
SHA1 d241cf7dae45079ea70d89d7ee0c0ab067123d13
SHA512 da87282708b1e9ec8aa543fa2090a45b46dbe9e686cda45231ae4ce748f54ffe4181199315301022a032f649eac855bb96f41c2967a1bbed59ee813effb66138
SSDEEP 24576:aPUr+NQH1x1vudUXRpdkrmXMLZHuSwyfyC:aJQH1adt0zYyC
TLSH
T10405F15F22AD18E8E67AA13D85864319F772F4511352E2CF0290817E4FA7DE8BD3EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 b2a6e9706d21bfe956d1c13c16f4406771885d57fe2f4f47d77c2148d9567db4
MD5 98f8fed4b2ca8c95ef1ba48dfee30543
SHA1 b4a18bb5ef8f8a26a2ad0af45b460f4de9a712e1
SHA512 b0bb8db5e99e4f6c672a0732d91393a2588d4b577b0ba83e15e880ad427198c983dd8a59507535915aff3e3ec0422ab69bc7851bbe37c7a37b4ac2aa35889443
SSDEEP 49152:fBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjXadt0zYyC:QG05lO43bOktUYyC
TLSH
T183D5CF6E62EC11F8D0BBD17CD9C6460BEBB23415032596CF02A486A91F67FF4967E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 ff7d86f2732d64e08cf592a9efe555a6e5c2274f5a9b841126524b4cf68d3ff9
MD5 a776253025b77e7c1c2b96d1310d9cd5
SHA1 a7d86e3505d37d28f9b59d9429340b25b728a9e3
SHA512 82b037cce7fef3241f2eecb067b69de547d9e1ca75cb150af3a8c0c15a3f8bf249dbe182e6f61277725911e1e9d981670099f973caa2e01956e7db4777bb1f0a
SSDEEP 24576:/sa5POZ3dpbWVM50JicR2hG0lasx2+47eidnvx1vudUXRpdkrmXMLZHuSwyfyC:ka5POZ3wJt2pasx2+mpadt0zYyC
TLSH
T1AB65BF5EA2FC01D5D1B9D17DC583461AE5B2742153329BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6c4ad7693a5f3fd746af6c357c1240bdd3c958be2cbe1f0b764212f2c1839e8a
MD5 6e59cbed7eb48354bb924174e6968fc0
SHA1 51aaed61d0c803d5093f2a253f7cc7174b739531
SHA512 0cfe9a56faf653dbab60bb55194118691ed238bfaac20e58fd7f43715d53248fb0f9d90a21961acafa6ce4cf95d17a7df686f1e78ddc9894d924be2302b1827a
SSDEEP 24576:fNcwHdjbyQ4nLC18lb/EOjowL7FkKx1vudUXRpdkrmXMLZHuSwyfyC:fNc/zEOVHFladt0zYyC
TLSH
T160858C5623E901E4F1BBE1BE896B9546FAB17865133086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 7958360af2c661215d4838ba5a4baf8cb051cd5f6e398831bc0cf6cd83209960
MD5 4a098581ddad14c0a99ed97be6f5cbf9
SHA1 67473d8ffc57a330841b155664ee8635b97c2a08
SHA512 a3c371bcda037b72338b7679a57d436790ef6946955129cfd6a48d2f1b424488bc20bb12167aaa4588fe3b5f69645ea249754a4152a5cdbcbd90af704c4d1901
SSDEEP 24576:RJnJPbzB4S1x1vudUXRpdkrmXMLZHuSwyfyC:RJnJv6S1adt0zYyC
TLSH
T12715E17DD2A810E8E4B7C274811A1769FF32746C2F26A9C719B4D4343F52EE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 bb968f1cba3b62c8b13f1803e5a2258ace746a5649bfff6fb763a30503516f7a
MD5 c3530c8136ac02fe950b9140f8014287
SHA1 c7d229abb9a65e81457f50c5285842800c8ed8fe
SHA512 2378836f8eb6bd37a66945eca45e8e1393c74c283c8f980d38a93af93e493f679880114e6e86b28ffd325faf515e313345d0bf55ebe475f1ecef880ae77010a3
SSDEEP 24576:HCLHGL0MoeVtFumTijCmlKQWDkDx1vudUXRpdkrmXMLZHuSwyfyC:HCLHGeeV5ijCmlDWDkDadt0zYyC
TLSH
T1FAA56B05A7EB4188E8F3CAF5C92694169B327C549B34F7EF4A80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 90a05d79919cb3e5b88b08cfeee6f6bfb9780a4fad03480dcba3e63b827f7a24
MD5 db08e15366289d9d6ca62ce6af0b20a8
SHA1 f60152738c6cd96a9b65c062611804c307e313ac
