b95fe3dad03c9b78da36cd692cf60ccbee8f40b1993ef3c0aa3c488e99f87b6b

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 04:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Size 1.4MB
Sample260804-fd4k7afr21
SHA256 b95fe3dad03c9b78da36cd692cf60ccbee8f40b1993ef3c0aa3c488e99f87b6b
MD5 fd68f24b3b98be6f1f2e3ccbfb53b65e
SHA1 01129d29853786d3d966c2ed8564d55aed3ee063
SHA512 654e2c6d43bbdf3cb5a54648ff3ca3cfca955912029e1d2faf0ca7cb999eba7b5c3c9823a2c2c3976fd3de1a1b5104e9bf54276f8e81ce4b8dba754de3a84c92
SSDEEP 24576:0u6O339SSgT7QBMvjRA+iqMIjmJ8c+hE:0QNSFTrv1PiqMymJ/+hE
TLSH
T19A6502316080C072EA33153589E9CBB146BABC7E6970800F77ED7ABA1F763E1415D79A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5020	elevation_service.exe
3400	elevation_service.exe
3428	maintenanceservice.exe
2884	OSE.EXE
1780	PerceptionSimulationService.exe
4148	perfhost.exe
5072	ReFsDedupSvc.exe
5124	SensorDataService.exe
1764	ssh-agent.exe
2684	AgentService.exe
4880	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\75ad8810c618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000032a6553ecc23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036eed47fcc23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c2c9d7fcc23dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c6ad07fcc23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce3f093ecc23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a8a8f3dcc23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003653243ecc23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000d86713ecc23dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5020	elevation_service.exe
5020	elevation_service.exe
5020	elevation_service.exe
5020	elevation_service.exe
5020	elevation_service.exe
5020	elevation_service.exe
5020	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe
3400	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3304	2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Token: SeBackupPrivilege	5072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5072	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5072	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5072	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5072	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5072	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2684	AgentService.exe
Token: 33	4880	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4880	SearchIndexer.exe
Token: SeDebugPrivilege	5020	elevation_service.exe
Token: SeDebugPrivilege	3400	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 696	4880	SearchIndexer.exe	100
PID 4880 wrote to memory of 4108	4880	SearchIndexer.exe	101
PID 4880 wrote to memory of 5328	4880	SearchIndexer.exe	102
PID 4880 wrote to memory of 2700	4880	SearchIndexer.exe	103
PID 4880 wrote to memory of 3504	4880	SearchIndexer.exe	105
PID 4880 wrote to memory of 5648	4880	SearchIndexer.exe	106
PID 4880 wrote to memory of 4864	4880	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_fd68f24b3b98be6f1f2e3ccbfb53b65e_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3304

