dab9a5e2042c43950b28cb2a277d9ee70607592bb5ccf85b3694a9727538d959

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_ed4977f55263341bf06e26a3645b43a7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 1.3MB
Sample260807-adnl3stdqe
SHA256 dab9a5e2042c43950b28cb2a277d9ee70607592bb5ccf85b3694a9727538d959
MD5 ed4977f55263341bf06e26a3645b43a7
SHA1 0e5ee4e73f08cb3d7ae9700294071bc1a8e10ab1
SHA512 648bc16d73046120257943164e199aceba159c2cc6b324899cb0c6e2f4d9b71845a484c0252d77f25b37d5c3e84674ea1049b18c3bf991cb55f0c3369e45e24a
SSDEEP 12288:Y1i/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:pfnQ/tbw/2Mkjy6Fr7g0o
TLSH
T17B6523297550F477D91709F55892C581AB3F0D826FE5A38F7B88223E9B393D00AAE385
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3316	elevation_service.exe
5568	elevation_service.exe
3896	maintenanceservice.exe
2060	OSE.EXE
3764	PerceptionSimulationService.exe
1280	perfhost.exe
548	ReFsDedupSvc.exe
2012	SensorDataService.exe
4292	ssh-agent.exe
1200	AgentService.exe
2720	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-06_ed4977f55263341bf06e26a3645b43a7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-06_ed4977f55263341bf06e26a3645b43a7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\798736ade62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-06_ed4977f55263341bf06e26a3645b43a7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-06_ed4977f55263341bf06e26a3645b43a7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-06_ed4977f55263341bf06e26a3645b43a7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-06_ed4977f55263341bf06e26a3645b43a7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-06_ed4977f55263341bf06e26a3645b43a7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-06_ed4977f55263341bf06e26a3645b43a7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-06_ed4977f55263341bf06e26a3645b43a7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-06_ed4977f55263341bf06e26a3645b43a7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_ed4977f55263341bf06e26a3645b43a7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000024f273950026dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cdc85fdf0026dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004bb01a940026dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b2e15df0026dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3316	elevation_service.exe
3316	elevation_service.exe
3316	elevation_service.exe
3316	elevation_service.exe
3316	elevation_service.exe
3316	elevation_service.exe
3316	elevation_service.exe
5568	elevation_service.exe
5568	elevation_service.exe
5568	elevation_service.exe
5568	elevation_service.exe
5568	elevation_service.exe
5568	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3556	2026-08-06_ed4977f55263341bf06e26a3645b43a7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Token: SeTakeOwnershipPrivilege	3316	elevation_service.exe
Token: SeBackupPrivilege	548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	548	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1200	AgentService.exe
Token: 33	2720	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2720	SearchIndexer.exe
Token: SeDebugPrivilege	3316	elevation_service.exe
Token: SeDebugPrivilege	5568	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 1944	2720	SearchIndexer.exe	100
PID 2720 wrote to memory of 5612	2720	SearchIndexer.exe	101
PID 2720 wrote to memory of 3216	2720	SearchIndexer.exe	102
PID 2720 wrote to memory of 300	2720	SearchIndexer.exe	103
PID 2720 wrote to memory of 6052	2720	SearchIndexer.exe	105
PID 2720 wrote to memory of 2272	2720	SearchIndexer.exe	106
PID 2720 wrote to memory of 1460	2720	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-06_ed4977f55263341bf06e26a3645b43a7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_ed4977f55263341bf06e26a3645b43a7_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3556