SHA512 07f4e32d3ec7f5428430634dcf04f290c7f30b0216986b186c52332cb1dc3da7f4f5923d22bb413f1568035337aaf968bef7b06547f220438078cc9a8d55d04d
SSDEEP 12288:81Hck6j5ZI7FNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo3:06DIRx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T18FF4019D237B00F9D07B903E95820252D7B3F0609352A6DF169885B98FE3DD8B93DE45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 b0af033e78d2f391fd5e910732cc704191fffc6903b237ae2a79a13d033067a9
MD5 3c4f6b1d4c0baf0ec485518a4720576f
SHA1 9a9b3c38560119418f0ee26fca8225492b5062df
SHA512 f72cce8da72bd382dec517efedafe84bf4cf5569b0faeb55d73dbc6069e93111aa44a486ff3fbd33f6d4da72f010bc737e4375bcdfc04acb1c8b493a5c7aa4d3
SSDEEP 12288:JG6kyqUNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:gtyqUx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T13BF4228913A950ACE5BE1239985602B0DF77FC106752E3DF2080A63D5FFAAE0A535F1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 4d746ec9226887dc7cbc26f441c4b0e6fe701fe2ddc804ced03fca55f9dc3e5e
MD5 7732cf3b9c303cec91b97c207daf24df
SHA1 2e97d98be9ea2b369d2958b1c08bae7759fe8ca1
SHA512 4893d1bd5791a542e8c5d852de8d01866894457be1cc2981da24add054ca122073151bf2faa8d416df5e88ddf62c7e1222e7dba09362ee68fb51f93ff1df06a4
SSDEEP 12288:EaoTNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:poTx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T16DD422CE022B547CD47E227A640D22B5D7BBF01463C6E2EF344859B0C6DA8E49279F4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 0c03b9a9993998bd6c37ce620562cc3b8c8f500a2383179d655baa863a0b3dd6
MD5 c497abff15fcb27011be1646d2263ec8
SHA1 8b42482a552d8c9dd1a3258692c8a8d0f3a29345
SHA512 b746d869839e7beeecfaea9cc9d10efeb28cb9134c8f6173b625c2ef9fa1449890a2ffa01f8a64d66113e87a9f163998fdae23108a4e71247139af657fe83515
SSDEEP 24576:Y0gILoTfaidZyx1vudUXRpdkrmXMLZHuSwyfyC:FgHTrZyadt0zYyC
TLSH
T11C559D1D63EA05DAE2B2D239D8621493D733B4315772D6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 fad0501c8a35f6e62d94022f2d5f15664cecafdfb2113ef01b3784ca2c11bb35
MD5 5fdd357aa68c36b4d9a3a7b0bfd33c8c
SHA1 3921cd5952f14d98b3b3cb4cc9eedcd75fa4288f
SHA512 5cb393637de6aa3b69652ec09d960af9383297255dbbf669adb2b80c85b0e8dd43234db4a545dc671c19d577c6dcadbc8f7491a1f1740eb0f43974e5b0b914bc
SSDEEP 12288:apJcm8CNCaNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:arcmRnx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T10F05F18EB36F00B9E1BB913C88450256E7B3B0306352A3DF0295877D8E979E97D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 a54aa51b18be41ab05b3dc6264abbd255b86fd8e57ab0fa647fccfa224789a0a
MD5 3df06145b3fdd8565aaca6faf6908d22
SHA1 6f69f8df5dce2a8bcbb24eaf2a6a52549e2e0252
SHA512 9779b4d6efefd141a16d9b7f43565a51adfb9430078c461cf1d040cdfda64a61d2babaa6ec754708f4d2fc4ead845f57fec058154ee4c76e8ea263bf24e5d719
SSDEEP 49152:VDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3nadt0zYyC:23Upow8sBCktUYyC
TLSH
T140A58C3DA2E800A8C9AAC379C54213A6EA71742D3F3055DB0174C5B8BF1BDF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/376-448-0x00007FF6A2830000-0x00007FF6A2D00000-memory.dmp