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3400

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3428

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2884

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1780

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4148

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5124

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1764

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2684

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:696
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4108
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5328
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2868 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2700
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3504
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2868 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5648
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 85f43e16eca54e332824b5d63b2da7246588c18294ed5e6f0f11ce5262330673
MD5 c4bb0f2cef13a1b38179b7ecd7a35c2b
SHA1 8544a8c783c43ac86e2cfd6991558905be134c48
SHA512 f7406aa60c3ad0e133662a962d682cffef04ba268c25492ac3f27d725349700ff362482ca5f91268d9e866adf6846aa43ee2ff78739c5477e451e11192c6ed7c
SSDEEP 49152:Vb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnZv1PiqMymJ/+hE:r3q6mjBgtPiqk9+
TLSH
T148D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 975bc9de287fdf9b602559188fca7b4b0a67bf2b59bd6466a2f531a0763f2845
MD5 b86a3041a22c7e134278f039037ce604
SHA1 5fae2d96172be6883c4756e68a0c0c7333266065
SHA512 8ca94d5af0e7f27ebdfde3998ff8e3d998e6eaf149147640b2ed6d810abfcfba3ebe40fe98172662a8a95e9352b70711050fe5c7f11740bcc70e826961509f48
SSDEEP 12288:K1XLsswWkxy2lRq2czAwrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzIT:AXYfDtczAJBMvjRA+iqMIjmJ8c+hE
TLSH
T15265013863E409F9ED67923CCCA28512E773B8554760E78B03A4996A1F333D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 39028aae9fae1890f0cddca29be8b630a2d334c4110d796b8076ce863c81e5fa
MD5 e5728e860eccb137ba085fd721396d24
SHA1 7f467adeffd51ad3c977f9a38edb447b78900691
SHA512 bf7987e10d26f08907cdcbc93a09d9277e7545037f9874cdc87c6802b4885046195543453b17f83345fde3982feac2eaf678a3c70e742ae42b8fba4bf3782b29
SSDEEP 24576:i0Le5ji0hmxhrMqBMvjRA+iqMIjmJ8c+hE:iPji0AzKv1PiqMymJ/+hE
TLSH
T12985AE26F5748331D073C0B9C5D2A69AE97130865B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 be92e4994267907217a1990f42837e6f9ccc432ec33d9942ba6a1062765d67f7
MD5 0687ebcd3619df09a351ec244fffa8d0
SHA1 02fa638488df5c1ad15378e6c45bbe675608ba46
SHA512 6027cd03b1665c047f60339ae5ec67af700842cde5a45ccaa31494ed81faf59440d44939ac3e61f599b135c7bc613755dd16fd2b20c0923d8dd186678a76a93f
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWj6q8wyu8BMvjRA+iqMIjmJ8c+hE:W/ezSC6vUzPv+Hjymv1PiqMymJ/+hE
TLSH
T1B7755D25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 485414824c1a5da90a1509d4e3a143ac940edc9a2b856b1f7d39ee6986603625
MD5 50a94fe957c9f2a04af1b0b24809ae0d
SHA1 58cdf2e5499554e79ad651266209e837a6da24c5
SHA512 520f20bcaa10e1791f607d7c04719e48e3bdd365e7de833186103522a51fe5612886a2d04d34ee2891a5ca69e48cc9073407a47e59f4c32e918c4ac4c131b6ac
SSDEEP 24576:ZVbqPb88hv/l+BdBMvjRA+iqMIjmJ8c+hE:ZVO88hXl+qv1PiqMymJ/+hE
TLSH
T1D3559E66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 87b10f83e760a3c92411fea738dd554e8f9eb8ed8bfa4f6abedb6837aa7c38a9
MD5 b09c7aa4d79a4efa48373ce11ccd4df3
SHA1 4417a91e3c0a44412fc04ea0ef4dac7a09c6a57a
SHA512 9d9808b4faff27ee6cb3af31b5fb25a3216b39304a5b92a21b72ee6cbd6b3de3fdfbd3bc094c58017486dbf6af90c71b434035b892d27ff97917617eb4ab2b26
SSDEEP 12288:SGvrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:SGuBMvjRA+iqMIjmJ8c+hE
TLSH
T14045233600A80A95FF733F386DEB67A3C245EC7DF550A203B51676DB563C1E4A88A607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 3e01922be8c0561209d1e8df60a371d1f1eae4d118acefa1804319bfcebf993e
MD5 b0df2fba66e35e2910328014082c9bb5
SHA1 688f22c80cb77f53195dd074c1e0d64d4c683606
SHA512 06c8f14e64b4eea9f117987a59a2e17b9f20c5734697920d6539ff90506cf944a20765d05bf32661fa62e5a837846cb305976f152344ac308a2f39f1fc003235
SSDEEP 12288:ueBNUbTVO86UsrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:uJIU1BMvjRA+iqMIjmJ8c+hE
TLSH
T12D65DF3BAE28FCD2C67A5D785A918700D77278304B62A3CBE175834EDE235E05D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 07b3bc4d979b276c1aed20e7d064232f81e79949b345e687bfb93d2fef40c784
MD5 8f3a17d549c5be67bdcae96bfb96a59e
SHA1 432bc5790fd81c39fa11dc688655847e882852bd
SHA512 c2545562534d24f39f504781163fe3c5505c1eddfe716e4ca0a0ee7b5a570a36c7acd9fddcba19ba864e9eec866c933456528d92aa75de49ffdf863e5bfbc555
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THj:nQvGAdlCEL8c/WRNw5CbtPiqk9+
TLSH
T114266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 f47d8c5cb42966b27638d0d28cdea8a536926bd6fc039339dcbf531557595344
MD5 3a8c6664e250cb82c97224dc955e151f
