86d91804fab3655112705955d94ca00a14403d52d14bd6967b72bdb7635c37f3

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 19:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_a5ae8212f0358ca84007bb31a87c5a4e_elex_redline-stealer_rhadamanthys_stop.exe
Size 1.3MB
Sample260929-xrn64avane
SHA256 86d91804fab3655112705955d94ca00a14403d52d14bd6967b72bdb7635c37f3
MD5 a5ae8212f0358ca84007bb31a87c5a4e
SHA1 190ecbc24db9fda4f7d29a01d5b5eb16bae9c52b
SHA512 0d811f46b3c9991c0e954dd3f5bf4b2bf9e4bb9d322252f9b3d1a97363d50ce64391bb9f8fdc7d84946fa0fc140270a5f47ce23a8c75dd5851cad88cef92ed4e
SSDEEP 12288:S5dGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:S9nQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1615522647940E473D91B04B50846C2A1AB3F4D913BB5DB8BBB891B3F9F383D05A5B389
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4240	elevation_service.exe
3524	elevation_service.exe
2892	maintenanceservice.exe
5664	OSE.EXE
3976	PerceptionSimulationService.exe
4984	perfhost.exe
5516	ReFsDedupSvc.exe
1452	SensorDataService.exe
3244	ssh-agent.exe
1048	AgentService.exe
4184	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
	\??\F:\	elevation_service.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_a5ae8212f0358ca84007bb31a87c5a4e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_a5ae8212f0358ca84007bb31a87c5a4e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dd6ce0d3a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_a5ae8212f0358ca84007bb31a87c5a4e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_a5ae8212f0358ca84007bb31a87c5a4e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-29_a5ae8212f0358ca84007bb31a87c5a4e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_a5ae8212f0358ca84007bb31a87c5a4e_elex_redline-stealer_rhadamanthys_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5768	2504	WerFault.exe	87

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_a5ae8212f0358ca84007bb31a87c5a4e_elex_redline-stealer_rhadamanthys_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000519b5cca4550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a5fd9f884550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4240	elevation_service.exe
4240	elevation_service.exe
4240	elevation_service.exe
4240	elevation_service.exe
4240	elevation_service.exe
4240	elevation_service.exe
4240	elevation_service.exe
3524	elevation_service.exe
3524	elevation_service.exe
3524	elevation_service.exe
3524	elevation_service.exe
3524	elevation_service.exe
3524	elevation_service.exe
3524	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2504	2026-09-29_a5ae8212f0358ca84007bb31a87c5a4e_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	4240	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1048	AgentService.exe
Token: SeBackupPrivilege	5516	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5516	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5516	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5516	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5516	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5516	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5516	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5516	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5516	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5516	ReFsDedupSvc.exe
Token: 33	4184	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4184	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4184	SearchIndexer.exe
Token: SeDebugPrivilege	4240	elevation_service.exe
Token: SeDebugPrivilege	3524	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 5308	4184	SearchIndexer.exe	103
PID 4184 wrote to memory of 2248	4184	SearchIndexer.exe	104
PID 4184 wrote to memory of 2532	4184	SearchIndexer.exe	105
PID 4184 wrote to memory of 3032	4184	SearchIndexer.exe	106
PID 4184 wrote to memory of 5148	4184	SearchIndexer.exe	110
PID 4184 wrote to memory of 1040	4184	SearchIndexer.exe	111
PID 4184 wrote to memory of 4560	4184	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-09-29_a5ae8212f0358ca84007bb31a87c5a4e_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_a5ae8212f0358ca84007bb31a87c5a4e_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 488
  2⤵
  - Program crash
  PID:5768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2504 -ip 2504
1⤵
PID:3240