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5568

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3896

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2060

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3764

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1280

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:548

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2012

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4292

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1944
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5612
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3216
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:300
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6052
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2272
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3044 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c513aacdc82ce22a6b0ebaa60c67d8a407b2b5e33c3f36c2f147b44e36b60de1
MD5 07912a687c4d929e2f98a1c995754229
SHA1 e4e0d489789a18f4a1b5675528ec391a62cfafcb
SHA512 2219741ec3210cec62be37f036b4c8e4de6e78bd4eaa9e2a89188c26db9992d7ab693313b323e0f44b32b25a361c840d3ae55ac70ac50af645bbed67b76f8dfd
SSDEEP 49152:Kb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnDQ/lFTjN4:83q6HjBHLm
TLSH
T1FED58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 f1327885d73b93ad0481802c5ef6541bef261c1c1955a44d0517850b203197b6
MD5 c32c0b9a8e96611e2b169afa0807ae71
SHA1 1e033980c1c569d41e6b99b17cd9691f75983b95
SHA512 2c6d557ce241fb5507dcd6cbd5dc1199e5338e66fbeca9e8dcf7fa31a3b04b0c89f7dcea8176e143fd526b63a34e9124b077617d540225f38a97b672b6010b60
SSDEEP 12288:R1XLsswWkxy2lRq2czAwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:fXYfDtczAQnQ/tbw/2Mkjy6Fr7g0o
TLSH
T17C75F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 17e9ff929248bb54e0e8b5d8c9a803a1e598f443c8d43483bd1f15d5d06c5b8e
MD5 991134400ee2049f5c610a20e7186566
SHA1 21686efeb07b5ccf20481744dfb8f49a079a15d5
SHA512 2e206f22b4c493e4939c9dd8b8b4c15d5e75bbe14dc56c29c2bc21879cfe34d96f68c0ea329f9e1c807afa3f6350248bb6fffea5c62efc7f089c0a7a397b85f9
SSDEEP 24576:20Le5ji0hmxmrMcJnQ/tbw/2Mkjy6Fr7g0o:2Pji0AoLQ/lFTjN4
TLSH
T1DA959E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a5d71088714c9ef55f26f59672eb77373f6b81b468ae53b356ddafa01b2d793e
MD5 c79397371fe2d46e324f6230ce0cb586
SHA1 aa50c96c02e201d62573a88d9791934342038ad1
SHA512 cb5ec4d126b2c6a7956b933150ef3b2d30a7aebb3c6882af2f708505844414c4d1f9c42aa6d2c68843b80c199b510f9a12ebfd05b6acb55c1a6ad8057a2105aa
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWE6q8wyuOJnQ/tbw/2Mkjy6Fr7g0o:s/ezSC6vUzPvxHjy3Q/lFTjN4
TLSH
T1DA755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c679269af47eada86eb5b39d26ba3106d88eae463fab890c1f38e16b64b16d95
MD5 84517daa7f3528b7847d174344d704e6
SHA1 484aabbfd3e90354e6f9f77697be1f8f7aec82ec
SHA512 be024fa4eec72a5db02ea3437ce27d1d6df6236e71dfa039c51f3086b54bbe25d808787af17b18341c3b206065a88796f85a34991284fde3cd9bc9fbc627f635
SSDEEP 24576:ZVbqPb88hv/l+6rJnQ/tbw/2Mkjy6Fr7g0o:ZVO88hXl+iQ/lFTjN4
TLSH
T197559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 659fb7e74b22c84b1949180aa46ca85ffd84e9ee3a02c0fbf617bfb43aa54f7f
MD5 a1d16480ca5ba688ffaa7f3e106509f2
SHA1 6f0c4583e8c22b8118e4c0c812a558dac4f1c7b8
SHA512 eb9cc76abf73b037fb26e8f86b3bad368457a63f3fe343b861cba55c25f00c7c8a6fad4127e1bcde834ed3a5d51952dfdd9c98b05f8f6263e0905a20f83f0d31
SSDEEP 12288:59A5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:59AJnQ/tbw/2Mkjy6Fr7g0o
TLSH
T11C5523696A24F887FB2B06F15CD385826B7B0DC1AFD0A74E6B44322DC53C39446DB785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 2ed09d8c69b3a66a35a8d262a798acbc6b3561a46dab67cd614b38a5bab61fea
MD5 5d274a69ecbfae96f3848d30dd02e344
SHA1 b50cd906595ae166f3a3a2c052b86be6916f37f3
SHA512 3b3aa8406388938e94cf5ee4fc64b9e98d660146059bd3d2cfb8c8daf7b6f327d27a2177cfe265ba2eb6d7492d257f0653df775642e0826c91c561406d2f38d2
SSDEEP 12288:PeBNUbTVO86UT5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:PJIUTJnQ/tbw/2Mkjy6Fr7g0o
TLSH
T16F75CF3BAE28FCD2C27E4DB85A918640E77278704F51A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 19ca0583d72c3acc1548d222a9484d6a3ace4ce753003cf367ff3fe504affb3d
MD5 7d45d5d4e141190f07aecfca83aeae22
SHA1 bd2755d5fc3b71098ee14a65c2a68d0cb7147dad
SHA512 be1cb308f282ac99d0228d70444c21134350cc96bd8dca1ce9ea8f2f8872cd3562cabecf62544ab00cea68aa10fa1fd4887761e04ca99f20b86034334d1b8750
SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THN:zQvGAdlCEL8c/yRNw5CnLm
TLSH
T196267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 86c0a8e7788a1b97cee571635f273360fa1142f8decf59f1dd7e42ca126fc430
MD5 7875dd4c48c09c89baca73331278ae6a
SHA1 2cec005390d96c087b0b454eb053007382974e3b
SHA512 bfc230890e077587a03b72da1446aeaeeff7155de288d3f649d86dae9b43168531b4c20369c2952954de2ddeca80f0fe178a2bcb688a90825ed79889509a54d1
