5fb89a69eca347e7b59e0a03a12fde0255df40e0f197c03f7391f843902c4c80

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_294d95e171678000cb41cc3c86799cb7_elex_redline-stealer_rhadamanthys_stop.exe
Size 1.3MB
Sample260930-ejlrwsvgpf
SHA256 5fb89a69eca347e7b59e0a03a12fde0255df40e0f197c03f7391f843902c4c80
MD5 294d95e171678000cb41cc3c86799cb7
SHA1 195bbb6851ee4e0ac7115836f1dff84a61fc5b49
SHA512 27fb70f2f6a3e6a3d5e500a28ac39f13d236e3f9b3d420ff481412f390b66e4588acec48ad04b937bfd7057570494d4b7b2029d64f468b6acc2322e458c13c1f
SSDEEP 12288:R68GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:Y8nQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1F75522647950E473D91B04B54842C6A1AB3F0C913BB5DB8BBB89177F8B383D05A6B389
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4208	elevation_service.exe
4516	elevation_service.exe
1288	maintenanceservice.exe
5036	OSE.EXE
5440	PerceptionSimulationService.exe
1456	perfhost.exe
1740	ReFsDedupSvc.exe
2500	SensorDataService.exe
5788	ssh-agent.exe
5240	AgentService.exe
3824	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\bda46f713a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_294d95e171678000cb41cc3c86799cb7_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_294d95e171678000cb41cc3c86799cb7_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_294d95e171678000cb41cc3c86799cb7_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_294d95e171678000cb41cc3c86799cb7_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_294d95e171678000cb41cc3c86799cb7_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_294d95e171678000cb41cc3c86799cb7_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_294d95e171678000cb41cc3c86799cb7_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2780	4284	WerFault.exe	87

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_294d95e171678000cb41cc3c86799cb7_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000578343399050dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba1927399050dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000019db54f68f50dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000048629f78f50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000fedebf68f50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000e8971f68f50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f7fd51f58f50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4208	elevation_service.exe
4208	elevation_service.exe
4208	elevation_service.exe
4208	elevation_service.exe
4208	elevation_service.exe
4208	elevation_service.exe
4208	elevation_service.exe
4516	elevation_service.exe
4516	elevation_service.exe
4516	elevation_service.exe
4516	elevation_service.exe
4516	elevation_service.exe
4516	elevation_service.exe
4516	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
832	Process not Found
832	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4284	2026-09-29_294d95e171678000cb41cc3c86799cb7_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	4208	elevation_service.exe
Token: SeBackupPrivilege	1740	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1740	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1740	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1740	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1740	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1740	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1740	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1740	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1740	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1740	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5240	AgentService.exe