SHA1 61d34df5cc41212952600bec811132e43a4355c4
SHA512 903b812575de001c602fbf548492b5f4deaa6ba6f113566055f3c21e48b0222007da3443d7761cb4ac6085da89f75c45114e8e81bb1912acb34c23e9d8f3a16e
SSDEEP 12288:lAwSfxL/2Dc3mDLLmt0LDQewsAjmrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2FuQ:GfewsAjfBMvjRA+iqMIjmJ8c+hE
TLSH
T1CC75F031FA74D432C7BB0DB61B36C716542CB9204B612AC3F3A89E9E59342D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9181d6e67cbb16f4f68501fd831c0485a8e94889831e14a701253c0b2b034e69
MD5 a979a5405012377c6f5cce8a92f90bb3
SHA1 a9eee0398ccbf9674d216d889b48447fb5a3950f
SHA512 623b02035189cae1670870e3a87dadc5a2cbcd1aab524cbb4bfa76839def2159429881eaa8a509322603b92c741fd608d08adde836b950ae818cb16331c2b885
SSDEEP 196608:KUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHyaT9+:KUEtQevvqc2W1cpV20I32yaM
TLSH
T15E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d7da3f7031911363403ee1682abb991b13d17cf14ab3a126a54ec337f4be5c82
MD5 b3a973ec0b95f7ed5bec3824d16371d0
SHA1 2544ab66f2a2f062e5ce33ae8d95019be62256b5
SHA512 840eac8786f1a55f436198202303e4d28b6e8758ea021092a23cdd4dd136b3ad59b1898a416f187c298e2c08cb2f90760e89989378a9d5df30b93b4e3a9acf35
SSDEEP 49152:yCbRquA/m2yL5zQfFiV+XenmE3/z6v1PiqMymJ/+hE:XoqtVjnmntPiqk9+
TLSH
T1BBD58E1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 158ea443de076bc67d6316de325b3f272f9919bfed1ec967c5fafad1e470729d
MD5 9c1500e03eaf9424d159108f9de05961
SHA1 ec1ac35a3573284b1fc8bde54b0519e8a8843809
SHA512 290ef61b19ec95eb519e2fff43bd981781ae6ee814576cafb91724d5ad0ee492b3a6f99eb2562f56d73eaaad6757c5530143ac0802fd0ca0af80416baa93de69
SSDEEP 24576:oAhGL6IFoiwtA5l7S53oBMvjRA+iqMIjmJ8c+hE:oAM5Foiq53v1PiqMymJ/+hE
TLSH
T1D635AD81E7F945D4F5B3AA7899B68171EA76BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 063cf197a602e7ab43eb5afe6cacc04009473d1ae405d88dcc7bfb4304a10ccf
MD5 b979ca0c81c6e62bb631361d3919a744
SHA1 7555c5c99ce6ff592b4d66609c3b2f1aee45a5eb
SHA512 663d579c453954d4e49754f1ff37c17e8135b0fb0f217f4005807bc3785921f50f8ad525b11cbe14a3bc2ab43dd328ebbc4a4b84f73d7a2e0294c405a133009b
SSDEEP 12288:Dmw5HEjsChNEBFgl0WDm+CFrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8Y:CwuROW7BMvjRA+iqMIjmJ8c+hE
TLSH
T1D965F11A32A80CF9E96356388597C236E7F2BC163A21D71F1760C65B5F37361AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 3a439be633b0ac23d2afd62f56e896623a13a8fa361b47351832a5698ca08e1b
MD5 df39105bb50c66f256c8fac11c6aa250
SHA1 1d3ace76105bc2b585d75ecef88be4eccac2e0b0
SHA512 77efbdfa3b9078c60725cf2f009417d4dcf017076c0d91d7982e0cd0fdc98d3142013b94b15c5173d00f22d5af734b7f09dedbd29878a45611777368c9a5a9c0
SSDEEP 12288:OyZ1Iy2rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:3ZuiBMvjRA+iqMIjmJ8c+hE
TLSH
T11355122A22E811F5E673173CDCE64742D362B866733183CF262552AB1F37AD11D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 50b8fcb88602df2d9f12a5a79559d181087c71f3e9620d41b5dcd55bd6721f08
MD5 3b795e004a5a09f474b288601cb4ac1b
SHA1 2acedd56ddef73a6b55646efc1f0290449a5e69d
SHA512 6a7c0f056af15b040635c1bb6e4cf669fe1df23f8215adae485de778ac1ac7fe57bbd255adb239a2aa2eeb61a3398ba9bb10d19c33d0787535ab0f2087cb3392
SSDEEP 98304:+QRQyi36YOcPDLvw2gAf+PN3EtPiqk9+:lQyiKanX+PNwaT9+
TLSH
T17F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4010584b6124285666166fdb7c9245eade34fa33902adff5c11adf36d2295bfa
MD5 a2aaabcf463567e2f0a5f8346633cba5
SHA1 39a596bb0617f48398bb8d9f46be47ae0d7c25ed
SHA512 713e58216a2d29f2d5e654807c2827d117bc0f7cbd4e53f1dbdc74f6bc1efd597223875f91fc0eaf9b945db0053665aad96b2a503114500f2a40459285076281
SSDEEP 98304:rQRQyi36YOcPDLvw2gAf+PN3EtPiqk9+:aQyiKanX+PNwaT9+
TLSH
T129667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 cad95512e5eac17d8ee6bed2939c1fb3410c9e5ab8b6e5fb6293f0823c90b0fa
MD5 2a451eda13f247f1a75db13e5a5a43f3
SHA1 9c136ef4d4b82850f9167f8d48acef3c4cf4bb54
SHA512 b9085aec55c68dbd2e309a4222db0127d8aefcb136e2d9109a571161c2bec1ad38095443714f765d1b2c6e070d519db59cc123e43207935d72f8b351d0a08a03
SSDEEP 49152:S68Qg55nhkeWu7PNU3/Kv1PiqMymJ/+hE:QthTRc/KtPiqk9+
TLSH
T189B54A33B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f57e53568efefcd8f37115c7f6f7cafaf665c0a31f0f0b8b2554e0d62ee9125d
MD5 053a7a9988b5da7d848b0a4a7d713e2d
SHA1 89c30ef67e6551efdc64aade212caf85e50a7dfa
SHA512 27ebffa6cbd758b7d07e351db941cd3254b6d51109d9d210c26fbe62138cf5ab03d2ca1a7c4713e9e1a8b927567b68614d3d1a3b79d618b43d08976d85725973
SSDEEP 98304:ay5112gYy5azzVvU69nLKnhZVtPiqk9+:DLIHRWhFaT9+
TLSH
T167167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9a4592ed27db1aa1f39825b9be1db941c5d9f817999038f202a51ab3b40e9406
MD5 781725ba9b21262825e149bb6d3d5629
SHA1 441022c905e883cfda1b702910cc02b38144ffdf
SHA512 04db21f97b3687d09f57647cfc3dca5479879d810efa59db12a9944d2b95bd4f020f6a18741db8ae9e84393722a2f10102805b9c9d9d8faa26c5d92c225fba88
SSDEEP 49152:vB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glMv1PiqMymJ/+hE:Ru6JmIxd2dMtPiqk9+
TLSH