SSDEEP 12288:MAwSfxL/2Dc3kDLLmt0LDQewsAjF5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJs8:x5ewsAjFJnQ/tbw/2Mkjy6Fr7g0o
TLSH
T18485E031FE74E436C77F0DB21B26C706683D69604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c039c7c3a27a4f9af92a2764dc3db2e32b22a598678acd6cd5b9fb97bb392af5
MD5 a31fa7e1d523542af3670994e13faae7
SHA1 69318d14c131b61a89feee7552bdecc8b8af10e5
SHA512 e4ec0377b135f12a37532ba0760efcc1cafc44ca271ef7985f19b8797a7db9b904c30fbd12734e6e65500b6804cab9f3f57aba0e1d1f81cad61841514ea522bd
SSDEEP 196608:KUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHYL:KUEtQevvqc2W1cpV2EI32
TLSH
T11E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5cf95b2d79ed1440990f3494a8ca9aa47388b14fa00a7e47ae77cedbfc6eb0bd
MD5 ab39531bf6d5cfff7c244a423db3b673
SHA1 bc6506141cfb83130aac656e06cbf2c571761ec4
SHA512 88c58a7bdd2ee7b0da4420d7a900f77be05c799d8bf073eed49bf9c3774693ec0dc0f414a2631205a5a464b0e84ccf5a785279287c2df6af40b962a3be29b807
SSDEEP 49152:JCbRquA/m2yL5zQfFiV+XenmE3/zbQ/lFTjN4:GoqtVjnmTLm
TLSH
T115D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f08cdbda2d0de92c29fcf13d60408fcdf8ef8ebee77ca80bfeca6ca2e924587a
MD5 2fe7a3838337ba2e2c685dfdc9966cb6
SHA1 8115819eac34bdb7338aae84c5d717ac3ae15c99
SHA512 38fa312cc0f6a53a63506e0603a6ecb69d62afee4e7be7a252cd66c208ed1708f6e3f3b8e2b6c4fdd55e90555d1dc3184bab8223fc468cc144818e1ec5fc5cba
SSDEEP 24576:jAhGLJIFoiwtA5l7S53KJnQ/tbw/2Mkjy6Fr7g0o:jAMyFoiq5wQ/lFTjN4
TLSH
T10F35AD80E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E37A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 2bc102aa22493b7203a4f137314cfeafee3c4bb319ee746d1b9eed33c6aa2b41
MD5 d3e8963b34a2a2886771e3769ec73453
SHA1 054b59c28eef2505093bcdda5d544c9dc611b1c0
SHA512 81665abba90c6109112646f8258a172c91f940cb48b263fbbffa60f770a7ca44c97aba9516e1edcb00d63444ff125f8d12beaa8d0206bf71b275f89e94dc4e86
SSDEEP 12288:amw5HEjsChNZBFgl0WDm+CVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:zwu0OWSnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1A175F14A36A41CF9EA6742398993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 55546e398133e075038ebba476b5a7422f6c2df736ddd335dd99bb65631f1ca9
MD5 acc03136780632a25a167648eecb211f
SHA1 c639c5c0e01877ef6a3c1abb133399ee78edf4a0
SHA512 99f3ba49dbaa49ce11a6c5132417ab9dba820503dcb0dd57663882daa0f21a2176feb695c3540ce1050d7406ad34b1a63a1f8b317a0778c4939b1d5688145958
SSDEEP 12288:J1Z1Iy15GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:jZuEJnQ/tbw/2Mkjy6Fr7g0o
TLSH
T11B65126933A470FAE6674278CCE28646E77338826BB193CF275442695F3B7C11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f7d0fff94d904b075d131cffab2f2204b73d28a8f0174611c1a86b3cacb4e999
MD5 219f64d58ecd1a1041d3dfb2b079101f
SHA1 5bca33b502ba263fc89e9b5efe805010238a48f9
SHA512 2e1e2abe81e73680e6fb71e27ff91029bc34b628de7c95076ee35423de48bf1aa3105a8a42244a1660d5bbbb37248bad8a62ed052c36fabe3dd452845c7d337b
SSDEEP 49152:Bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Up:IQRQyi36YOcPQLvw2gAf+PN3WLm
TLSH
T1F0667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6d5786d379420e4d57afed485a707d3e529388fa3c41ee64673c6d911cc76191
MD5 a66f2c60408c5888bc7d3e1805c1f82c
SHA1 0346f842dac1feee6a1afd4abf0636e68283e323
SHA512 3c80ffaa053673a789175e7f92451109df89e1fc5a2a8eb0c6979c5734369b9541b2456aad864a19260aa271b5aed52583a3aaaf01c24da26718438721f5c03d
SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Up:UQRQyi36YOcPQLvw2gAf+PN3WLm
TLSH
T1D4667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3a4107a6e33e293399ad6e54426053d3b49b3b253060452ccd1e0d98ffe381af
MD5 17d8f2e06de8feb7e9029deefcc077d9
SHA1 537d74c2f956de629b653541bfdcc87f642a8b40
SHA512 4bd6033d063718653f70980e8169c761bc1d6265905868f1e76886e9d9e0e86029eaffe14abaaa57e6b17aa1dc1c2cc18b3340558c7469e12271ff30ae12e91a
SSDEEP 24576:YwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0UJnQ/tbw/2MkjyZ:+68Qg55nhheWu7PNU3/LQ/lFTjN4
TLSH
T1A7B55A33B2F60099C44DE1769F46872196E27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 73848ef6ae434ba114bcfce8d74b098352ed474346c8c35c2ac80753a887d90c
MD5 b638ef41962066289c38c1cfaeff2e7c
SHA1 3b89e70910a59c2c7f657514013ee71c8d02f973
SHA512 118ce9a0d5ffbaf53ef070ec3f8789efd0b9690070a7bdf190f6226f50dcc900e90b338fcc6088f4ddb951499fa48526fc2774c072ffb2404c7f940649a3ad4f
SSDEEP 49152:93aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99T:sy5112gYy5azzVvL69nLKnhZVLm
TLSH
T17F167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 88f14f1ac28ec2d7a47ff107c1f766f9fa566edeb2371f2ed36dc67881c9f58a
MD5 7bae75eb67570ee776fbd2b957e4a5dc
SHA1 79e029155f21195877bd62ea4e95113c4e28bb63
SHA512 53c2aea1c96737c54e6506784fb1c2122e8fe5ddf0dac91f50e34e1d750664e4cc75323416513c0a2d44c412b30fac190ea12bdf51e404404ea7a938d174a769