Token: 33	3824	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3824	SearchIndexer.exe
Token: SeDebugPrivilege	4208	elevation_service.exe
Token: SeDebugPrivilege	4516	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 4876	3824	SearchIndexer.exe	103
PID 3824 wrote to memory of 3284	3824	SearchIndexer.exe	104
PID 3824 wrote to memory of 4664	3824	SearchIndexer.exe	105
PID 3824 wrote to memory of 6140	3824	SearchIndexer.exe	106
PID 3824 wrote to memory of 4348	3824	SearchIndexer.exe	108
PID 3824 wrote to memory of 4260	3824	SearchIndexer.exe	109
PID 3824 wrote to memory of 1148	3824	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-29_294d95e171678000cb41cc3c86799cb7_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_294d95e171678000cb41cc3c86799cb7_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 496
  2⤵
  - Program crash
  PID:2780

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4284 -ip 4284
1⤵
PID:3392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4516

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1288

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5036

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5440

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1456

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1740

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2500

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5788

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5240

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4876
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3284
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3064 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4664
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3020 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6140
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4348
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3064 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4260
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3020 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4a44ba5ab4b3672669f53f24409e3738225c431d3c9d7116a9bd13941e0a8eb4
MD5 9d39b7fcafaffcc83dfdb22778908b3d
SHA1 f63b1e7c66361ac5233d84f89eee68125eb06360
SHA512 8558642ac6f8cec9280b6ed28f54b551d21f723a44bc4c26f9c199eb263f96ec943d5e477e75905a219e06943b72429ca7c3e840bfb002b6ff8fa218d706f8e3
SSDEEP 49152:mb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnnQ/lFTjN4:Y3q6HjBTLm
TLSH
T122D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 9147292b19d40d129fbc68844800eee66effc67121bbcfef5335bf7fca0587d7
MD5 bdb63b90d60d9139f6e8b98ab9dfb21d
SHA1 a11831371d4151d44783c2954d5a89e948ea4a95
SHA512 dd6ad086ded24a4803581a081a499d491f57c3c67803bbb4586decfb898125f05fb1b6387c2fabf8c31d9d3d6e2caecbd0f06a0b75e70e864b81cd217e712b24
SSDEEP 12288:61XLsswWkxy2lRq2czAkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:QXYfDtczAEnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T13765F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 3ea993ef3c40a8533bfcc723f38cda1c157f4a8a2944aca8afdbdff943b1665d
MD5 0a164638b4c88c74983105a35895d0a4
SHA1 780023c3b32171ca46ede5d024a07923c36133b8
SHA512 f8aa266e116702b95f28f65a50346134ef89ef0765d93875f3aab3675891923ccfc096852bbcd40d597e49b02601b506b423a15e51d1c859426a9f283bd39266
SSDEEP 24576:l0Le5ji0hmxLrM1nQ/tbw/2Mkjy6Fr7g0od:lPji0AlcQ/lFTjN4