T142D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 807bdd8e528230c68beb4344eadcc6c28ea7f73be040fe45d8a41c0f7d28261d
MD5 5d41d273913fe560cdaf089cb28c46d3
SHA1 636b7e15f294ea2557b2cad82a3ad248472fc9f9
SHA512 bda858081bf85ef1e69613eb670c817e30f41c1ae7c43079bc3ab1120f07e4e1e3e55f8f10aa5f99917e093b37b59746292c4fb0164c8450e8e1482764727945
SSDEEP 49152:J1hpsNoJpF1A67U44CwH7R4xYv1PiqMymJ/+hE:JmifPqRntPiqk9+
TLSH
T1C5B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 49acdcf2a57f59639b473ba6be8fdfa35ca5b9f932d0503d1515031b827ef59d
MD5 673be36755c4b61ad8da819aece63479
SHA1 a5af1ff8c97721998de3ab682fcd15f358298048
SHA512 936d8ad2643cad28ccdf3b26ae284e832aef9f68f4a69143a7cc06f2df2dd1643868a01ac55bf822d251e7885faa68db65b30e8c93edfd27975864964d908e9f
SSDEEP 49152:rSuZQIY0Be2KkRVtOnks6NMHqpv1PiqMymJ/+hE:55dKqi61ptPiqk9+
TLSH
T185C5BF13F2E901E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9497e4ed5996422c781ccb2db4bc3d6178a6c93e2260fdf78ef25d2e31910468
MD5 eb6190122967c8ef62078dcee1609dce
SHA1 2c42ce7bb960542deb5c7034186f800e18128d29
SHA512 a2d4e5b7cee38336c7025cdaed9eb204877d9af7bdcec31f88f8a6d57fc4ff3ef5af91debfd2bd0d1497a6437324d94372f131e10b63e58a23cd10c48be465fc
SSDEEP 49152:nhtSn8EApI0figjgiDn0AP5wcv1PiqMymJ/+hE:2X2iWphTtPiqk9+
TLSH
T17E95BE13F2D901E8D06AD178C7468632EA62BC160B35B6EF0A50B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 46f58fe8c8d34328264800285b36a6404303ae893b460feeb9035d075cb79a58
MD5 c4e9f50e3a140bc3c777795f7aa635ef
SHA1 54c24cfdd26ceb8378ab3ca3ed113a31164fa2d9
SHA512 d978bc4539390da1c132b2c0177872268aaa58175659e6efb3c1e6216451d7119cccabe80d4c265862a4549ac06740106d8ccf89b7c1b740f63ba1b9ef85667f
SSDEEP 12288:lXrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:lGBMvjRA+iqMIjmJ8c+hE
TLSH
T1BF45233A00A90F86FF323B389DE75392C285FC7EF651A203761A719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 2ea05df0c4ae4dc9ea2611d476bded78c67bfee21d1056b70e172dd271b21023
MD5 f1006b9131da5cc5749a3468b577b14e
SHA1 ebc5ab1bc2eb0cc9ac952c18e3a9af08ba2b4eae
SHA512 0cf4cc356dbb9ce765748e157154e5b04b70c4005ed8f1b9cf04fb864bb76c7f44e8d239a68fcefe033fd640df4edc37ad347ce48e27ce6a312d051d7781cfd1
SSDEEP 12288:warGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:wDBMvjRA+iqMIjmJ8c+hE
TLSH
T11D45233A00A90F96FF323B38ADD75392C244FC7EF651A203761A719B533D5E4284EA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 af405963a436a2b4db72a92320c1486348358354b2f8705555576d017ecab1cc
MD5 0f7fd9f81e6f44b4d1ad62ccb0ba4614
SHA1 16ec3a97f72945f43015ace88d4a35adeee50aa9
SHA512 e66e578ea5ca84769e317e9098800153c63a2fa71cfb99dc92d9cd2813b9a0a3c100b35fab984316b59b167967d5cc07d5beaa364b721d9ed07dccb9f0c9f2fb
SSDEEP 12288:JUrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:JNBMvjRA+iqMIjmJ8c+hE
TLSH
T10545233A00AD0F86FE323B3CA9D75392C284EC7EF651A203B61A719B573D5E4284DA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 3cbfdd8a6e74beb0cc79574ee5a49a03f14a83bfa4e0c7904d249aa262cfdfc4
MD5 9f56b53ff2ced7a14731d14a1f835905
SHA1 4abbc83315919bbfabc7d76be1bb2dcac60031b7
SHA512 6b14370eba2c64d6916b0e97b50216fbfb686cee1939a373a8d3585357268955037c1c88d09670edc08944a2f4c5dcd8fa4426273cff836f0e1d4725896f668b
SSDEEP 12288:yVRrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:7BMvjRA+iqMIjmJ8c+hE
TLSH
T17945233611A90AC6FD32AB3CDDA75352D395FC6DF731A30BB601259B0B392E02869F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 583e318f7c38953a52b7564697e8c36e200e631b0302b30ebb5a0c9ee1e7a2f3
MD5 cc1d396189111a3abde245f65913163d
SHA1 24e80e65d7ae9558bbaef7986eb6cdfb6f66496d
SHA512 b044746246fe06d2f4de8cf4a94afa28e8b9e054c01a657a10f8ac3bf6c77a6864c02472111107ec104bf1f1632130c517f6a1650380afc2459d9646ddfc22ce
SSDEEP 12288:lJrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:lwBMvjRA+iqMIjmJ8c+hE
TLSH
T18245233A00AD0F86FE323B389DD75392C284EC7EF651A207B61A719B573D1E4284EA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 3cde14d769a27e023f4a8143c130f397d54c4b82241849643f1c037224038715
MD5 ab302ab4a638f81fac3db21c684c27b6
SHA1 6fdab494056671b11dd2bf967f857e3f78050d09
SHA512 c55e5f02b48fe0fe313204ce3e01fbd686ccb8d2e8af3dd63e60975378d878498ad60a44ceee1bc858ace85cab0a81e870a54f998f0b3aae3e20632532533f49
SSDEEP 12288:2OrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:2XBMvjRA+iqMIjmJ8c+hE
TLSH
T19B45233A00A90F96FF323B389DE75392C244FC7EF651A207761A719B533D1E4284DA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 caa67d7bb9c572ca86642b6718f250353b99e3b240bd908784146f1bde928e5c
MD5 4a1f5e7bc42eaaba1c8a74032f3cf378
SHA1 fc04ca412e91ac3eaeb9eccb2cfc648920f1fecc
SHA512 f3ad28861372797a3301f0dd4976bd3d9e98f782b827e0ad1ebd1e455663ba68b6e035e1fc2e4d049ef874c2e79476c8802925866d19a87c5ad1f4b833c03948
SSDEEP 12288:YSrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:YrBMvjRA+iqMIjmJ8c+hE
TLSH
T14A45233A00A90F46FF323B3C9DD657A2C244FC7EF651A207B61A719B633D1E4284DA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 8a4e5420c1e9a3879c4ffee69df5dfe0f0d7ef481d81d017c658a631ac84259a