SSDEEP 49152:KB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glgQ/lFTjN4:Yu6JmVxd2dzLm
TLSH
T128D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 841f302c43a577eadca2e590e4bbe3fa18afa96fa86235af7e0bb0258b78fd4f
MD5 d77c93340f901069b9cfce6b1388ae46
SHA1 35a95ca3271ed6b4ebe2fa30866e325182b9331c
SHA512 bd1b9fc429a48fc7db965b3f95f970660812264c4f22bb65f10c73b6bda5bc36aac7037f25a03af0c6a5c7c81f3c1b6ad205b79f8baffdc007a3877eeb3330bc
SSDEEP 49152:Y1hpsNoJpF1A6UU44CwH7R4xFQ/lFTjN4:YmifPbRTLm
TLSH
T143B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3318433e01578058917bd7f3de0d303a45734ace6570155b83d20897edac4a10
MD5 6e687bb955ffa33d1bbe549aa25ad26f
SHA1 cdc61675dc501c58484e89fec15a55168de34208
SHA512 37b69702a46913e115ce64a5f8727133746bb4afe395a7af092b3e9921b9c764325b9ed178cda85ae6a514d299d63dd2444b25f7742f010105edb554e52acc56
SSDEEP 49152:eSuZQIY0Be2KRRVtOnks6NMHqeQ/lFTjN4:w5dKTi615Lm
TLSH
T1F6C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 20f079e5504af10bfff8842b4b315a4dc2cb2426475ffeaa474ab18bf79d85b8
MD5 d3f6896ec619fc7a1e0f44d7c866d0f6
SHA1 ad4a4c8e7fc7326477fbed9d6c16e94d65a7ce1b
SHA512 7dd286725f07f8e8647e211b2cfc50af3ea106e959d638667e92c1bd793575835e5e6f5003b1e15786739b557847e5f7eca7a23e830b11fa48d7640cdd989c53
SSDEEP 49152:shtSn8EApI0figngiDn0AP5wpQ/lFTjN4:NX2iyphvLm
TLSH
T1CF95BE13F2D900E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 79f2091724896d1609078264169cc191c222486715654137a781ae740e9eab45
MD5 3844a2d8fa8501b5a723947668829a94
SHA1 6ca39c9247155cae4cf71b0036af3cb7034f3cfe
SHA512 cbff582177f2ae3976345a934d99bfcc42d052a610b7b06ae71e199f72e6065f6bd91a2c7bbeb441059003c2ac44ecde51bd6b9c7fd4bd3710ee512ff194888d
SSDEEP 12288:aI5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:aIJnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1DB5523686965F98BFA1706F188838182A77F0DC6BFD1A38E77482129D67D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 bb9144455525af02ae69ad36338cc3bfc45e074f212d4e2ab56ddfd4d22bdcd0
MD5 df80fd73eae5a30abf57862f25939058
SHA1 de8a8a24aaf3889ad078807f2b56eeb1cf39e33c
SHA512 21818518186b7866bbaa6f8e8824671b722259f8eadbd80a59f82d721228af0f4a4aadabc7c70aad10854265f1314c6c5c018f86ac539011dbe9126080b435f5
SSDEEP 12288:e55GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:e5JnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1125523687965F98BFA1706F188838182A73F0DC6BFD1A38E77482129D67D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 e4150b623aee58089c92e942aa41e00f0ed93a722861ec439c31713c56cfdc39
MD5 1a9fe61ff9bf13e5347ee632914d8746
SHA1 7795d4f37dc40f5483f17cf5c91385388602214a
SHA512 3dd55a5aad363f7d823a1483b81cd6a3c36fcde2b493cd5f0a0d0065c60067b4f6efe0f430feed50f1da4d3f606e60c8cc7cf030e10a01c35015f8192df72a7e
SSDEEP 12288:f75GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:f7JnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1055523687565F98BFA1706F148838182AB7F0DC6BFD1A38E7B482128D67D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 f978e9cb827fb0dfe29a10ba55e33c51745a90eef4dc05e8485abf3bc19e15e5
MD5 98d16a5facca6aeaf3c4204fa3de6562
SHA1 d7a673aa0b230c84bede14f73948af7cf37394b1
SHA512 c6d95a504a8b1f7836f4371d06d0bcab90750687dfb7159738980c92b1332c646a1010c5efcc21c7c45a2e6e086ae99d5db4e3130354e9004a6cb91808d326d3
SSDEEP 12288:3Vq5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:IJnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1E15523693669B4C7F92746F4CC938142F77B3CC2BBA1A3CF6B0411194E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 cecae43387144b167e378c8b7ac0ad57ba8089aec83805c6fc92d5c9b0ff4af5
MD5 47b50420c5a95228a83149c51b039f49
SHA1 aa9de2bb3c43f32b8671b023483092c00f406a47
SHA512 193d21adcde8f3d82076f8e5b1f746e2291a75a230bc3dbb155c017710c680d8e444b4cd90eeb054266e74e9d39cf362f4485a89cc22b23730847a18a5ac3af7
SSDEEP 12288:TC5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:TCJnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1285523687955F98BFA1706F188838182AB7F0DC6BFD1A38E77482128D67D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 e9c821cbc025d21ed2a551b0a90c2a341b8162b98d372c5bb7822580a102f4f2
MD5 8b62497cc4d3251fd05043ca7482de15
SHA1 6ceaf6c974b0e60c4aeb46c5b4030bba9dda93cd
SHA512 7470d2ae3bcbb3add21e47e13af91457ae88604e05b74fdea78cfdb4e150c6b638f3f7b2fcb5eb966a108f83c9a2f583f386ae9d970133ca86c9ba89432d6e40
SSDEEP 12288:Tt5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:TtJnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1F35523687965F98BFA1706F18C838182A73B0DC6BFD1A38E77482129D67D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 f804726caae315a530d48389f604b1d357e2672550f2d702befc436acc065b43
MD5 8eefea94ad6785865d322a5ea4477797
SHA1 5a3219b11c072bed3260b29b52d9b23282323b00
SHA512 138e63c23c6e250e2835bd758e50b5244d70b06b7185d86afd7161fe05d5f0ec8c940199fe82153a30007487ab0beb5b9ae74ec782068870036f10c6974eebd9