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3524

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2892

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5664

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3976

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4984

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5516

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1452

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3244

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1048

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5308
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2248
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2964 2960 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2532
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2996 3000 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3032
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5148
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2964 2960 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1040
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2996 3000 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1a9a8ba98cec6d9455a7a132effa491a836b64751cb14b50aa1d3f6eeee16d5e
MD5 1035ff7f53672f216e08cbf355924fa0
SHA1 4ebc2ac34633d7dcdcafd809e83020f719317531
SHA512 5180db7208b3a185eab67b8025da49fbc2e163782f23f094a30723d2102e08496e334028034745c41dcae4b23c64fc603df6c19c879de02206eaab81fcc3838e
SSDEEP 49152:pb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn2Q/lFTjN4:/3q6HjBOLm
TLSH
T1A8D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 e07a86d99966f8ba86a1fb2871fd6b9f15e9d9bf1bfc864dff4ce0963eec20f6
MD5 62cf5d910aa7e6e512461525893b189c
SHA1 8a401d63eef1b08622c298802e6165d2a9f622c8
SHA512 7df39c247d348e6d6f7c004d2bd2269d2e2da03675aec9d3c88e969a14fb662c3891f1d3d11bdeecc8ac0988d2cccebbf44aa434427e1758fa02f1ab66723a18
SSDEEP 12288:J1XLsswWkxy2lRq2czAHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:HXYfDtczAnnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T15965F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 ff58ab34577cc26be1a137a8c9045e53978576d4ba1b8ce86745b71ffb64c8b1
MD5 bf2f6e4bdc446afd04ea320480b8d37a
SHA1 2c363f3d0279ac915bba1fa136455a129b9ebf0c
SHA512 4c5ad781a918cdb8368a99db80bf005c02f083b9bfd65e0c83d86b961981f1ac1ad450a65c714338074be907f15d75185c48b1f54d16194ecce075b768d64ab0
SSDEEP 24576:g0Le5ji0hmxLrMYnQ/tbw/2Mkjy6Fr7g0oZ:gPji0AlFQ/lFTjN4
TLSH
T1CD859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 88ef0411cdc6cae956e99cb71e0ffe68daeed0c169b3200c90c6db1b1541e33b
MD5 726822bfc75cda762efb964124c66537
SHA1 cfa24ab55ef2c4559ff0f90a0d23207bec55afe5
SHA512 86fd239797a35c0f22b5f72f7c6f6082c8a6f2fd211e5682e19055a181c3bbea2cd4a98a3446d3e641b55c951d084b58b088df1cd46d3276080405695fba379a
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWE6q8wyuCnQ/tbw/2Mkjy6Fr7g0oh:1/ezSC6vUzPvxHjyBQ/lFTjN4
TLSH
T1D4755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 bda9166b335e7be1426f6073128b05607d8b4cd126a53f5f462631d5482129b2
MD5 144d997d5d362a567aa6743d50895182
SHA1 818973b1c875515ecf7794aca360615d89c23c5f
SHA512 9ea175dd0f8cdfe1da41b0302134bea44ff27ffd4703ecdfd8884bc42254d961b195ab2b49093b6e1eddb04fbafe2f97469c0ffb73656da8bd614814396c03a5
SSDEEP 24576:yVbqPb88hv/l+6rnQ/tbw/2Mkjy6Fr7g0oB:yVO88hXl+kQ/lFTjN4
TLSH
T1AF559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ff4c271aa1ea54dd65138a4e256891e6796dfa37c8a003c1e90e9f0256c2bc45
MD5 488e85a3923c59fa49766ffaeeb01087
SHA1 115def9d0751ff9b0331dccf676ecf653da08868
SHA512 c247cea8bb4b8b431c21e9cc787f0ca36335c6a132d01e17baa1b09b7722c5af1ee312068a707893171c24a3668d1b418145a876ed870b6d1b1c28d2bc6317ef
SSDEEP 12288:0z8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:0z8nQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1635523696A24F897FF2B06B55CC284826B7B0EC1BFD4A74E7744322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 22156e63e20e4dd29824a0d907c45f559f72b80167ce3b83f8f505631c372556
MD5 fac34bec0ae6445a73def06e2708563f
SHA1 8bf8bd56807f50dd71a32fac5dc95d0b2f2685b8
SHA512 c6a98e36476c7a5d810a32f9cdf18034205abaa072ccecc3f671799f257ee1793b1dfbbff5b5d17c87e103fd31f84750403c77a3c698eeebd98005460c86fdd4
SSDEEP 12288:keBNUbTVO86UjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:kJIUTnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T16775CF3BAE28FCD2C67E4DB85A91C640D77278704F61A3CBD164820EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8c06d25b554a3f165a4078a69ae36c0389741dbf26e20a35e605dfa093ace3d4
MD5 36c54618a9aeb9fef4c1a301106357e2
SHA1 98825e65929378c82a96d7f9d351062aadcc0563