MD5 e42d36581b569e60f79ac516488536ab
SHA1 aa31df0c5b064f101cfaa6f094ce33c08d89f5d5
SHA512 5596ce01b4c137dd8abd00e17b68f4d9141fd1f2da8ed012bd0c0380c598af461e5598df9b02add8306f13e6206dc6bef1f38e1546b65a4129108e5e10a0d41b
SSDEEP 12288:hiZwbDzzFEoS2cPvy6rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8ti:kZM3zFVSOjBMvjRA+iqMIjmJ8c+hE
TLSH
T1F465016573900CF4ED63823ECD568A16D2B2BC6A5770C60F13A4366B5F373A11C2EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0f5b387986c053065968f2cfb2e1eca4baecd018a74eee719279c176dc7b636d
MD5 cee649a6b51cda626cad756ed44a58cb
SHA1 59c960e516b55151e0ba523179df12d4bc56d620
SHA512 af8285bf612990a3096c9158f08a996cfe2bc957066079cf66041448c83a825bad1d3fffb0d6fccdaadb2f695a88e75668be0a29a115125a5c671f1327f55e20
SSDEEP 12288:OjrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:OyBMvjRA+iqMIjmJ8c+hE
TLSH
T1DF45233A00A90F86FF322B3CA9D75792C284EC7EF651A203B61E719B573D1E4284DA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 742b91989c162ced6de24bb3b7489826143da63f7bdc3f22d4f36a826bc0d00d
MD5 307251061bd08d91ac25d2aa648e2e7b
SHA1 fb5dbfacee2092a6badee239ab3db21a6e74a722
SHA512 48a46759b6772fcb72396120251b3fb2a283cb73db6ae68621df4e4babf045783f169b9bde8438635a9f1df4cd8452c5ece653920dbb1eeae44e20355220a843
SSDEEP 12288:r/rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:r+BMvjRA+iqMIjmJ8c+hE
TLSH
T1C945233A00A90F86FF323B3C99D75792C244ED7EF651A203B61E719B633D1E4284DA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 3872855abe0c7e3d0210eec857eac7409ba6b11459acd7b0a30061d750e43eb8
MD5 f7790128dbb6afbc6cc8a015a8954787
SHA1 a1544e38d7122ecf549498e7c72376b424dfc94a
SHA512 6a19123793fb27d622282a44bc6ba94e2e766aae2ac401a7ab299f7bf7873add1698d976e525b88f20b96f90e51bb1dec2ad6bf4966b18c013bbea834a0afe44
SSDEEP 12288:FyPz5L82rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:MzyvBMvjRA+iqMIjmJ8c+hE
TLSH
T1F155021722A521F9E5335238CCA21B52F372B83657209A5F676417BB2F372E05D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 0896bb884a7d356d73606f21fc229b2ae472df78f3f0e046774807cdbd984671
MD5 75c5a7890cd4c6159faf773c6b88775b
SHA1 223332335a83a589c42b3639bd1b0681bb4b168b
SHA512 668f08e83a2d565348e426107a4e637c0abca0f1796e92de373bff6cae70991f2858927c0914affd2728baa6c5049d304727839e30431525dc569483fece1331
SSDEEP 12288:pjrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:pyBMvjRA+iqMIjmJ8c+hE
TLSH
T17C45233A00A90F86FF323B3C99D75792C284EC7EF651A203B61E719B573D1E4284DA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 7d6ac0687589d6ff7c4661f5b13e3131ed8f855f8a35e0423be897cb4fd1329b
MD5 1125f43bb69dba3c5a422fce31b9f1a5
SHA1 fcdab65f3dbe6afeda715c07a4ff07d32d012bf6
SHA512 9d667e4f1cc76bac59208a7b6e3a024205b385c9c37d9dc3f7f7772346afcf82731f88565ca72dd46b655d28ae703284be98523e7e48e11852d668ce2fa67dbe
SSDEEP 12288:LjrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:LyBMvjRA+iqMIjmJ8c+hE
TLSH
T1DB45233A00A90F86FF322B3C99D75792C284FC7EF651A203B61E719B573D1E4284DA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 843094885ff0b4a28862c71ab69c12f131de6e1828f4480e5b3a56795148701a
MD5 bb5886ec9653f7ab769116947cdce1f6
SHA1 3282e32d34f8d9820e09d6bf06706f189521f066
SHA512 393d2c5bab2137c512b2e829974c163c558b299e22536c3ce97ca9e684ce2809a3f27b92ab40b19611e00f1c2d24d75cdd278594ff0e4353402017357096f2b5
SSDEEP 12288:zyPz5L82rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:+zyvBMvjRA+iqMIjmJ8c+hE
TLSH
T13855021722A521F9E5335238CCA21B52F372B83657209A5F676417BB2F372E05D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 02ec7a4cf30b41232c343d32654985b2193f090c2a2cf3f5d63fc625517e73d3
MD5 867255d4ce3a52619cf3f039a57f4ea0
SHA1 d08169ad9c8696c709e392ba6f0ee2c45fe32dd8
SHA512 1f25ad2bbd6dfe313c312fa5cf9e49ab4308bf57f0024c4907f49f3c080694ee5e8483ec5d2abca680e64dd2bae0fa2b8ee79052b8b1bb12c968b2164b51d9d9
SSDEEP 12288:OCd91WYoaLHF3z0z04PDvhErGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8Y:fT8aLl3z0zD9BMvjRA+iqMIjmJ8c+hE
TLSH
T16C65026573900CF8ED63423ECD568A16D2B2BC6A5770C61F13A8366B5F373A01C2EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 8232c50ec8e72f2a2a40c601d0b414db6e6d0d3bb267b70e6224d7a9259c384d
MD5 a414e1f248dc602623f82b8d843a1726
SHA1 9f429b1f536cd23a9f1720df19830fd3d6f4dd33
SHA512 01528fa144dee23134fba37d6cac118867a8ff4efa5feee2c38e1ae6c5f3b5ae7b7824ba3f646b6b972e1ce7d8276e074fad89b047c7357b317ed99ea3d377ac
SSDEEP 24576:J3rd9CHKy7GZhBMvjRA+iqMIjmJ8c+hE:Zrd9CHKyaSv1PiqMymJ/+hE
TLSH
T16975DF90B3E414E8F1B39A35CD764512CAB67C5A1B31DA8F13A8265A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 0983834e68090c96526b0d7ed4809ea940e1998ebccd0b1c42eb7245f650cf6b
MD5 51f54c7f3adc39738b7d604573e1bdb3
SHA1 87aef4c2ff6f0c7a237eb978bffc1525d1df58e8
SHA512 f916641fd1d9d93c5fab924af1bcae34e885dbb01471be95955533c9fdd72541db4d84ae0e446fb4e11653111a3b8449c961475a22f51dd89c50f8dd99414af0