SSDEEP 12288:iR5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:iRJnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1905523686955F98BFB1706F18C828182AB3F0DC6BFD1A38E7B481129D67D39415CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 500187e5f6376747ac9cc64fd8a42fcba64d9ec2bcf0ec180510638b328856d5
MD5 9c53dc6e38e1e91d03b804759d2b15f4
SHA1 c5d8e01624df6cd6d440771691bfc444d6b79940
SHA512 a2f782c19bd043d778701f17f785f08e35d1ed054813b504a0647c0a2b90768edae1846ce55bd75d7ea9cdbe6ac9782bc30e229c20956e1056e405ae38abb6a9
SSDEEP 12288:piZwb2zzFEoS2cPvyZ5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:sZM2zFVSOZJnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1967501A4B35058F9EC67427ECC528906D6B27C5A1BB0C75F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 b7d4771954a33cd06f76f783b3e8f8206aa472017bc4c6654e6bfae7b0ad9790
MD5 4e9afdb20e0a21309e71f574010fbb8d
SHA1 fdfd0f417090a55c502e8414871df5ff8dd2f21e
SHA512 8ca52ffc81fbca8f209a46961ed106461922c46aeed47cce2bb02bfdc754ab2f2f516695fc86edd2d6a3eb91958adc1bbac0e5f0bb1f9ab66f2081a70be2e727
SSDEEP 12288:E05GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:E0JnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1685523687565F88BFA1706F588838182AB7E0DC6BFD1A38E7B481128D67D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 bf20681c36f04fcc8c7a9dc033279da329b9db9c106ee047597a6a3eb44cb832
MD5 2abcd4fce46b7bd3af263fbcc99fc2a2
SHA1 4e2c98797f5b63168889c6b2d6b814ab19281fac
SHA512 4f1bd8ff98a148c1d31247f0c9125a12a1b8dc5fa8eef822487c3971f94bdb45012ec089823fdf33cc9782494c18894f9f061fbc6e4b73c1db4b056c692a44a4
SSDEEP 12288:jw5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:jwJnQ/tbw/2Mkjy6Fr7g0o
TLSH
T18E5523687555F98BFA1706F188838182AB3E0EC6BFD1A38E7B481129D67D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 7b0385cb9a49c663dd4321024c609e91426cc317faffa4b42854e857fca302cc
MD5 8539060676fe6813bcdc9f53d3dc8447
SHA1 2194c1f18fe8919747c895573fc20afe7158eb40
SHA512 024586030efaa919cd2f8779ab83dc6c39bd4fc8b09c4df5c3b171f29a4eb69e2fe53f93a3fe95fed59d8c5a908fbd1221fcca7c21638058530f44284187c96f
SSDEEP 12288:YyPz5L815GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:5zy1JnQ/tbw/2Mkjy6Fr7g0o
TLSH
T17365021772A530FAE537427888920A02F77678725B609B9F2794037A5F3B3D05E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 e9e5d7fefa4652b10f51829f3500d4279047425de42526e5931bbc73c7ef952f
MD5 1342e52d2d3b3a3815cd78300797f813
SHA1 439259fddb2dd91fc984bbd0b0580e0b3fc276c0
SHA512 1104e3ea6d1e49d18be19cc3a219d94e9288f7a958dfc7ad0940317f60383153dc1497d92c0d5f6fbaeafcbb431a7a60bae26a57d6b007faafde0eacb5154327
SSDEEP 12288:V05GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:V0JnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1355523687555F98BFA1706F588838182AB7E0DC6BFD1A38E7B482128D67D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 57889f82b286f3f8c58d2218ee5e10585111bf5f6983fcb53638bfba020cc0d2
MD5 3787efc8ef2fb8205352fbc59c0312e7
SHA1 314ecb70183c3543ba028ae356c91e01688dd981
SHA512 bedc644290b073427a20a9eb0dc3f12eb6328b4bd06f64abf0826907978a37c03c05dbbaf17204e606dbf9b1c1d8502e737f6be0aabffa0fcaf1b369b1da275a
SSDEEP 12288:w05GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:w0JnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1875523687965F98BFA1706F548838182AB7E0DC6BFD1A38E7B481128D67D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 869e5ce55a9762e5584e815ff6bcb779425c528e6a4b8cbfa915712c7d6b474a
MD5 bc613916821e12a5e8c0dc136ee57130
SHA1 3d62715096a910de7a97f250173a85e67f839bb2
SHA512 e484be8a541f3b66634b49cbb3a58ba61d55d1c5b2a38d0a80afb950baebd239b9badd9640e0358149a8f7bcc24aa20a08998238f5d8b023bc76964a90b501a7
SSDEEP 12288:NyPz5L815GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:kzy1JnQ/tbw/2Mkjy6Fr7g0o
TLSH
T11D65021772A530FAE537427888920A02F77678725B609B9F2794037A5F3B3D05E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 4ab3ca9881d39d45568799b4d7b1d1b6f2db21ccb6c01fd8601694c03cd6e4e1
MD5 cc13b91e21e9c1225cf3d8124f506e44
SHA1 f45c1fee8ea3fbe27a271aa9326a1a0f9cce6888
SHA512 aae8e88ea9d85489e8918b6a923b9ce13a7f04492ca3d77162e161777c7d960f3d670a9fb0c99a548c2fbb2e369da63e90cde6fe8af4b940a357c3d08a7d1569
SSDEEP 24576:mTDaLl3z0zDLJnQ/tbw/2Mkjy6Fr7g0o:mTuLljEQ/lFTjN4
TLSH
T1AD7502A4B35058F9ED67427ECC528906D7B27C5A0BB0C75F13A8322A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 afbaa11f60b113b5571ddc78d35b75c5c932c77d0cb2fcf36188dfd61855b2e2
MD5 44954be55ea044207b7a98a2370330f7
SHA1 37177fd5aa0ae79dddcdc871b27345b54820ad83
SHA512 eb4949a04277470b90e17aa36e7005d58a4696bb2badf8e3799ad2deaa30d99b647f6b041fd358269bd2b7b5cf2e080bd7261377dcda45cd3013bce55a0faebc
SSDEEP 24576:s3Hd9CHKy7GZvJnQ/tbw/2Mkjy6Fr7g0o:WHd9CHKyaTQ/lFTjN4
TLSH