SHA512 baefd14f36c3277c56abeecf78d9a99328e66018d64b06a397a3a1562227a14b75536244c81ed045256768112aac4b04e5030a2c216d007bf506178fa989b37c
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THD:SQvGAdlCEL8c/yRNw5C9Lm
TLSH
T141267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 dde07d074cdcc701ffd0b1b610af4febde0296583dfe1ab9be39b0820b52ef23
MD5 f144634691a8474f42e50e2814252665
SHA1 ee6dab7c571fc56270f8a188bdc994105c8ae9f6
SHA512 253bbe8885ffad08b719447621b8d262ed577aab50a077b620b76063db456cfce9b277015cffef9ee6cb84b15748df4388115d2f67d6141fb6be7bb064f92b1e
SSDEEP 12288:cAwSfxL/2Dc39DLLmt0LDQewsAjVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgu:BQewsAj1nQ/tbw/2Mkjy6Fr7g0oY
TLSH
T10175E031FE74E436C77F0DB21B22C706593D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 779292e2fed935877fb085082417a34477a48106af0a4932634ebfe7f4ea0318
MD5 2323ad191c7b8b1cadb6e4afa8b68467
SHA1 8b8750ca1fdce380007ed30ac036df4d0d98d8c3
SHA512 0f6772957da3fdf1f9e316035e55062c9965b42b17167b54db2a6b8961638b3b2708a17f3a25ee4dbe62ff1fbdf174eb42d0e80290ebd920a6191153537e128a
SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHiL:NUEtQevvqc2W1cpV2EI32
TLSH
T1EF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 370be27435716c672428b24c2724523974f6838e0245643a8f6ba84ab7bafcb9
MD5 0b28521afe69a815cb1c8c58f316c097
SHA1 d137bf646cee1fda5e40bdee08010bec7815f03d
SHA512 b0e2c4404779c9aed3f06c996fbef00873e9be98e6b76978050328ed23f671cb0639a3262b991b872c3db471fe4aa7d9352e5aaf7fe365ab630e18f2f1fb53f1
SSDEEP 49152:MCbRquA/m2yL5zQfFiV+XenmE3/zVQ/lFTjN4:loqtVjnmJLm
TLSH
T1C5D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 77d465b49c9471a62af1dab197bed155e0faa29f93b55496ac8b340c7d287e4d
MD5 0ee4739fb0810b3965f627a1774bbafa
SHA1 5d4476aab238e07786b56d3888f703a0f2e4eafe
SHA512 d09dbc9b99c8b75cea68f9590fdf61f628d2df456452c8b64930212da326cfccbf94d14a66adedaa8de59cbe2ef63cab1c305de847fb8b359dc17ffa2242db3a
SSDEEP 24576:zAhGLJIFoiwtA5l7S53OnQ/tbw/2Mkjy6Fr7g0oB:zAMyFoiq5eQ/lFTjN4
TLSH
T1C935AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 2047eb0b81ac22a4665fb0c90ee19b2bd05ceef6fbbab9855b8719ec3f66643c
MD5 45bcc30b2476c458abd16422b2323bfe
SHA1 4bdb59509bd4e307883ddfe3a7e4c7db0d350910
SHA512 52b8f7699ed9fefd36ff6037a4667274eed0517d87f7691968491b31535dec6c058cd26ef75eced580309e8688b273679913dab0fb775ded6f93bb1471033f0e
SSDEEP 12288:omw5HEjsChN2BFgl0WDm+CiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMr:FwuHOWhnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T16C65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 3141cd33631d69cad8f7a6ae16e43bc9770501b07e61a59552b252daa28a0f6d
MD5 5d7a16760f62433095ad36a681ab3808
SHA1 6535c0339ace220b8ad64c28956c2e8604f0ce0a
SHA512 a04e323aebe5c3ee378df08efd09c2ef56d5d7e6c93a4fe3c82bac2f42e1d97bdf279fa01d1fc4df146fc6ce5c8197dd68adfd4fc75049aaa7ac5886f289e30d
SSDEEP 12288:kXZ1IyFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:kZuAnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T13F55126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 62567fc534f52bd5d19d61f5bc5334460a1d1d72b0c0d500c712f3a766742b95
MD5 9672f531522e9936316cc679d158e9fd
SHA1 a488bd1e61d0e8bfec861fd0d411258123a593c2
SHA512 ebd134476bab09096c8906a31beee2b020b27466c64881a0adc4dd08ced3f1e833c4122bfbfdfc6ff45911c69b5b6ec3a19ae8eb34b8b99ce4f62ad1c05b2c36
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UP:/QRQyi36YOcPQLvw2gAf+PN3kLm
TLSH
T1A2666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 79147c300459e75b5d873ad9ce210661839c14d089f10ea9467c5de7b3ac2ce2
MD5 2611f4b2f70d72679220d44ad5484e9c
SHA1 9ffabea6c28b5f0e6edf4b8c0eaaee6a61b43ea6
SHA512 cfdd31dc7c51fcd11114514dff92a8c94f2172bb0c7f9f25462ef358d854cd902b2f9d488f05632f317d2d4a7d4f0a5fbde5398e8582234df6bd015f468f81d6
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UP:2QRQyi36YOcPQLvw2gAf+PN3kLm
TLSH
T1A9666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8036c9df934a16834ff9300e91ba2ec06108f00d8a05d8e845f0785e8839fbbc
MD5 c877b899e092abde63b39a0f9ca9e5e0
SHA1 c363a5f41cdfc10cf17b8c1e70e05bf9d9fcd399
SHA512 24310bb59354142132bf7ff4193f28e89a936da7e27db08c3768ac7f9474a92de8abc6a8e611ee9615b6cbe705cdc054ff787c04bfca104b913b6089df5f04f2
SSDEEP 24576:owvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0QnQ/tbw/2Mkjy6G:u68Qg55nhheWu7PNU3/FQ/lFTjN4
TLSH
T1D3B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 62fda6ebdee0e2c6ab30c7e1d9819bea384fabfe60af9e37da4fb22fc5743363
MD5 b0872fb80ff2ac82f2ab0e5d3a9c96b2
SHA1 5da2fc0fb5a49924b2c2ffd91ca5ea0aa00ff6e3
SHA512 9f1b824e294eaf6eee9a273e033688693c26717085324093a7b5d73c7c3207640c78552a7b86492c0a742d11653d07765c1b03273780c992a51d7d16e7c0d8fa