TLSH
T173859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b0914e33943c2f36f4bcbf5e7c3e077a1dde51876455d4c29ed78caffdfc39fb
MD5 511ffec7317fbc66964b1e974e4687c3
SHA1 40b61d88c51fc0c943661034747341db97d9e00b
SHA512 9060ca70cff5deda390be97b14ed92dce3dd6f9beec9d7749ef6a9d05adddc50052a116e15573dd7292e1716ab03b044c2e6d7fb97aa15cb4b6b07e4393a3193
SSDEEP 24576:Wa7/ezSC6vUyD/aqgrvWE6q8wyuDnQ/tbw/2Mkjy6Fr7g0oN:h/ezSC6vUzPvxHjyQQ/lFTjN4
TLSH
T172755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2c8d0352caa22dea9b5d6e87f41364cdcb027eb1a9cce8467d26d51096876562
MD5 8ae911f23e2a4d05b8006c9ed3938768
SHA1 7f56891be3f0de6660dbbcb00b51850f745b2d09
SHA512 3927c747f58d5e0cdb49c72069b4612878ccef1bf687cb0bd8a73bf018987eb876bfab1fa6fd11a0ad326caff7f867863286a260af7f60f41811a3328fcc6785
SSDEEP 24576:oVbqPb88hv/l+6+nQ/tbw/2Mkjy6Fr7g0o+:oVO88hXl+ZQ/lFTjN4
TLSH
T11B559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 53233e7361fe126a2ebde0223cb3bddeba3a4e5a4f1defab50fe700b4ae0cace
MD5 87f86aaf1a42b48aea7e7b2ec092acbc
SHA1 c84be00f9107dbbad551536cba45d1cf9a9bef57
SHA512 d242cffa752160660762ef28af7266c52875f088146829668b7b04408a2f6bfe33ab5ecaaa07c975af05523f5b9d4ce43322578932ee68b6055e5b09c09b073d
SSDEEP 12288:bzhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:bzxnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1C35523796A24F897FF2B06B55CC284826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 dee0f7c7413598885df657e15690fae40652ba275bd987e849457274fdcb337d
MD5 1758796d46ad8e532b3ef35a8548561c
SHA1 3a450aa0d512b97a497746f539e00af69a585968
SHA512 a1a923cf57547d942e63725142d1c140000ad9455e2b4d548c300dbfd82c629a90be47d8faa83f68bb159a3b1cb7c7a0f6b6b50c443cb425250d799d020f9018
SSDEEP 12288:WeBNUbTVO86UmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:WJIUGnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T10375CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 569973b1359c84f4a4bb49f619751d68b2749c5c980fb7243a941c61e7f0c7b9
MD5 de5781e14d4cba50f876966df65f70cf
SHA1 130aa0dbb2895125743ebfd73449981b26df2650
SHA512 642110c9cafac8a96cf7fd3c85585c8a61170a27b65baf4ccb6b6a17513afebf89ea029abfc4f210e44a59b2724ee585e30348088ee40827753b4825dd2958f9
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THc:OQvGAdlCEL8c/yRNw5C4Lm
TLSH
T146267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 da591dc4bb9ef072af6e31ba64faaa0af560737b1065a143386ba5b505e04735
MD5 d1d79e6a0d1517c2a76292a0ca314dde
SHA1 75bad7cc184b009689c576ecb3ee6f2493510093
SHA512 fd6eefe2c54b81923bbe91e0ffde82a0eacf0a70ac2774cdda8328dfda7196e053e51ac626f4de1013ff50f021ae7436ee3bc1d395b9003d78cac69b5cbf86ce
SSDEEP 12288:JAwSfxL/2Dc39DLLmt0LDQewsAjsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgq:6QewsAjsnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1B875E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e78c263860d2de5656943ae9c44c315f94a15001d07050407d6e2782dd3b87a4
MD5 805062e921696ea28586da3f5600bfa8
SHA1 986e0de45f8f468e0a4d40c695dc2985154d3547
SHA512 6e1129a2032b3ef80d5ec95828aef0517f092aa19e6687a64c489e1914a40d53732b75a7daf5eeef8c08550da3ea71d1f24a19d5877b3084a42331181b5e067f
SSDEEP 196608:4UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH3L:4UEtQevvqc2W1cpV2EI32
TLSH
T179474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a2601c86587db1bb82aaee2d1c8450d6d0399da24285736decf4db1a90c088fe
MD5 84fb053a238550f65973e9981cb90ea3
SHA1 84a152cd23af91b26a6dc1277035698a301aa81a
SHA512 943cfebf102b2dde23209113492947e15c2b4b860d2d7ce783d5c64a83f339cbdab1de642d0be69fd7f7e58ce14af3b03134d2258bc5466c04628da5152332f5