SSDEEP 12288:s0rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:stBMvjRA+iqMIjmJ8c+hE
TLSH
T14745233A00AD0F46FF323B3CA9D75392C284EC7EF651A203B61A719B573D1E4284DA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 0e837cd5178b36071c4756e881b92bfcc91920db797bfe20388597466b0a204e
MD5 e1e19161ad3330298b81564e3ae1c844
SHA1 75f3f0b4cf9f1e693b099aadb4713d6de3cbfec1
SHA512 042b34e7babe877d57d5c99c4c5847adae3b902d6eb2ea1392d0ce34b1ebb845684499a3013bfbe95defd90d9601cf1152ad17c4108cfd5bc34e9a39dcc877ac
SSDEEP 12288:MWrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:MPBMvjRA+iqMIjmJ8c+hE
TLSH
T1EE45233A00A90F96FE323B3C6DE75792C244FC7EF661A203761A719B533D1E4284DA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 b918f26c63ed65e26ab68276104e0552e0978cd2f43e81a7649b6408c534a6b7
MD5 f81c29683635774230b1ff4ad214eab8
SHA1 5e823ede5220dc3fe79414544fe330dcb0f854cd
SHA512 fba5c79b7d065fd69b2796463d215d587e89b77966609d19437dc5c5fffe28ce3a86e7d354d54e8a0db1369c5df15fa3bd79a8ecc7a30c373f2295fc45191b2a
SSDEEP 12288:C9rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:CEBMvjRA+iqMIjmJ8c+hE
TLSH
T19945233A00A90F86FE323B3C99D75792C284FC7EF651A203B61B719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 13745a84eefef941a3a2ad53c2685b43960cbc58505fbedee71541f35f03c66f
MD5 ef77cd96917f91fa36d5aa5957a646f4
SHA1 cd66993fb33d9160e274a6d61fbc96337e64776b
SHA512 13e4076a218c2510aad7151c660766235277f7e091cea6bf604119a86af896daf84d49b6e1298dd8fdbd27828dfe654fcf361fa35203fd9761327df432fe8b6b
SSDEEP 12288:CjrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:CyBMvjRA+iqMIjmJ8c+hE
TLSH
T15A45233A00A90F86FF322B3C99D75792C284FC7EF651A203B61E719B573D1E4284DA59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 73be559a8c3d955f22614944116223596f4cf7606baa762906ae0f4b5e9946ef
MD5 5605b48d8953d9b3d2441eba29bb4771
SHA1 371f2190b8e924a6715f9493bba92d629cbd778b
SHA512 3e2ef6b57f2843c038350b9ffbcacb53c5eb76e8920c31d3a5605849e3094b5ce68194c7fa09481b672d58f64947a3d29a6e2e36b2fa3bb1061b74fed7df4337
SSDEEP 12288:r0rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:rtBMvjRA+iqMIjmJ8c+hE
TLSH
T18C45233A00A90F86FE323B3CADD75392C284EC7EF651A203B61A719B573D1E4284DA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 626ddb7d42db7049b58f63a466016b74a145c18aa73528e9e44c76e37f98c61f
MD5 8df3e1e20c0096f30ac35872feabeab6
SHA1 8b0a4ec6a29bf01c6a4396ac903e185010faba81
SHA512 cf04cd6d07f3aef68f778862171f6373695aabbce73fb657a89f1d438cdaecf09c80ee3f8c2f5912558996bf4d93e680ff94af547ffc2f13ac83878994d6405e
SSDEEP 12288:+7rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:+aBMvjRA+iqMIjmJ8c+hE
TLSH
T1C745233A00A90F86FF322B3C9DD757A2C284EC7EF652A203761B719B573D1E5284DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 eae34e4e55600fde3fda0593d4f2b906b54a51152d325365675070806b4da716
MD5 41a8654022c2028303e9395e74d50123
SHA1 17c3f18c48a6124a871d7188471bded7f4208991
SHA512 12a3e8cef928267e9748e546cd0b4d94325643e7a7da11fdc07f3bc3cac578306b14ccef6cba8a0b47ba2fa3ccdec367ecc323dd1c860059ab664a64ca282d6b
SSDEEP 12288:kJrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:kwBMvjRA+iqMIjmJ8c+hE
TLSH
T19E45233A00A90F86FE323B3C9DD75392C285EC7EF651A203B61A719B573D1E4284DA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 1da6fc9ff0d0fd9c506b9baf92852bc9cc88075ab9c1f63bd014aff521bc0683
MD5 01dc115d0ed4aa99934c341a8253fa9d
SHA1 e9dd161a54d84ef7c4eed62e073f148c2492cc54
SHA512 c3345a39c5486005f244ff28a46229dc7576f79a0ac17be51c19065ebfb278b5252ec2459ac8df6cfd33a0d6fc528bc23ab6831d5b69c41d1e1c4631f3403546
SSDEEP 12288:k8rGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:kFBMvjRA+iqMIjmJ8c+hE
TLSH
T11145233A00A90F86FF322B3C9DD75792C244EC7EF652A203B61B719B573D1E5284DA19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 1e23600913e23c64dfed229ad1a6ac2caeff2c7348554d4699c22f3b60f11b78
MD5 c0b0560a72dd579e6bd33f62728b9255
SHA1 e1a052086fbbf92da70c52a3944794d3dd13a1d3
SHA512 4fa89da1cc2567798af6cb94356e98371ac2b525ccf18e5d5408807c72d62544183912f0f9e3c715022c34a7e008f3ecc4f6c0631ec24daf7e1f5ba65ae0ea89
SSDEEP 24576:Rfwvzk9RX6wkyAIOBMvjRA+iqMIjmJ8c+hE:QMnYI1v1PiqMymJ/+hE
TLSH
T10485CF29EBDC04E5E177923C99B7460AF2B178691B31C2CF125A53AE0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c70ed41ddc8f0487d34d7221807057db2e153fc478a360b1744f2985cc6b7b03
MD5 81edb2e4d27bf123cf8fba172c5fab9b
SHA1 50b72033e7906d9121b857aa6db9830a149f2c4b
SHA512 a5a8a3423b3d1dc65379c5c989c328d61307832d163989b7d39b239ef462020d9809f780858fae4c32d6ee4dfe5b74256fbe44efff04ad0c9d8fc0b73223d7df
SSDEEP 49152:7YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK08v1PiqMymJ/+q:GySzPktPiqk9+
TLSH
T1BB066C56A1A801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3274fca4c7ed3636681a64db2dd31710a3243b10a10e154aa9a1d06e574309ac
MD5 9e613dcb5cc12aa79be75a531c11bf15
SHA1 b52f6ec6c16a48ebfaeabed6c34c313d09eeb060