SSDEEP 49152:m3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99F:3y5112gYy5azzVvL69nLKnhZfLm
TLSH
T1A2167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 63b349ac9e8675d8217953b23a158fb2088b89dec5b45d7b0de1fde55788fd49
MD5 0b6065442d3eba67b107d21a5dc5b207
SHA1 11b48cbf412fb12e2357ccc618f498931c436b13
SHA512 04c3548825e08bb797160b86a92f227661cd7f206dce3aa735fc5512bf76835438ca33feb393aeb3431135f7e6648de8b97100436e2a9bea79900e25038bd5f3
SSDEEP 49152:VB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gltQ/lFTjN4:bu6JmVxd2diLm
TLSH
T170D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3db40ee02e23838a90f255969aa7e79da02cae5d2e4a6bdef8b6075c7e3508c1
MD5 9d9aaa50d0465f7d98a849059328dca7
SHA1 5bac839221ad64143250ca90e2a4c8c1c74c3755
SHA512 caeefa1d89e2a47c63f2141943929ac0bf1aa05eff48f39c94244d91ffb61ab980c253024d5f42440e6a282e890168ff94de25af2f26298b4f92bc2d6ec1b527
SSDEEP 49152:S1hpsNoJpF1A6UU44CwH7R4xzQ/lFTjN4:SmifPbRJLm
TLSH
T12DB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3c59b05d198a35bf57499342681cc8ce518d1aa23b0321946bfe02eea9184fb2
MD5 70d6cdf732ef01037756b19fdeaa181e
SHA1 84b76d03a4a8c4bb3411e37aab97478dd60f10b5
SHA512 4b67da5be41ddb7f034bacd36f5af8faa7ae5a27caf078327212fa52035f0539b9fc5dc80a75efcc1c781af52ae3dfd4c4a7f3092b73b2c913d5bdcdd2175274
SSDEEP 49152:iSuZQIY0Be2KRRVtOnks6NMHqAQ/lFTjN4:85dKTi61TLm
TLSH
T152C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6d9fba5f888dc8a7b90099d67daf91257f906afd6b3aebfcabd34a5bd99bdd51
MD5 97e3299a46e55c75a95fa7a6b602d115
SHA1 21bf83b77589b499a8b9913f0ac6a4a8e1d675b6
SHA512 37ad147632e43211954d93d357ebc627f71850fa751abaafd8b845b8ebcf9dad0151b050d524520319706460ef3252efef4e58fcbc8cf161235abcc09dc034eb
SSDEEP 49152:MhtSn8EApI0figngiDn0AP5wnQ/lFTjN4:tX2iyphlLm
TLSH
T1B995BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 eb2bde9fb9e43816353063045e4f9e367f9ae7638d579fe4a89b2cce2ac127b9
MD5 c69733e9cbaa8641520321cecc15159e
SHA1 a7d44f30f2208f1113671ad1287f8a1c0c456a85
SHA512 8f9fd8bde0b5b4aaaf431b39839b81ffeb36da4ecb8e79b34f6e1c60135d2134c2d429bea87c444f31148a73bfaff055e1fb9fb63aa4225859b0eaa7de8542fd
SSDEEP 12288:bEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:bknQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1D55523697965F98BFB1706F14C828182A73F0EC6BFD1A38F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 65cdec4c4f81e69ca42879686fb4136cd52af5e104e0a957d647cad67d466bd8
MD5 013610e46866f0544644a62a243d6772
SHA1 cc4f0f043ce6d6ddb918645d2385499c9578090f
SHA512 d8b04afa6dd87703a1a4a668ce27e910dbdf1037668d26260f94ac51f2e9b5e97f5e6383dbd76fb16027696b771e166cfbc5d52da7be28a621b74c9f637c61fc
SSDEEP 12288:bJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:bZnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1B45523697965F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 2a155e86f0a40e454855fa2f2659f58687f6e6c1fe5b39ecd272c0d32ac58ec1
MD5 0c1192dc241225413ea71d2262da760d
SHA1 bf57d6cd6829f9b445956de88cda2de80a8dfff3
SHA512 7bde85624c0c995428b186f953ff84be2f8d21ba35ba862a28ee4f0f242d4b24c3598c79dfb2790b7de336a8de35ea4cc6ffa4aab2452291505bf1d97cc6bbea
SSDEEP 12288:RLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:R7nQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1735523697965F98BFA1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 f80688e4bcf31a9ac00e4069de09b8bb3f2cce31a909f693c52c877ec38ab0ff
MD5 49c61b36093b0299599562dca19c201f
SHA1 69997cc5aa89a93af726221118c49d124fb7cc14
SHA512 3bacbf3a41ac8fcd760cd896d305e8624d3b0f193af46f5cc2197ecdd2e5e65c780e5772be362f2c599c7fbf1f7a76b76222608fc4a622e1ae69e9348531cdd0
SSDEEP 12288:6VuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:ZnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T18A5523693B69F4C7F92742B4CC928142E77B3DC5BBA1A3CF6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 82e1c6e5e34b8fb823aac604a88d4048699919cd08808fa498251b748bdc28fb
MD5 d3a5478445bea42ac5fad6fa9d4e1287
SHA1 2da305d0becf644d384e68d0c79cde01c324fa4b
SHA512 31b49a0853b91809041a0ab5c1931c0b12321c5ee777e364c8557cefe9a3ea4164c403db6d2e0423851c17d2b8230c6a129b7c02f463d5c4e7d01c56a18b20cc
SSDEEP 12288:0GGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:0mnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1465523697965F98BFA1706F14C8381829B3B0EC6BFD1A38F774C2128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 1d48dd3972b56a9e92fba6821b3d7fa3c30899384dec8a11c956f5d6388fb739
MD5 438d01b33ab45ec2fe6f81df7189ac6c
SHA1 a74243e20c00634d0f9c71d1f581cd77120fb826
SHA512 2377abb435675f1520e9e642c4f989202aee612e010ba6e32e628dbafe6b092ff225153f0913cac7b6f9a461e62e2a61713f2bdb5e9510395c853ebb4934d070