SSDEEP 49152:TCbRquA/m2yL5zQfFiV+XenmE3/zMQ/lFTjN4:soqtVjnm8Lm
TLSH
T1EED58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 03ecf6ec502d5c8a42349f5db2a6d5251d4b73e550c3e7145fe95987f4be30e1
MD5 76b83b6c2c77e5a200e58ba17168f18e
SHA1 7cfc52e1caacc8d4ca3636279692d1fbf5ac1e23
SHA512 f71af2fb506f77393a51541b8045da0ab96016ee0498e728b009f9d6d6069d6ff542755c856cc0a501b6f496535d2f2ffe0b56220739df0ada3f03e929c1780d
SSDEEP 24576:BAhGLJIFoiwtA5l7S533nQ/tbw/2Mkjy6Fr7g0oG:BAMyFoiq5nQ/lFTjN4
TLSH
T1F535AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 0a6d91fc1a47116e62ca97b5a518c9e6986c93324ca3e8bd9d9489d44b9ebe75
MD5 8d0b84daeb48218c9542357df6776358
SHA1 165dbdc1846d48a151da476823e8a7f2c2be324e
SHA512 905d939aa8cefb1ac5477a6ad2ab8729143691e3aa5b48a02bc4d2ab755e4f98e89b212a5ae9cf151ac1905e80d9007e6d4236f0260dea3cef9d2acaa5cec822
SSDEEP 12288:Qmw5HEjsChN2BFgl0WDm+CFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMM:NwuHOWqnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T13865F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a02dc2e9e7c131048536702f6a9fc43f7d00de85e109f51f7271ebe7c5e1e542
MD5 f5d5108eb3f1affd91d19ef6d51530bc
SHA1 108bbdb6138b5f436bd3a4c82ab7321b3e544883
SHA512 9cfd698c5486032ca2fb2bb5b822fa99037333219d5b406c3e1faaa23af960fd743a9a83b32e4a5d9f7c187a8762ad14d12383d1cd7bdbc5b00ca40b51e8d1b6
SSDEEP 12288:rXZ1Iy8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:jZu9nQ/tbw/2Mkjy6Fr7g0oA
TLSH
T10555126937A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b5eef06d60d9a868d38ba6fe1eeadecb32eaf19baade3485d9c1b06881b5c6e4
MD5 64e0c41f85b830344e7fb31a17c2d839
SHA1 2ca1bce01520f90266f79f23f36d74e262b4bd0f
SHA512 537e79b4c1e6ed8cef8525f94e3a3ca792f4ce172dab7374452ee2b320997f372c86af24f295ac9f19d79bb05914aaf1f6cc820ba3728fba30369caf3df7ac6f
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U:QQRQyi36YOcPQLvw2gAf+PN3VLm
TLSH
T13B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1f24c9bdde538783df15a240dd0692d98c8ba7b3472fb454e9850061be121fbf
MD5 fa73b96b77ca178ae0266fb4b8514ef2
SHA1 df259d7cbdafc91b5b06fe48724ed6a0aa90c918
SHA512 a94f7254312c64df01620004b7a133efa6fa5b2be32256abee3d4aa6521427591e006c967aafe13a8b0d05b462e58b10bd0a032dbe2315f09239022e92373849
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U:yQRQyi36YOcPQLvw2gAf+PN3VLm
TLSH
T1E2667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 cbc16923a6e6688f9a242b5e653311f753a7f224d6b0da45d470503e1a42384f
MD5 cb7cb89c49b6816c5f627e238d17c39c
SHA1 ecc3648485f1cde920323b4f1e7a50a44a073360
SHA512 55ea43849de0ca19849f2ff731b103b68f007d27e3996af5544d95d7c36748df0bcacc040ab4254f3750bde8340edb4a978c3f7a8b346274edee715dddaf79cf
SSDEEP 24576:mwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0tnQ/tbw/2Mkjy6l:w68Qg55nhheWu7PNU3/cQ/lFTjN4
TLSH
T121B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4d05401a25f746695be95794e80f63877d46b05680f74b4e71b5701be0f11336
MD5 3cbac2f4c0c33aaf6527f82f24285c33
SHA1 b2ef8d08c17b22d05f56b1db5ca9370d286ddebb
SHA512 1c08049c34723df2bfe84ec51f7a529ab743558790983ecb207cfee974a21895e97ede47061fb60948f00c5d01a7ae8823bcf7da8245a415d6e32dbafa6cc9bc
SSDEEP 49152:L3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99y:Oy5112gYy5azzVvL69nLKnhZWLm
TLSH
T102167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e60d3dba37cc7853ea0fcc1f7e8d2d97ae2b483771c953e23ab18427b19b973c
MD5 874f308c10b4f8d49bc3515faf028ebd
SHA1 7792f71ab14f42e031cd67f3224614078b402fe8