SHA512 236bcdd18991addbf72cc7b37d6e16bf45808bf720497fb9b6dbf3201994dc834a099e8442c22e5a48c2106f484c08481fffc22429e1e8440620d1d2a83183e5
SSDEEP 24576:Y47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYzBMvjRA+iqMIjmJ8c+hE:Y47JUQjqirIhCnDHUPfF/Mv1PiqMymJJ
TLSH
T1C765AE1EA3EC01E5E1BA927885154A5AEA71742E1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 9975d2a2e01111c134ef967d6ec99d4618eb45eb1d31c5c92bea59084dd8615b
MD5 d8042db1811c9490828518b244a07194
SHA1 8fcdc546116c1a51f64cc41b1a62399fd9a5cf1f
SHA512 cf0f6ef89728f0a6f0ed931de59d9ad0a66384394fe8ae586ce7d903635f7f93950a3d4e6a545799d47fe7e6866be10a4b488306a53e65a3dcf5c3c7cb4f7417
SSDEEP 12288:apsfTrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:ziBMvjRA+iqMIjmJ8c+hE
TLSH
T1E755F11AC29802D8D56E6239CB964641F3637C2993E1D3CB62D0F57E1F3A6D05DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1004KB
SHA256 496c194a82c08dba7078f207797dbf962655be71a4c14ae494a50c60d06e2a63
MD5 c0d674a359e78dec559e0bd116b298c7
SHA1 4ee4335f47a5088204872134272f0c001b2bc251
SHA512 96fefea62b4079c620914df9e42d889ded3084f929977f88362cbd7cd56a5fea05d567443dd35b81bb949b212e4c4199100b78969d18fd9827a0566391d811b3
SSDEEP 12288:HuhszAU3fNG8VEBH4ZYdc0KrrBTyKqaAFWmg5i4fh:HkssUPNGbBHbcxr9yKqaX35i0
TLSH
T1DF250650762BC75FC6A940325E32D1CCA7707D41EE05AB0372C88B3FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 5fc4bb7fa3d024c0eef9a92811d655f0c4a127226cd1f03fb3bf9d8d91bf5c4b
MD5 13f49e60dfc2742b26cf3a96560b9f82
SHA1 86f1def09185fba4ec661347815251403d3aa47d
SHA512 7935ce90346222c95bbe12485271397f163d7cb632b215e25fb70d2a7c47ab7f2ab5504e1447707456066f7d04aaaabd5a98dd16d681abdaa63b450b5e167bf3
SSDEEP 12288:Nljb+W4OAZ7o8S3e/NSjsFR1cBgqejjc0fwZoCGdXdbqL0HkVuahz47VKixR5XS2:Nljv3NiPC5A/d4ukL2
TLSH
T1E055C781A137E38FD1F76031472A9B4CB7A4EC4777095F2673C4453AD82AB66A0B83D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b26bb8819a721a054aa6a951bbbbb7f6ef379509939b5880955c767bbb7e2e4c
MD5 3634317525c1abe77bcecea713f7a91c
SHA1 fb0887bb6847712376bf2bbac5790a5794f411b2
SHA512 958d9c2742f12770858413335fb6384bb9daaf1a813bf59206c5c5f46310f8dfafd20e5a0c239b34faf11b88b2a42d0044e4c4812e86dd747ac5da3fb380b968
SSDEEP 12288:QM7rrGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:RKBMvjRA+iqMIjmJ8c+hE
TLSH
T16845233601AC0E46FE723B3859AB9332D249FC7DBB10E183B50672DB56395D46C69B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8b25b8cfdbf26685f47c325f132960d26fc69d2baa910c50bd6ccf6fc69595bc
MD5 9ef7b0a162dfa01ebf4aafb32a9bf884
SHA1 a5626bc0954728e1e10e9a6aa91afa5f36f9c752
SHA512 30ac8cb4c5a4b8d7e459284bb3e98e1ad78cabc6566f504e669d423f4d3192ef922f30396833bbf304d7ff24e40aa4be9f9920eea81f62f424085d701ec0ae30
SSDEEP 24576:Ggb6bmBIi49WNNFpg1rSvFv7bY8BMvjRA+iqMIjmJ8c+hE:Ggb4mBIBhGFOv1PiqMymJ/+hE
TLSH
T15F65AE1E22EC02F5E0F6E2B8DDAA4417D6B278161731D2CF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 1a6d0164d49728bb3f39a40e3885913b6b2cbbfc6aa886207ffb283dbc218d32
MD5 1be61388238ee5728a9f40a8f955de47
SHA1 7fbf68d5ece71512f5136b78f1314bca44a99a1f
SHA512 705569f18001858cd27262242e4b49bd7beb418b15214fc3ac1bb24f3902205f5fdb76139e52cfda3e0b5b48886ffccfc82e68001110123b50c9b8ba08a5857a
SSDEEP 24576:9G88u8FpJqH1vzria7/mjBMvjRA+iqMIjmJ8c+hE:Q7ZFPqVya7/Dv1PiqMymJ/+hE
TLSH
T10E85F12566E102F1D477D13889864663F6B2B8251360FBDF07AC8B561F23AE50B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 e6bc07acd9b3b45c02bc369bd63b004e3e2e7aaeb3e27d095e2f75326b3e5b2c
MD5 e14d1af1c671794e7234554ba69a97e7
SHA1 4abbc9844f83db307ef8d7f987d3c8e12a87a3a3
SHA512 2d2d67dca6a4ed644c3e205761c08add6af16c9b0462925accd36c607ed394ccf5837513259abe3189b17b8a9369ddeaa27790991fda50afc76276d1658b37d8
SSDEEP 12288:cHvUrBFrEjwaQerGnBM7L0upU+1y+AYXmUbibGqiMIjmYP2Fucf7N8zzI8tEV:cPUr+NQnBMvjRA+iqMIjmJ8c+hE
TLSH
T1DC65E12F21AC1CE5E676A17C89868719E771B8661312D2CF02A1817F5F37AE87C3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 fd1e6595a8f93c78bd96d2dd22ce6e7e0ab0de07159fbfccc2d032b851e1647a
MD5 3a74e6b486ae4408f95d66987f7afee3
SHA1 0b4ac36ea9e3630379c4c322ae25173283402d04
SHA512 009955cb536ca4fcf2d212704ee02e1f31ab4ea275997b5139bce95aef07e28f19fe1780fc3345647013a222ab17b65887e907930574e0ec4e7f5edb219ff5f8
SSDEEP 49152:oBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjCv1PiqMymJ/+hE:DG05lO43bNtPiqk9+
TLSH
T15BD5CF6E62EC01F9D1BBD17CD9C6460BEBB23825033556CB02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a97cf25fa067e8671c2d99e76657c5a9ff72bd3bb4e159f1280ebc2dfa805519
MD5 be213527e6117d3ba8c292ad29ae85c0
SHA1 05281af2cc5efabdf8f2640579971561d5c2e143
SHA512 aa4e8f0b18e73518265c3e2e2c5ca17cd24201fc5042a2687ddd0c35887dd5dc2b7ff62a3766fb54a5eadea68c0dc79757db12816aede9d38a335a85b5b17c34
SSDEEP 24576:Lfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnpBMvjRA+iqMIjmJ8c+hE:Ta5POZ3lJt2pasx2+mKv1PiqMymJ/+hE
TLSH
T18565BF5EA2FC01D5E579D17CC583461AF5B1342653329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e81d6c1fff68593500305fc4f6db509d60c5d5ee32257edaac9d60bf2627a3e3