SSDEEP 12288:u9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:udnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1905523697965F98BFB1706F14C828182973F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 846746192eed8d2992b13b8bc5b5f86b2a86c88ee1bdcc5741bac5b535e479ec
MD5 e97ec76e6e4af0188d7820edc59bd3b9
SHA1 01245fd973032ccdca6b30bde76f66290b3e1e15
SHA512 c5e8697de7c7e3ab9f375a8b2dac170e0ff7583432410a14f6c3ae5690041d5c988bbc931c3eb7f5fb316fa985ab0a02aeccee416d320fe4b46dd1facd4b18f0
SSDEEP 12288:ehGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:exnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1795523797965F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 2cf98a0f3b349f9004c71d42a1d0ade4221b2e7ac0f023a03394588ed6a5cabb
MD5 365110cad614012baa069fc61ad5ddc0
SHA1 e515607782bacddc6d64145c1affbde9ae76d518
SHA512 b60544f436753c91c3060868b892ae483cb7f08670345a2744beba627cb5993d2f5e73832b6009f9ac124ea49034939b70b06a986244a9899646dbe6a90da64d
SSDEEP 12288:iiZwbDzzFEoS2cPvypGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:FZM3zFVSO5nQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1CF7501A5B39058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 d6fc610f59e6d8127cb0a8ba7c7715bf7f96b097533081b0a91230918973a5ef
MD5 16e9edd83bfdfb5755ef59544c680ad3
SHA1 769f3d5a1cde9b02eb31b1a54a9b585f71f84d7a
SHA512 a09bb3e21b2989023b8be46677777c9843e5ad52778f9d751e5ca39f5bafeeb720e1e24047bb15280c92891236fd0efed52f32f732857930030c9b0b4e5981b7
SSDEEP 12288:KQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:KwnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1A85523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 30c7d66c13487494a50e5d48b7bcfb596c6af6931c183381cb0df32376011b5e
MD5 d498fc06004859e9cca77d4161a0fe09
SHA1 c204a82c66075334b3ad04ed2fc8ce011633f8d1
SHA512 9e0204a981185d31a54ca5ea0e949b3e04249e499df74d65cfabae89b1f641f61c6a18cbbdc75ffde4852f9aabaf2aa33bbc234c3133ed19147efa503a2ab692
SSDEEP 12288:EsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:EsnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T16A5523697965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 8e7b82cdc779da5a91d624ad1c547ffbfba1dcb5e43863456ea7f4a301f78269
MD5 8aee0c29798e56a6d7f0e330e9ba10e7
SHA1 07f7b86db5cec3c675630af8e90c4a2b70b7e008
SHA512 fb7b432f3d62ad6c24fbc34bf07958d76fab7eabe89d536968f4f61a6f7f821552557bf71aad0f96504b4a3530a1b36c6b69e9462b7c0ad2664a0daa60761e63
SSDEEP 12288:OyPz5L8FGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:TzylnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T15D65021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 6c3bf281dabc971c17c63ff5685b9e70688224cab2d0715c9a26f2a9c7ba8a46
MD5 7bd4e112f9e776a7c3669c345ef4840a
SHA1 892cc64838da22c9222afb0ce559fb6048495550
SHA512 578243210a9fcf8a68a226ae1edeac91ffeb90c85418dc86c0199fafc850e2f0f9199f8f587c35603a9cf80593284a16efd8bf7a63412bc7892270cf7d4e68fd
SSDEEP 12288:YQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:YwnQ/tbw/2Mkjy6Fr7g0on
TLSH
T1B25523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 988bdc1379cc867eb1f4c4a8635bbf08eaf2fd3e1c96d3c883378402576587d4
MD5 588a86010045d256316d16f83af03575
SHA1 27fcc75847686af4f14c004e72c0b1dcf94391fa
SHA512 46c32cf89cefb2fb0058dbb349c283faadae5421425f784aefa9f76d47e5ebd1380eb3eb22df76f4bc4f653f88f43d15d9413800bc47dead5f0c45621a5be17f
SSDEEP 12288:7QGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:7wnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T17C5523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 a2ee67e84c4cf6837e6f906cfa8d6f15c222a86753b216000c77fcc6b90f7ffe
MD5 66e24985b0d2c42531bfdb2e241d15cc
SHA1 fcace7744f34163f51c0871cb900369f9ff8cc22
SHA512 973b49595b32064fb5cd5d02e77d61fb028cdc1c301ab5c6b1250edbdaf41e17776c65769faef0663240626823dbdf20b310c1101cd95fdbd02b8a93f9f6c0c1
SSDEEP 12288:fyPz5L8FGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:SzylnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1C565021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 7e56d196b99054258a5ac3091ffcd1e8b0a39c957fc065fafd4a0b7ce406aa51
MD5 a84d26153e6c28c445618609e6d0867c
SHA1 6cc66173c5cbc7bc76c518f34b9cee4de18d5046
SHA512 3477db9bf1783c1b2a648059448090ee31ceccb2c44c6c58c63d9f0ba6cffe71e73a3f9e1336c4792c2ad4a87cd949eec8db07da2bbde800640e17b382805238
SSDEEP 24576:uT0aLl3z0zDLnQ/tbw/2Mkjy6Fr7g0o6:uTDLljCQ/lFTjN4
TLSH
T13A7501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 b82053562623ac27bfdb8b0b9f77058bdfc9ef82b51da89a849142bb038e3cde
MD5 65961ee54c388c41b76f2716e94e290d
SHA1 a999ab9dbcb54a3d013cfb4d8f743901c89c40ab