SHA512 12e68e36f4aa920bfa23107175b221b7f90f5447fb5a63df02b11685c7dc809664ec406818d5154b420eaccae206233b7e5639e7f205ca4c36ab54454b4cf275
SSDEEP 49152:aB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glUQ/lFTjN4:Iu6JmVxd2dHLm
TLSH
T158D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 90b59325509800520e80e0aa337fdc0377769ec63c0add0eaa72312a49cfd3b4
MD5 6d018105534c1f5f15cb0849e9c5e59a
SHA1 1e4eae499e26f85d3bf9739cd28ea728f9a905da
SHA512 777f6b73d5c5685bef94986f030dd2722e08da65fc8fe05a0e64a854441b1fe66b16d07d28a9cdb13bf42099ab5e678ff24fa726a1d8f775538345ccdf41433a
SSDEEP 49152:k1hpsNoJpF1A6UU44CwH7R4xmQ/lFTjN4:kmifPbR8Lm
TLSH
T10BB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 da20fec15660086ed19b2896884395d8540f9cdc9b158b7c1819e83e559498f1
MD5 2c082f11cacc849c534bcd9b1df8cdcc
SHA1 72c50bc7fa5db133d2200f48dda57165a8701a89
SHA512 05921127ab27e6d452af71496d1b657a538bec0e13a13cdb40f0fc07f33536810c1918792d2454aebf44775644c04a787c8d7439134a8f5c33611a7405e480e4
SSDEEP 49152:RSuZQIY0Be2KRRVtOnks6NMHq9Q/lFTjN4:/5dKTi61yLm
TLSH
T1D7C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 226bd522e7b0314c700562decb4f1e3e47b6f33bdc90ae71afaeb12690cb7dc5
MD5 068d3e6f690c756bcd37634f05382a52
SHA1 06f778ff1b28885879bc7b58c643466b5a115620
SHA512 60d439be7cea1b633f864f3b93a1135d4a8e6e72efb2a044b59c1b2e4dbb9529d02a21a417b429c1d67c6d45b2b0133ffab65d020264e95dd8d4108533117ea9
SSDEEP 49152:ghtSn8EApI0figngiDn0AP5wyQ/lFTjN4:xX2iyphgLm
TLSH
T19495BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 23b62ad048d228ef0a0928c73d6d2b8e774fd02a6e3259cd7f1bcdf1411fccf4
MD5 28e76c2e6d7267a6f213d8b5f70d139b
SHA1 7739cfd06698c6425c66cba4f4c8072c1edefd10
SHA512 5cb1dde2ec7ba85723453c52b54f604e0d6ae98598b0f53b78e2ad37b548a75f8842ef83b39115f68ab28af6c3e7d7a3d668306393bd18e31759f58ed454cc2c
SSDEEP 12288:gJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:gZnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1625523697964F98BFB1706F18C828182A73F0EC6BFD1938F7B481129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 43d05728caced8ae39d600886d72a6cea085fec8cc3af6bbc604f43b605572c5
MD5 da6dc7b9da745df1086a9d8f43632627
SHA1 8192ba4c2704a92c91bb88a5e5411c89b22113e3
SHA512 8f4375f230eba82c6170cbb5771f77e2dc9933909947095b51acf5d3fa2bdbfe918ead5161265f341893d7821c21e02a1ca745d308205046a931ae9c90724978
SSDEEP 12288:VoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:VonQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1905523697965F98BFA1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 cb08661339ec9b745b67dab7b5eadd4154f6156a9f11638e6bd7d4a0439ba453
MD5 1ae2bbf25e02142198023e5ac4d86aba
SHA1 a847cf8e43d65cec58b4e88ffaac5470d0d60eba
SHA512 8ab2cead6ee9d042da2b5ca6e273ff3471fc444485ec765429091417261ed73ec01486a3174e7fd38816eccb9b5af4949c4e18dd5185014d94e90186ceb621d8
SSDEEP 12288:3uGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:3unQ/tbw/2Mkjy6Fr7g0ol
TLSH
T12E5523697965F98BFA1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 05ab64e8ef40e7d65b12917a69b45bba6c8f9f8e0a85e2c7a0ed121f7dfaa136
MD5 abef9d2726640eacafaa052e3f1fc964
SHA1 daf3419f2d79ba78f99ac920f91c3db52bb16dbd
SHA512 556c0dda60c921ffd3eccb450f4567a0e2df655e5b719b2a58d4b9378a725884e2855cc6d1685a252651b166d4e77d8d3b1d69e7933c42c33dae4b1f7328e39d
SSDEEP 12288:0V3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:anQ/tbw/2Mkjy6Fr7g0oO
TLSH
T12D5523693B69F4C7F92742B4CC928142E77B3DC5BBB1A38F6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 3702acd164e68c4d497b9ceb3c98466645488b3ee6466b451e18d7a7cdf9ac33