T1D885CF90F3E414E9F1B78A758D724502DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 7de72abdb1d0e9c661100f59a2534191c40f9702a11a6acc9bae55853077dcd0
MD5 27866fa6e60efe971505dfbd84b84406
SHA1 77a7ed355862020673d819243dcb6ab82c09942a
SHA512 5072df774665ac1a22556a1052d9d9d975443ec3aa37cb78374ac108edbccdd9a7201bc4ed9e600ad8c085bd2c154feda400d067fec4bad52d0e80f3b1d5dbef
SSDEEP 12288:mb5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:mbJnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1795523687955F98BFA1706F188838182A77F0DC6BFD1A38E7B482128D67D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 b68b532ec4b3b16900b9cfc140aabf49c749f1656f423b1de409de533d35674d
MD5 a7c4bd6d559db0b1a4846b86e8b17c99
SHA1 13cf9ae7b23f11fd58c6f669da842233be27d3b1
SHA512 b1fa32ea80119f1ed85cb6281c818eddc4f92ab341e9d1cb639ec3c2e7337f888c296e69271a24572958bdb1b42b7e83277404c4f6f76215793dfa2401a16dc4
SSDEEP 12288:QV5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:QVJnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1285523787964F99BFA1B06F14C838182AB7E0DC6BFD1938E7B481129967D39405CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 dddbbaf10c783516f7432ed5d5e99d54a5ba03873044916ea6b1ecfb8c3fe0eb
MD5 1ab08f3d1cd880ba853981aa502b2d54
SHA1 f81d2119a6e46127a072ede9fced488b021b23fc
SHA512 45d7125fac2d8b9fc8dbeb2138ebe54998211f40bee52c5af4f0f7a3a9feef6f43ea05627dd31e11b5e6f30f700918076523aa5da2cc025dfa159adf4cfd287f
SSDEEP 12288:HG5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:HGJnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1BB5523687565F98BFA1706F188838182AB7E0DC6BFD1A38E7B481128D67D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 b1d4a1178b373fbd00e271a5dae219d695539093aa8b7e30b8b8c2935cbb148d
MD5 28cb9ee192da91e75dea4f3cb875207e
SHA1 3e374d851261162f30e5dfbbc5af590340850197
SHA512 3e475630aec3a97da80fb8cfce4a0b9e36089c3e8479bf25365466cb7196cac1ed9c09e4cd0c89f20742bf066504a223c942ec6f11ad228e895dfc533b68b9db
SSDEEP 12288:U05GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:U0JnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1945523687565F98BFA1706F548838182AB7F0DC6BFD1A38E7B481128967D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 2b28619b77c81c8ae28039a81ecb5ddd9031a969c7f33b48003c71b06b24dec4
MD5 f017599be1da39e8df5e65b9737269e1
SHA1 117b32f0c1dca3005a8f14c7258411f297d65cb5
SHA512 1e9011e9a039301920bcc20ae887061c4c399e1fd943f6c797580f7de3336ce75a0b37e90924fbe84e2ca7ac17073b3e0dd8511bbb2c87496340add9e87f379e
SSDEEP 12288:Fb5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:FbJnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1D85523687565F98BFA1706F148838182AB7B0DC6BFD1A38E7B482128967D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 1b2d79ffbfada8a45b9e15f7ed2417adb0251925bffd824b03c9cfeaf7797046
MD5 57a819dfb4ee43aaf884173b8335e902
SHA1 c4f723377c089d0c564b1992fddd87514cd84dd5
SHA512 d645977e2c26ee86adcb8e5d401b1b975c2a6106b325709d272524d467c4978116132fc43ef678321fb0269edf4882841e611deab06227dcb3e60388dc146f7b
SSDEEP 12288:ms5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:msJnQ/tbw/2Mkjy6Fr7g0o
TLSH
T19D5523687965F98BFA1706F18CC38182AB7E0DC6BFD1A38E7B481129D67D39405CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 83916ce0dacadeb708ce784ea83b618b7a37331b5e9e91a9a226fb69551f8132
MD5 13ab1ccc204a5eee771d153dc9354232
SHA1 82026e36f384b3bb333bbbc4c7c9db2bdf67c268
SHA512 b143cf7fc24228387949936a3d82a21cdf1a963fda90738ebe6dc172c7458769fc8671751ae65956327a5ea1d0ab5e642eb3939f4e4f53ad1a377860825eee34
SSDEEP 12288:CC5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:CCJnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1E45523687955F98BFA1706F188838182AB7F0DC7BFD1A38E77482128967D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 eb9b44dfaec1cbf329f9d2bb39ec1d9a373b3fd0def4cf2004cf144ee8754b17
MD5 4f474ae2604f6c19622b5cd1cb671a52
SHA1 af720898fbc67047a3965bf1e7535b4cd149f48c
SHA512 8e492312fcd973534b8e4ba3d7510e765e0d61f7b5729aee30db96582ac2dad5ffc428825722c985ef7cdc88b348d46804f3deeb209a45efc4eb9cb3f39bacf5
SSDEEP 24576:QfwvZk9RX6wkyAIgJnQ/tbw/2Mkjy6Fr7g0o:JMnYI6Q/lFTjN4
TLSH
T14285DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e090be3519dff0414a271430d6bc363822d191aeaa0c6b4fd91f7effc6470e84
MD5 67dd1c555b72734da47c17f6d9dcbbb2
SHA1 b31a1d2b758d973feab8b3a93ac60e952029ba49
SHA512 8fb4c63645edb6fdc91fa9172f6c7eb57ef20c565af2ceb6268ad0486018ed55588e913b9a8e79bc323cbefef63a2e07197fd48ce17ae08953a2ad7695dbdbca
SSDEEP 49152:LYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0JQ/lFTjN4:vySzP2Lm
TLSH
T1E9066C96A16801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0542d04f5bfab7ff03ef287341cfe4987756dd9de2324fad9be07edbcfbc7ffb
MD5 4a644ddb7c179b7bae784c5787044108
SHA1 e13a0f9ec8a27fea1e7ce27023173fb8a4d64bdc
SHA512 d28bfcaa72cee2cfbe35c938254d1ceb37cf62c621edb363f2dd1cf2c51f4faebf998ae9df93ded17876cc6905c3bf4253330fa85ef6064a8a541830591e10fb