SHA512 d4a4c605d7a9ec44bcff807ea9607655604dc4a3d0a79f6e03c6ea46eea9691eed96b73b44962e1b4ad94a6a8a282d0f8d6a3807f3698118ac2addb5f2c0c97e
SSDEEP 24576:j31d9CHKy7GZPnQ/tbw/2Mkjy6Fr7g0oY:D1d9CHKyaNQ/lFTjN4
TLSH
T1ED85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 cd34cf8dd746d4267e242a71e0f1f88b422472972aca50352b89ded217c95e29
MD5 d1f65295c02815d9ab1e93f734547e21
SHA1 377e8d4bddfc1a1ef59c01af97be6573b4db803a
SHA512 5a82167716be3e75c595d3e397f3b9788589d6ba27c8b58a26e917d632c7dbe4f549901134f059dda0e89d35a932e4b3d079de92ede0287aa8359b8bac7511cc
SSDEEP 12288:2rGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:2bnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1FF5523697965F98BFA1706F14C8381829B3B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 fbd22bd45009c4ad6f07dbab6d80194d0ace525544b8166368fc76715f69d1e1
MD5 47c400020dae7a95a571e83fc9de12e9
SHA1 f7dae47cd1e3926054aca75cb1fda53b37943f7b
SHA512 b65d10717d6977f9cef3ec684c2b322a350aef9b980fbf05e33412bf75c9940359a5484c7ec13fab0ed0950bb32eec86e8d060d75b9d94a31973be6bea184ede
SSDEEP 12288:ilGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:iFnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T12F5523787964F99BFA1B06F15C8381829B3B0EC6BFD1938F77481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 5888d575a25f712267c81fe93658e0e443b35ee1e3509400f131e10d06241060
MD5 d871b3fc0b5043b0fb1b4e8dec16f56d
SHA1 56f75e12b7cc5d6da89ca9919794d1989f8524c0
SHA512 119b6c67496189f1adfcb8ef8ec3797639a6cb0bf756370f9d43dbf65eb56b8494ded46b277929e86e8ddcdac8cb0331c7bf606c7e70698fc04e2b9f9651ae15
SSDEEP 12288:7aGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:7anQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1B25523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 9db3020a43a2f28c019479dd958e154a1f2d58665122671d48a80bc6e2858bb3
MD5 d019c14d5572d35f0fb213dce9ee1dc3
SHA1 836004748a80bd0a5243c5cf38cbef8a94c1b729
SHA512 f91a763181184b020122161f7fee516f16972bc00446f0231590bed872aa34583f34120082679332a27045c73c4cf080a97cbcb3c9680105968af82569bc42e4
SSDEEP 12288:9QGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:9wnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1BA5523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 95868245c985354d739cdd9be06d1ad6aec484b27b70c3415b2409e9700613ba
MD5 3a897033e78ff6c8c8cb401a2efe0ec7
SHA1 288b837bb5bd56538967a750f5c3186e315d75e4
SHA512 19d884291d1c0bc78e2ebaca8c0e2319ac4111a29860723adb6297a36236473934d6b4cc0944d2c5ae6ea0e0fbc554256c7261380e3f06db99eb851d6769617d
SSDEEP 12288:+rGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:+bnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1D75523697965F98BFA1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 884f314e214628716a3e203f0eb3a6861fb7e72cc3693bf6bc614a0cc7513bbb
MD5 d885303b82acbfe1a8f3b523cedaa2a8
SHA1 fd0fa3cfae279f4e0c9cdef56e33804001d29f91
SHA512 def1c35aeb06f48987cc60cf7dc7ce231bdbb993e0ffa011753a1c64644e7083995711d878424a9a77e4a35a1593616c8f9374b3958adffee0151d2d4d36e2c1
SSDEEP 12288:KoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:KonQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1C95523687965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 bfeeb6ff0cb52c9db86c79f1ae4ce4a1376f43e33d18151e5e2c036a02c15a6f
MD5 ed821387a3b0644404baff0872db3e66
SHA1 88c5cbfe8aa1275d66f544761cdfcacd1b04a482
SHA512 3fb32a7ddd24d30ca6ee07d38b2e2ed170e830f7a4ce5a058417cdf25136b9f8e12a0ae8d3bf4042b5a61e6c654147e53e404b5c968d992de0a53de8e598e737
SSDEEP 12288:iGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:imnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1A95523697965F98BFA1706F14C8381829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 3d9fa23424ae79e7bf949fb5611daadf133fa488f0b9dad5f14721241c5d96bf
MD5 495a9a86d31e5cc0a9a8eb95cb77aae8
SHA1 5fc1b087932c6ebef21244ac19dcc93211669b87
SHA512 0fdf66e7bdb0864ddb53b5efb6b3455074ab4e843db1de179995db5cfc796093f6684eae76784c950643ccb18aef5c5cae1b20d8292e35d945e9a451e420be91
SSDEEP 24576:ufwv/k9RX6wkyAIcnQ/tbw/2Mkjy6Fr7g0ok:lMnYIcQ/lFTjN4
TLSH
T17E85DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e799fe46459b9da67e2e1c33f590c92d3647479d4d77d918ec4917485dbd0e79
MD5 2d2b30b190d9101fee5163a5563e583c
SHA1 100557ce1cf2553505b32117939fc2a80cbe54cb
SHA512 17c25b2a3a449db26e4cab4bbe1cd432cf3c4f8c8ef1fce499b592bf26204afc718ba207c9b7b2f4703313817a1e075e7e07b88d18713565c574bdafdfdb65b9
SSDEEP 49152:aYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0HQ/lFTjN4:0ySzPELm
TLSH
T147066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 bacfc3f28b22db06d6136c493070296e2033bf98a83437c3df1ee4d86da4dd1d