MD5 a0bafc2712fa8b68c470bdd6936f842c
SHA1 af0174bc22a2bb995cd166c137383c53cd091179
SHA512 15021baf5ef8702c88b80f82b9fe12f8774a11bfd235fbf9c13a442efcf6dc81bd95d4db1e02b17ac6b85968806f9736cb9a4ce3ca0a6edefef2f8a5ce3fead4
SSDEEP 24576:mNcwHdjbyQ4nLC18lb/EOjowL7FkbBMvjRA+iqMIjmJ8c+hE:mNc/zEOVHFjv1PiqMymJ/+hE
TLSH
T1AF858C2622E901E4F5B7E1BE89779646FA717869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 217c740cfc3aa3792504a94cef2f99e166ceb476135ec34a26b4210923094273
MD5 e8b22b862b71cbdb25491a1f18aa552c
SHA1 f8bbbf5414b95297d77c4c55208469ed54b732db
SHA512 e910300d7b9c28a1846943dd9029142161de9cf5316e0df5dbcb87be02eff877ced24fe127b5e5a8fe7c52e89da7d9e2d9168aa94d7fa36b8aa172d986f1b9dd
SSDEEP 24576:xzkNvNnaFeYhJNtmZBmFBMvjRA+iqMIjmJ8c+hE:xzMwBtOmIv1PiqMymJ/+hE
TLSH
T18855AF2EB6F806E4E1FAC6B4CD238512E6727461173293CB5290C13F5E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 8ef9e53c5b55ca6b32c80a3fe9b57762ac2eaac6214f0b5833c15adc5c8eb259
MD5 5868062d767738aeda774ac6ffccb9b2
SHA1 324900884ba0cd22d63f9bd628e7705b6df50967
SHA512 f297d275f339285efb0488e3ff0512625e5e03392c94935ba2cc11c73c350e30d4f2710ca95ff66780bfc9991cae9ba8f1c107e4daf132a28507e61e0935f4e9
SSDEEP 24576:5D3FHshBIYQgAmBMvjRA+iqMIjmJ8c+hE:5DVHeBIAAdv1PiqMymJ/+hE
TLSH
T10A75E13DE69C04E4E57BD17CDA638606E37178AD032266CB129491BA5F2BEE43D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1764-114-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1764-120-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1764-314-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1764-112-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1780-65-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1780-72-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1780-279-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1780-71-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2684-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2684-132-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2684-135-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2684-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2684-126-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2884-54-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2884-250-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2884-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2884-60-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3304-76-0x0000000000400000-0x0000000000600000-memory.dmp

Download

memory/3304-0-0x0000000000400000-0x0000000000600000-memory.dmp

Download

memory/3304-2-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/3304-319-0x0000000000400000-0x0000000000600000-memory.dmp

Download

memory/3304-8-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/3400-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3400-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3400-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3400-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3428-43-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3428-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3428-44-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3428-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3428-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3428-38-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4148-83-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/4148-82-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4148-77-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/4148-294-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4880-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4880-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4880-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4880-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5020-21-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5020-87-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5020-13-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5020-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5020-20-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5072-378-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5072-89-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5072-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5072-95-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5072-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5072-380-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5124-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5124-312-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5124-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5124-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5124-101-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5124-107-0x00000000006D0000-0x0000000000730000-memory.dmp

Download