MD5 acfdc8e2449216da8c1913458f1a6015
SHA1 0e764f72e5eb6c85e14de128eccdb9722c7a581e
SHA512 27fcaf17ac379677849b1ddb5b273bb299e9692ccf1e294fa6fd309863360a93661ce51ef1ce375bb54238e73645461ff644b129c34df912adbb16d31648f1e1
SSDEEP 12288:+vGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:+PnQ/tbw/2Mkjy6Fr7g0or
TLSH
T18C5523697965F98BFA1706F14C8381829B3B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 09cdd3872ca6c8f0f65cb93b402261d3e771fdbae44c1b1e06f196f33059ba10
MD5 b447914bb408d15cfae0425fc194a41d
SHA1 81a3ab967f93a03a036ddd270b0b668b3b30721d
SHA512 5f30fbebfd035c74c9e74845b92ea34e05c05269b850d1bad0bba8a06e5c8ce4b6d2bdf3ec4a57e10262679b52ba62a2509b7f28eac43ea464d596fc36f18b2d
SSDEEP 12288:t0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:tUnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1E75523697964F98BFB2706F14C828182973F0EC6BFD1A38F7B481129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ecc062c2f8512835901a85166fd0e1ba8242e86535574c48226ec74ae56e9c80
MD5 cf73b01977f5d8259ec8a01067d9010e
SHA1 fc1cef46849b770f34cff9ae07e7a0753b74ccbc
SHA512 b1b0e51474ffa1a9ae897e8b7d666ffa7734b6cc28db3025ea35370bb537a34e937fd4fb3b8cc06939f2d363add2bf6ce67d1a059d8f80265d55bcabde5b1f7e
SSDEEP 12288:nAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:ngnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1515523697964F98BFB2706F14C828182973B0EC6BFD1A38F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 d9f4f47fa8102b78ef983e6ed85e6944db31de81b82157395d6321e3ebb1f1c8
MD5 518779b669b66c50765de66eec292b4a
SHA1 b40870a1d15ae220f09f17c4dccce74716560c64
SHA512 6e2a62a292d38ef863718b78ac70b7673cd3ffcb3cebf0e40a01f086506d68a31bec97ed91c5387edeabe34fd529af000f08115f679ea69b7d3712663f348c99
SSDEEP 12288:KiZwbDzzFEoS2cPvyIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWgv:tZM3zFVSOInQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1B97501A5B35058F9EC67823ECC518906D7B27C5A1BA0C71F13A8362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 141c97466a0569b55754f43e43e2f4d9f6b5ac202dee2aaff6e32b08915a282e
MD5 c47ac42ef83b880c7c1f0ca4a7ebc625
SHA1 3dea345a0afa15ac0f94b2afb1e9f927f0f1622b
SHA512 a9ab41fd801ef22576df16d6a2f84623fd94e7923411f4dd4db385ed816fff85d66efc1ec156e7865d59d0cfe28d207eb76c78eee0b00127d588147a4eb71554
SSDEEP 12288:htGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWgR:hNnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1F55523697964F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 40a630e2656bc550a6369a1d2b9e11e4f4db0c78c99fb642189219a956ee93b3
MD5 3229c46a15d2e9feb99c2f03c2908b5f
SHA1 28797b63276cce821bf1a86721f7b99479de9d39
SHA512 fd6cc7249ef82e09450a31ff316868ca31509df5cedcdd0f7f1159eecb54867da4b96011e4f3f0341f856dd468768bed3b9be9f593d2ca3285e8adfe992cf72a
SSDEEP 12288:5xGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:5BnQ/tbw/2Mkjy6Fr7g0of
TLSH
T17E5523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 43603ef729fe839af68f67684acbe4f364f4c2e0635bed32966de45149087451
MD5 b3d9afccf9fa58b95a7b8c4a40b29b8a
SHA1 cf5ee357cce9e42a36e4792e0535e70ec7dff922
SHA512 05149cdff30bd102ada9fced420bb70000b273688edf41f55165668567ee330fa8cc9b1ffd3ea45e4872e5d7d33c11536614f5b960ba8485a90f8b2ecb318bb0
SSDEEP 12288:dyPz5L88GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:Uzy8nQ/tbw/2Mkjy6Fr7g0oR
TLSH
T12A65021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 86eaa7a1980f0c65d85fdd676c06bcbc9f1ea20aac70fdc86061ec4b307f4043
MD5 7c954abb89efbf9b4217c63ca477f9b4
SHA1 7c74a437d081e3085aaa21b3e0af49f6329be80a