SSDEEP 24576:B47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYJJnQ/tbw/2Mkjy6Fr7g0o:B47JUQj1irIhCnDHUPfF/5Q/lFTjN4
TLSH
T17465AE1DA3EC01E5E1BA827885158A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 d689d389bd363531dbe0d22ea3a06bc2c4f4daab30d10e08c64fc4b3808d0251
MD5 044103546fffa8cb46058950768287b5
SHA1 968062d386633de7d215eb5122ac3dcff1975e36
SHA512 d1d6ac30d5d8e2216c1a007aa7fa6b790e93cec36f351ab83622e170e1a16275f29b6eaa6902a4c848933e151d4929fd69830d9931c1be0c67276ea9356fc34c
SSDEEP 12288:2RsfE5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:7EJnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1A065F119D29852E9D02E52B5CB828641B3373C9597E1D3CB67C0F13E1F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1024KB
SHA256 e3045839088223db5c0a243c510a41b393da5e567439efdeeec5b793e2b0b444
MD5 2d26db7250b0a76085e8fa4a9cb17f28
SHA1 3e913563cd87cf70c51f273efa2c28010a06b3a3
SHA512 adbf573188b5e7e1de04e0e527381774dac7b361c9d86a8086be60aa2c4f02b87998150ca67da4dcaa6fe3bf92255bfc48416cc3e959009b1c85f4de62ef2005
SSDEEP 6144:6NQsBC2naHYwipPfPYxmtMxzRGaU3frkpBJTU0ozG27g+11KFDIgVdaWeku/m4Hj:6/Hd6U3faLoz7g+vouzwTYCNeOI
TLSH
T11525E5417627C69FC6A940321E76D6CCA7707D41EE05AF1373C8873FC476668BAB6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 f8199fb9ffb22a7665242789e81f05e06eca103d0d74ef924f9d5e2d543b4655
MD5 656e534e7a21efaa88e704f14538ce5b
SHA1 a247d6a933c8a439e9b277492f290203bcbf8dfd
SHA512 cbb6777c9298c31805675af7c843deb6022d7a52f98f5548489eee04c9fd939efb493db41d85f70a36fc27d12792a13ba7de9f40822641e7fa7aea5dccee23f6
SSDEEP 12288:YFNkxLeXYLAWr794o+UGpnEdHvgnqdNnNH:YjWaQ13u3ogqdZNH
TLSH
T1FC451A01A5A7E35FC9FE90370732868DBB789C07BB452B0573448A3C986757EB5E22D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 7596e441d1f449a181b3569e8809f4766e13726dc9491bd8ba8b22dd7ac7daa1
MD5 66deffa2e5973a1b3993986a81110b9a
SHA1 258e4b6e08c59623549fd5aac509be63cf856015
SHA512 aa7fc92e03a220c9bf7c527d94fbc3e5b4ef460854b2e07f055864d624674a12a580feee3a5c1e40e8235998a0ccdabe2b10ab62a1407b42eb2fabe522a9e9bb
SSDEEP 12288:So785GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:b8JnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1EC5523656668F94BFA3B06F048938111773F1EC5AF90D3CBBB082269953D3C41EBA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3106f844e56ddcadef93bc832898c97c3d5b8789faa6f5dce3b0c76e31e68dd1
MD5 eacd364682a755694089349e32941ff8
SHA1 5d990232b09eef71afc694e50078891af92bc765
SHA512 ac0f7f83ad5c61d2dd2006dbafbc0c77288e54acee9f300c9217adcef26f589bcfbdfd0ed0be81f8c664c59bb301e8ee5f49245690a760b9082d9d789833ace4
SSDEEP 24576:Sgb6bmBIi49WNNFpg1rSvFv7bYOJnQ/tbw/2Mkjy6Fr7g0o:Sgb4mBIBhGF/Q/lFTjN4
TLSH
T19265AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 4276ce370f627c76104a9b65644ee9bd46ebf50eb104cd5ad6f7ff2bbfe8cd82
MD5 6cd09ee78aa289ce545996156df4688d
SHA1 621c67b6d6173ae9966bdd4e9f47660b66cf8e71
SHA512 f287fac226d7261aeddedd64c00051dd1633b2361b19e81b7160028e5b475c07d146a7ca37ed20ce4b2afc6cdfefa1ccfcedf4bf1e4c57216d3dbd2ba6bb248c
SSDEEP 24576:nG88u8FpJqH1Hzria7/mZJnQ/tbw/2Mkjy6Fr7g0o:G7ZFPqVaa7/cQ/lFTjN4
TLSH
T1C295F06576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 bca5a6cbbaf8ba866bb2e58063c6abce0b6179257f12a20791970637a45ab465
MD5 0ae3785db243b5b84e3860f1f1811c54
SHA1 cae257943dfcd0c4bc2c944c173f7655a85fd3a2
SHA512 cfec447024acd7fed3bac0b8c473b84dd25a3d0a9e417651a510e475115aa332977f0433352aa533075402f6788d489b55d24b58701499abe1c25ed6b99def5a
SSDEEP 12288:XHvUrBFrEjwaQ+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:XPUr+NQ+nQ/tbw/2Mkjy6Fr7g0o
TLSH
T13975E12E26AC18E5F676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 d9b2a5a52dfc65777b9d3ce0af1d456b614e449d89593e8d16dee5be7a20bdfe
MD5 6479d70096eb1755d29ead8d7d6b9647
SHA1 afa75ecc10ec60e444212de571aacf3e26d8963e
SHA512 7a7f9fdb2971f55c69b563073b5349fb573e086fa4edefe0e9dfb95ca671ffedbb6937999b4fad76a59503e857112910f4c907c1dc57bf47be5a1cb358b867d8
SSDEEP 49152:qBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjjQ/lFTjN4:VG05lO43bdLm
TLSH
T1FFD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c20619ae48eb5649ef4020493e2495672e54cf093651e16e455710f98e50b68f
MD5 98969ac49400e8f38b9e5d8542928ced
SHA1 07503afb378699dfe300f719453fe472c82d171a
SHA512 cbbb003bf85552c604137c016a47053ea427da0bc9a4dbd20ca0979532475e6474113ec1032ac1f4163b1945900a83208d686103f6e6240be614f27e07cf0dea
SSDEEP 24576:efa5POZ3dpFWVM50JicR2hG0lasx2+47eidnnJnQ/tbw/2Mkjy6Fr7g0o:Ga5POZ3+Jt2pasx2+mLQ/lFTjN4
TLSH
T10D65AE5EA6F801D5E579D17DC583860AF5B1342253329BCB122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 79c7fa0e9a7a002dc3dcad307ccab6592427953e6c740f0d52833c4078abb66b
MD5 d3a121739d6f85063ae8e4656a53d3e0
SHA1 edcad4b7c38ea6a18509243e90845933a84036a8