Download

memory/376-361-0x00007FF6A2830000-0x00007FF6A2D00000-memory.dmp

Download

memory/376-362-0x0000025C180F0000-0x0000025C18156000-memory.dmp

Download

memory/376-363-0x0000025C180F0000-0x0000025C18156000-memory.dmp

Download

memory/560-244-0x00007FF6F70A0000-0x00007FF6F7168000-memory.dmp

Download

memory/560-322-0x00007FF6F70A0000-0x00007FF6F7168000-memory.dmp

Download

memory/560-245-0x000001EC00BF0000-0x000001EC00C56000-memory.dmp

Download

memory/560-246-0x000001EC00BF0000-0x000001EC00C56000-memory.dmp

Download

memory/1008-412-0x00007FF6F9240000-0x00007FF6F9656000-memory.dmp

Download

memory/1008-302-0x00007FF6F9240000-0x00007FF6F9656000-memory.dmp

Download

memory/1008-304-0x000001CD2CCE0000-0x000001CD2CD46000-memory.dmp

Download

memory/1008-303-0x000001CD2CCE0000-0x000001CD2CD46000-memory.dmp

Download

memory/1008-410-0x000001CD2CCE0000-0x000001CD2CD46000-memory.dmp

Download

memory/1008-381-0x00007FF6F9240000-0x00007FF6F9656000-memory.dmp

Download

memory/1168-391-0x00007FF61F400000-0x00007FF61F6A3000-memory.dmp

Download

memory/1168-325-0x000002EF80DC0000-0x000002EF80E26000-memory.dmp

Download

memory/1168-324-0x000002EF80DC0000-0x000002EF80E26000-memory.dmp

Download

memory/1168-323-0x00007FF61F400000-0x00007FF61F6A3000-memory.dmp

Download

memory/1360-68-0x00007FF6457A0000-0x00007FF6458C2000-memory.dmp

Download

memory/1360-18-0x000002DCCF150000-0x000002DCCF1B6000-memory.dmp

Download

memory/1360-16-0x000002DCCF150000-0x000002DCCF1B6000-memory.dmp

Download

memory/1360-17-0x000002DCCF150000-0x000002DCCF1B6000-memory.dmp

Download

memory/1360-15-0x00007FF6457A0000-0x00007FF6458C2000-memory.dmp

Download

memory/2036-0-0x00000000030E0000-0x0000000003201000-memory.dmp

Download

memory/2036-1-0x0000000003340000-0x00000000033A9000-memory.dmp

Download

memory/2036-7-0x0000000003340000-0x00000000033A9000-memory.dmp

Download

memory/2036-6-0x0000000003340000-0x00000000033A9000-memory.dmp

Download

memory/2312-273-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2312-352-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2312-274-0x0000000000830000-0x0000000000899000-memory.dmp