SHA512 dddd0544317e90f23a8420fc61e263291fbfc81902fce2da1e5a44592bbe055a9306e200acba68adfdca3ac60274e4c6afb2ab0fa8dde949639af589c2720dba
SSDEEP 12288:HtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:HNnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1445523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 32258497836fa07f2613684c2771579ca2931197cd4f47f60e7edcb7fa86ee57
MD5 6412e75107deae4cdd09c48156ee0eb1
SHA1 6f8777fb6b4816d8785dd6bfd1cd91458bdb00d2
SHA512 a301412cf1a4115f3ecd30a04f2379b3298f05419008ed4b69e60fa1d1da8688c500475819b5bd72c3c4c7226124554749df80b3e82a3e29da2f437df3f890fa
SSDEEP 12288:dtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:dNnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1FC5523697964F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 a43a91bdc0d868b923e65ecc862e3b9fb22f2eddd938ac177f50a518660390ff
MD5 c8942334d28fd6dd6e9b3d3ebdcbe54d
SHA1 fba24924e73d2cd5b8b44e73fec8b031faaadf48
SHA512 68e2797a70d548d4667586a975ad271fc7f0d6e3a0d5f359da55ac70912793cb96bdaa4b5d12112aab48f21c4cacd99769e24e6622a620fb97117400519503f6
SSDEEP 12288:yyPz5L88GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:vzy8nQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1BA65021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 b42571a52df0444a0241de7304af6a99ccf6f248d71225d7b05bdca37312d58d
MD5 a9bbe2add9c0ee8445fc971bfff2ff6b
SHA1 0deb154c86f1fabfbcf1c92ee2cb7a90514a87a0
SHA512 7373a44f1af71dbdcee9584f063d00eb9c269330770e97755cf012789727974a8258c561564f22bd2cc61d5d1a654b595f24e86eac81ef59eaed78262c31441f
SSDEEP 24576:WT0aLl3z0zDenQ/tbw/2Mkjy6Fr7g0oC:WTDLljDQ/lFTjN4
TLSH
T1FC7501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 6c2bdba3e315d3da8934f5337212bc1849e23f2473f7b5a430604973ea0a6c1b
MD5 4e4efc55b58173dfaaa3499f1152d324
SHA1 0bb2dc9b472da0850df56edfc0cce6afb859c7ef
SHA512 212160f4ed1ed3e7586df1fbebc0d006d88ce7c72543485c93b19e6311ded30db9fcd1fcf0e4457a56d011baa29ca643044bd5d8fb5dd028caf49b06802c2bcc
SSDEEP 24576:331d9CHKy7GZ6nQ/tbw/2Mkjy6Fr7g0os:H1d9CHKyakQ/lFTjN4
TLSH
T1DB85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 c7355fab6d8db24720810e5476bb781bdc22f9bc6a795e09cd24cc2a2060cbe8
MD5 dba92991b1eaf5e3a7db01247ab96656
SHA1 bd478f0bce6120874e962ef5afbe4f850444688b
SHA512 524395f64b935685390ae3f5db959b2ca42b4a1f44ff4ba2694e184af5ec7eec788fbfa8246855b83aa34570f66bba8f07d9bc954e80da7dde8af9d1c59f0d1f
SSDEEP 12288:tOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:tOnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1F45523697924F98BFB1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 5b718c3f122e33229f2d06cafe8a5381e2bb7ed3411540d2dcf2da56b4ab7bf0
MD5 a1d577978f41aabeaa5d6fc519f16e75
SHA1 a9a19ae6c5e87addd1dddd3b325ed0343a370e00
SHA512 8f6350784c05a7b63ad0ecb6a2e78fa5835dd579c14836a2130dd2b91b58032a224cf36a6143f0db21c840b5a105c1391ac9e3bee18b1672fde9aee443a435b2
SSDEEP 12288:ocGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:ocnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1DB5523783964F99BFA2B06F14C838182977B0EC6BFD1938F7B481129967D39406DA3C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 65205f4a484af980fc159fcbd78c31fcaa265cb50098279cf4e8d9697868a39a
MD5 be597f9d7cbac65f3bdb330c5bf9b6cc
SHA1 d6dc69add9e85d7f4c549768ae78c6df2917d052
SHA512 38139e74344ec6a915898f15d103c62e8890ec6bb03cf8693d4b665ca1166f258f342621238aacf52e91074884f73997a084ba58888f5abe9a5de7ebaa4a6dae
SSDEEP 12288:KLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:K7nQ/tbw/2Mkjy6Fr7g0o2
TLSH