SHA512 97d857620655b0c5e5826ddaab31d0d1199c4cd6b80a48636b4f229ddb8da0478265495691140709efee4aed9d5a2b0168db80d3109f9f4b054b69a79c91a3f2
SSDEEP 24576:vNcwHdjbyQ4nLC18lb/EOjowL7FkhJnQ/tbw/2Mkjy6Fr7g0o:vNc/zEOVHF8Q/lFTjN4
TLSH
T15F858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f0b61f52fa3267539ef39ee2e4618e38366fa1641aaaadcf9b341d374e59240b
MD5 bfa8082b5cea149690fc6cfd494ae6a9
SHA1 1a83b1863b00878681b22701b606ac43b5567118
SHA512 4e1191fc8e9fa9eacd0afa4ebfde5db919a1e5822ead5cdcc06cd41f363906bc7c9ac7fcdd739091ae2053239702b744878539edf5855f3d348f9792e0fc6328
SSDEEP 24576:O8kNvNnaFeYhJNtmZBm8nQ/tbw/2Mkjy6Fr7g0o:O8MwBtOm8Q/lFTjN4
TLSH
T10955AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E4E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 4e97a11a48e85cb02289f9aa8afe8c3e662ca12b153848be207ecc32ee58de7d
MD5 df3e818518aa91da63dcb5df62236d80
SHA1 42c5d602db7fc3b7b4ccf2d902f95ad91bcde2d0
SHA512 3efebdb2bb65193da3c0c9f841ff273f7cbab0febc6f773292af1ea5c60616b95e09daaca503633378583c5d3a3c03c0b60a1188e6c2457692b75fe0bb15157a
SSDEEP 24576:sD3FHshBIYQgAoJnQ/tbw/2Mkjy6Fr7g0o:sDVHeBIAACQ/lFTjN4
TLSH
T1FD85E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/548-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/548-332-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/548-99-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/548-93-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/548-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/548-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1200-140-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1200-138-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1200-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1200-132-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1200-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1280-300-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/1280-88-0x00000000007C0000-0x0000000000826000-memory.dmp

Download

memory/1280-83-0x00000000007C0000-0x0000000000826000-memory.dmp

Download

memory/1280-82-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/2012-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2012-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2012-112-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2012-106-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2012-317-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2012-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2060-252-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/2060-54-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/2060-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2060-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2720-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2720-154-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2720-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2720-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3216-323-0x000001F57B970000-0x000001F57BBFB000-memory.dmp

Download

memory/3316-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3316-14-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/3316-22-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/3316-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3316-20-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/3556-7-0x00000000023F0000-0x0000000002456000-memory.dmp

Download

memory/3556-6-0x00000000023F0000-0x0000000002456000-memory.dmp

Download

memory/3556-0-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/3556-67-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/3556-1-0x00000000023F0000-0x0000000002456000-memory.dmp

Download

memory/3764-79-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3764-73-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3764-71-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/3764-285-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/3896-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3896-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3896-38-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/3896-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3896-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3896-52-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/4292-125-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4292-316-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4292-117-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4292-119-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5568-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5568-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5568-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5568-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5568-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download