MD5 f4019dbee23360b42a1fc1a05339a7e0
SHA1 9d18b51af7aa96d2bd62e0965c925601ab364bb2
SHA512 95ca462224005f4bc979b61de0173e0d75ae2dcde7ccdf41cd59c34d3f63a43f4149de15d7e35a0a26ef486af50de0f16f93cab11a48ba507311f1d288f0957e
SSDEEP 24576:Y47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYpnQ/tbw/2Mkjy6Fr7g0oA:Y47JUQj1irIhCnDHUPfF/3Q/lFTjN4
TLSH
T1F765AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 3f3ddcf335ba028bdb33a60072d95989c9ff4b88dab790a6ee2969186bdc9093
MD5 83dd3193598c95372793de68f722769c
SHA1 3830de9d820c53aa5e88ff822a60f5f3c819d69b
SHA512 c8a13b44e5950b5a72eee4f86ad02e676d36b4d6fb4042dac1c8d85e0914b4cb4a7adaa5b89690082a81849b4768f96c9d156a6cc0bf96ee2bf6f029a5d670b1
SSDEEP 12288:rssfgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:nAnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T13465F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 1b92d29ceeebcaec8f09a4d6575202c76c15f5757356f32509c59d352fc2a05e
MD5 488d8e0a4419a64c085316d08689d3f5
SHA1 4ff4dd758f3b3e7c93e36f0805cef7063944d570
SHA512 3012935454c176c4828908e8f517459dad5d67ad585b372d75f65f470e2c76210979475ab029373ead844567e1604b54473f582bb77b6c1d20c8c98dcbf8accb
SSDEEP 12288:ccGPPBqbiD8Xgcj0p4hZlNh7PCR8Bo72m10aRMR:cXPogcj0p4hDNxsyo7H10aRMR
TLSH
T1424518107666CB4FC6A940321E32D6CCAB707D41EE056F0373C98B3F9576A59BAF2291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 da407ad91c2f2298dda74d4a9eba7ef2a629b375a847faa099ae4ce2ed70d58e
MD5 3c3343b245fd23e6a0d53458670f8b21
SHA1 a0924fc28ac401eee2abd0aed4c64ce114ce2a70
SHA512 09ee971158d5da02fc395593a408f8110c80aa63b3eeff12e2c494d8f9aa8daddd4c7d40b222b6ffb77a780bb251055e669ca413b33832d43c299710d0622c49
SSDEEP 49152:5gxaj3t4Fgxa9gxaj3t4AgxalgxajzYtigxaigxajzYtmgxajzYt/OUnxzf:YOU
TLSH
T15C751A40A137A78FC1BB503207356B8DAB74EC16B7096F26B3C8453AD866B15B0F97D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 7d695f992cd4d73e8d3227d3b1081a94859280dfc175d9dac1d22b355a85aab9
MD5 cba506e6e88e07b1d6c31309d7b2d2cb
SHA1 adf1dbbffb96e6454aca2e71a8254f55870d6ecf
SHA512 8b9b9ef5c1e86f9ebd9808447d4259100ddddcf386d7e49b72ff331aa87ddb6e8493bc00c007241b40ad24cec374f752f512648101774b1efd35152fa1334af6
SSDEEP 12288:s674GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:H4nQ/tbw/2Mkjy6Fr7g0og
TLSH
T1585523696668F94BFA3B06B058828111673F0EC5AF90D3CFB7082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a9383d8d2762d0d9981f8a2b463f2343aa815bf2abe9e72f3b85def7aeb667cd
MD5 e69a6faad2a54ea73419bb5fad87b620
SHA1 1e4fa64f0317381a00ed8098bc45c3f6d018ebc7
SHA512 4e2da7b66abde5e6589f3c7ae78786994fdf0cb430f9d6cf95040650c69f575ad23c25b3741ad6a793c709cc4c4927fd9593e82069836fac8f95081bfb9eaab7
SSDEEP 24576:xgb6bmBIi49WNNFpg1rSvFv7bYCnQ/tbw/2Mkjy6Fr7g0o0:xgb4mBIBhGFpQ/lFTjN4
TLSH
T1C165AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 8aaf3e2c66a860da233e7c36eb0715010288eb601480682d6cbac35ed0978393
MD5 4f394be965ae7bcef71e02724318ecd1
SHA1 91ebb09ef42e25f3724f1d6239ad5dd33e0ce5d6
SHA512 360fbcd3f523f532e13344f1953a3fdbdf6045d8ac151e4dce171125adc4330da0d56a32e112f9a91a7040f550749ebb75ee58b23e9a9c86d507cb0581e8a7f6
SSDEEP 24576:YG88u8FpJqH1Qzria7/m5nQ/tbw/2Mkjy6Fr7g0oE:b7ZFPqVva7/6Q/lFTjN4
TLSH
T15F85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 59e63064b66296506b906dbcd66abbdb12f681c58101fe6bb058046e6adb1192
MD5 0a6383a2aec7f890359b0021ae95a19f
SHA1 806545fe5e988f59c91163859820c90fa73a8d00
SHA512 b007530196dacdd6eebafbbce810b9e19792819a62226d32bafd64faed422ff96a6e02abdf95f209c7b8b90f22ee4ae68190f3cc1ccc207989bed8ad4e09fc0b
SSDEEP 12288:XHvUrBFrEjwaQtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:XPUr+NQNnQ/tbw/2Mkjy6Fr7g0og
TLSH
T16065E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4419cd7a50bd61a9de88892451128ab92a6d980ed52ade85165909ff87d38a06
MD5 30919100bbcbfb79ffa11782405bc2d6
SHA1 521bf0c636d19026142456440df6797f75d407a1
SHA512 73e5faf760a75b368eb37931d36acd4dc1d35c46a910cb44974bd0fb914263ce124c7098ccb21c77393f80d11ab859821b81f8a49a09afbca1a4163789881ff1
SSDEEP 49152:KBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjdQ/lFTjN4:1G05lO43bHLm
TLSH
T166D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7bdb6a3249d3e937df1ab97a0d48d70ff54d9d732602a980d88d9b3fe6397645
MD5 adfe843f3f8a7632f8d62237ef331b1f
SHA1 919935f6970587d26ab5c0b076d781b27f644d01
SHA512 096309f138c89861600423a2953bd203c2635cf854bc5469b113363ac3be2118323350ecc10b8f3eacde1c25b7960d954fa4a036ab6d3918963e26d23692b645
SSDEEP 24576:3fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnHnQ/tbw/2Mkjy6Fr7g0ow:Pa5POZ3+Jt2pasx2+mFQ/lFTjN4
TLSH
T18065AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 429e01b17e077ec7786c95479b411422464ac52b394d3faaf4ea2c1eabbbbcbd