Download

memory/2312-279-0x0000000000830000-0x0000000000899000-memory.dmp

Download

memory/2884-312-0x00007FF6F70A0000-0x00007FF6F7168000-memory.dmp

Download

memory/2884-236-0x000001AD2A730000-0x000001AD2A796000-memory.dmp

Download

memory/2884-237-0x000001AD2A730000-0x000001AD2A796000-memory.dmp

Download

memory/2884-235-0x00007FF6F70A0000-0x00007FF6F7168000-memory.dmp

Download

memory/2984-450-0x00007FF6FA4F0000-0x00007FF6FA61E000-memory.dmp

Download

memory/2984-382-0x0000027C80560000-0x0000027C805C6000-memory.dmp

Download

memory/2984-380-0x0000027C80560000-0x0000027C805C6000-memory.dmp

Download

memory/2984-386-0x00007FF6FA4F0000-0x00007FF6FA61E000-memory.dmp

Download

memory/3016-411-0x00007FF775D90000-0x00007FF775F24000-memory.dmp

Download

memory/3016-334-0x0000014035810000-0x0000014035876000-memory.dmp

Download

memory/3016-332-0x00007FF775D90000-0x00007FF775F24000-memory.dmp

Download

memory/3016-333-0x0000014035810000-0x0000014035876000-memory.dmp

Download

memory/3508-59-0x00000235F3B70000-0x00000235F3BD6000-memory.dmp

Download

memory/3508-58-0x00000235F38E0000-0x00000235F39F8000-memory.dmp

Download

memory/3508-60-0x00000235F3B70000-0x00000235F3BD6000-memory.dmp

Download

memory/3512-37-0x0000013DF28D0000-0x0000013DF29E8000-memory.dmp

Download

memory/3512-40-0x0000013DF2B10000-0x0000013DF2B76000-memory.dmp

Download

memory/3512-39-0x0000013DF2B10000-0x0000013DF2B76000-memory.dmp

Download

memory/3512-38-0x0000013DF2B10000-0x0000013DF2B76000-memory.dmp

Download

memory/4088-29-0x0000024BB7950000-0x0000024BB79B6000-memory.dmp

Download

memory/4088-30-0x0000024BB7950000-0x0000024BB79B6000-memory.dmp

Download

memory/4088-31-0x0000024BB7950000-0x0000024BB79B6000-memory.dmp

Download

memory/4088-28-0x0000024BB76A0000-0x0000024BB77B8000-memory.dmp

Download

memory/4156-376-0x00007FF673410000-0x00007FF6734BD000-memory.dmp

Download

memory/4156-293-0x00007FF673410000-0x00007FF6734BD000-memory.dmp

Download

memory/4156-294-0x000002CB6B300000-0x000002CB6B366000-memory.dmp

Download

memory/4156-295-0x000002CB6B300000-0x000002CB6B366000-memory.dmp

Download

memory/4576-388-0x00007FF6BABA0000-0x00007FF6BAC53000-memory.dmp

Download

memory/4576-315-0x000001AAB5B50000-0x000001AAB5BB6000-memory.dmp

Download

memory/4576-314-0x000001AAB5B50000-0x000001AAB5BB6000-memory.dmp

Download

memory/4576-313-0x00007FF6BABA0000-0x00007FF6BAC53000-memory.dmp

Download

memory/5216-393-0x00007FF66C650000-0x00007FF66C98E000-memory.dmp

Download

memory/5216-392-0x000001D6C9E40000-0x000001D6C9EA6000-memory.dmp

Download

memory/5216-451-0x00007FF66C650000-0x00007FF66C98E000-memory.dmp

Download

memory/5216-394-0x000001D6C9E40000-0x000001D6C9EA6000-memory.dmp

Download

memory/5296-353-0x00007FF70B0A0000-0x00007FF70B32A000-memory.dmp

Download

memory/5296-447-0x00007FF70B0A0000-0x00007FF70B32A000-memory.dmp

Download

memory/5296-355-0x000001D9E3030000-0x000001D9E3096000-memory.dmp

Download

memory/5296-354-0x000001D9E3030000-0x000001D9E3096000-memory.dmp

Download

memory/5460-264-0x00007FF79B7D0000-0x00007FF79B919000-memory.dmp

Download

memory/5460-267-0x00000244FBF00000-0x00000244FBF66000-memory.dmp

Download

memory/5460-266-0x00000244FBF00000-0x00000244FBF66000-memory.dmp

Download

memory/5460-340-0x00007FF79B7D0000-0x00007FF79B919000-memory.dmp

Download

memory/5564-46-0x00007FF671740000-0x00007FF6718A8000-memory.dmp

Download

memory/5564-47-0x00000200EE400000-0x00000200EE466000-memory.dmp

Download

memory/5564-57-0x00007FF671740000-0x00007FF6718A8000-memory.dmp

Download

memory/5564-48-0x00000200EE400000-0x00000200EE466000-memory.dmp

Download

memory/5564-54-0x00000200EE400000-0x00000200EE466000-memory.dmp

Download

memory/5772-341-0x00007FF648940000-0x00007FF648C60000-memory.dmp

Download

memory/5772-349-0x00007FF648940000-0x00007FF648C60000-memory.dmp

Download

memory/5772-342-0x0000016131A50000-0x0000016131AB6000-memory.dmp

Download

memory/5772-343-0x0000016131A50000-0x0000016131AB6000-memory.dmp

Download

memory/5772-347-0x0000016131A50000-0x0000016131AB6000-memory.dmp

Download

memory/5780-331-0x00007FF6F93A0000-0x00007FF6F94B9000-memory.dmp

Download

memory/5780-253-0x00000171C1D30000-0x00000171C1D96000-memory.dmp

Download

memory/5780-254-0x00000171C1D30000-0x00000171C1D96000-memory.dmp

Download

memory/5780-252-0x00007FF6F93A0000-0x00007FF6F94B9000-memory.dmp

Download

memory/5992-369-0x00007FF67C950000-0x00007FF67D093000-memory.dmp

Download

memory/5992-285-0x0000020A61F70000-0x0000020A61FD6000-memory.dmp

Download

memory/5992-286-0x0000020A61F70000-0x0000020A61FD6000-memory.dmp

Download

memory/5992-287-0x00007FF67C950000-0x00007FF67D093000-memory.dmp

Download

memory/6056-370-0x00007FF73AED0000-0x00007FF73B3D6000-memory.dmp

Download

memory/6056-371-0x000001DFA51F0000-0x000001DFA5256000-memory.dmp

Download

memory/6056-372-0x000001DFA51F0000-0x000001DFA5256000-memory.dmp

Download

memory/6056-449-0x00007FF73AED0000-0x00007FF73B3D6000-memory.dmp

Download