MD5 3433c705d62b38a910e61e5f67243b7d
SHA1 43db5c310f06080194e48919c9d5c94b515a49a7
SHA512 affc3584174a9cfc00452f58f717982fd0efa5af7e6bbbaa37bf97f84eca8531bacce3aa0770285aff4de91e80b7c61f982ade9b8fc141e7cf53b3fccc22c18b
SSDEEP 24576:0NcwHdjbyQ4nLC18lb/EOjowL7FkBnQ/tbw/2Mkjy6Fr7g0oL:0Nc/zEOVHFaQ/lFTjN4
TLSH
T1AF858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9562d0fe5c2a5d3a57c14dc97ce056754042d1e6ca36fcc47e86e758246f2f45
MD5 a9d6c8161fc13da1a1053464354c13c3
SHA1 b3e04992fb2ef4b3c1155545e83c35cdcaf6185e
SHA512 e973cd08f3a1c7ddfd25bd02efa0e20768a60b798cf302d6684a14a21e04e6ac861c0e819f10bc21f364a14c7dbf3e0192cc16d3e7d81cae85d4bae32b486771
SSDEEP 24576:q8kNvNnaFeYhJNtmZBmBnQ/tbw/2Mkjy6Fr7g0oY:q8MwBtOmBQ/lFTjN4
TLSH
T17555AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 d05d6e0e2e470455458c2f24dfdc3914a1c955ec4cfb15b5706e1165b4c40c1f
MD5 14c87262d1a5bd4bc85f2073a90c3222
SHA1 443fdace641410e2cf2d600011d313bd9bae81f5
SHA512 bc2aebf062e3ada4208aae8167476235caf252a378173e1f0999bf8f18d14bd55512a4fa32538fd0509363b4733015bb0e9f47912cd5028e58fe48a0b4865cca
SSDEEP 24576:kD3FHshBIYQgAEnQ/tbw/2Mkjy6Fr7g0oH:kDVHeBIAAEQ/lFTjN4
TLSH
T1BF75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1048-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1048-138-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1048-130-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1048-136-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1048-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1452-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1452-317-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1452-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1452-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1452-111-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1452-104-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2504-7-0x0000000000690000-0x00000000006F6000-memory.dmp

Download

memory/2504-0-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/2504-6-0x0000000000690000-0x00000000006F6000-memory.dmp

Download

memory/2504-2-0x0000000000690000-0x00000000006F6000-memory.dmp

Download

memory/2504-29-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/2892-43-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2892-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2892-56-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2892-42-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2892-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3244-124-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3244-116-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3244-316-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3524-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3524-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3524-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3524-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3524-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3976-77-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3976-71-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3976-70-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3976-298-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4184-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4184-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4184-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4184-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4240-15-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/4240-22-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/4240-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4240-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4984-313-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4984-82-0x0000000000770000-0x00000000007D6000-memory.dmp

Download

memory/4984-81-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4984-87-0x0000000000770000-0x00000000007D6000-memory.dmp

Download

memory/5516-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5516-92-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5516-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5516-98-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5516-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5516-333-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5664-65-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5664-59-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5664-58-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5664-282-0x0000000140000000-0x000000014017A000-memory.dmp

Download