T12B5523697964F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 8055cedac834ff2d64326cbb89ab7abcadaacedc2f90e8fab89e78a307f8a126
MD5 ce88ab944736b2f88040dd022c97a37d
SHA1 991ab7ab7c6b74a68f54ac2da1282048ac47bfb0
SHA512 1148ae13708e8496539ecf9a498a978a0a6bf81ef82938ab34d4d3c15b03b70043595eebce9080eb970297a4fa6070917f172a7f65a98172d6541d6f184c159a
SSDEEP 12288:ztGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:zNnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1195523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 35bb607f99cbb3fa3cc13e4cf0fba20574ccbf01f2a05aca5077c53af8fa5482
MD5 4e0edb8957a29c34ec2cb9d544c1ebfe
SHA1 d467dc58dd74a92ea8aa5c9db26f799c9db0cef6
SHA512 f98b007974189f7105b3423a561ec361553ee3f5071b35bf74032b5b89deac0e729f853dfc747cea7dddb70990742c3be91b61d7c901f2f2c5d4a5b2a4d8757d
SSDEEP 12288:sOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:sOnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1E05523697925F98BFA1706F14C8281829B7B0EC7BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 e8bc805bdf9f0073bc2b2c912a2b9614f38e3c56bdbffe9ac4c346663a58e792
MD5 a220fc7cba41a108eb6fc1526225e4a0
SHA1 85d13cf2b3166713079bb286f36d398e9370fdd1
SHA512 2f501e4c6e08d834bace836059d3ba5219868bbd7002919f748e0a75ca15d1797e915dd9c5a1e15dbaec1a66f1e8fb1bec2f15fc4e958cdd81ae398b8e3cb621
SSDEEP 12288:tFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:tlnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1235523697964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 85786fdb12ade5de6aebf47916e889fdfb3c3e0c3e6f93b19921486d52e37836
MD5 30018613f1635acaaf6289f26e5f8d8a
SHA1 65709d8766f825dbf08ce9f28657dc57f7b68e96
SHA512 f5078522cd7b2e18e10f8547e24a659d77d27e0bfe25b92600ce35acfea91f8dc85df9e9545e8d3f961e4f2ee798d07438c9d2a346677aea331c1046dfc0a811
SSDEEP 12288:tvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:tPnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1F75523697964F98BFA1706F14C8281829B7B0EC7BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 b042a7f34fab4d169098b180a2c54a813fced9b94a0af4b75b1a06f2f2473c7d
MD5 230d8d66a443e072d898c1c6fafcc4b1
SHA1 ea15d4511d0b30c1672cdaec4b8d452b57b66ddb
SHA512 fb065f67541ce823315b8f02b7e7ac7122d5edbba0504d06dc009c0d4903183797f08700123cc12278d6629dcb5b0afe531960b91d5bef9053ab32376d78acbd
SSDEEP 24576:xfwv/k9RX6wkyAIRnQ/tbw/2Mkjy6Fr7g0o4:gMnYIRQ/lFTjN4
TLSH
T15085DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 bf45fe2481a45f8e1a1e62bcf434e605a4c9b2317f2c7326bf6797cd0665d0ea
MD5 78cd1f302d1e6af03de1ea2bcd566188
SHA1 26a2826ddb69beafcd84d15006dbf6a496076e5b
SHA512 8a3e1a14abbe5c903d46194565e3368618f3fe2dea7bf99b6c6a6dfb94082aaf27ea7d53dbb483f5bdd557f19197039116806ca91a78a65a5dd785658aa6d385
SSDEEP 49152:rYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0SQ/lFTjN4:PySzP1Lm
TLSH
T10F066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3add532588f427d941212ab6eedc5d19f10a966b53d9e0270b9a6cac7da6fe5f
MD5 2603d6add8a9440e6c42a609230d87b6
SHA1 741fcd02bb2c3f77a8766d8b9371a0e33813170e
SHA512 536ee87f2a01e692d9a2e30b1d3b214f15553a65299911830b989d672b7ab1c0a3883c88ecb5134fab6b433fbd754571a448d973111311f0816965db4e039720
SSDEEP 24576:U47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYYnQ/tbw/2Mkjy6Fr7g0oa:U47JUQj1irIhCnDHUPfF/iQ/lFTjN4
TLSH
T11165AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 4a00e580474f3de5ad6de7e031f0e8355f76f81098e30b2afa8988e5601f2eae
MD5 fd5ba190cae8963b254ebb86634afbf1
SHA1 2120b639abcf4ea60ae212c184007a5e52a7ea31
SHA512 44741f816e7fec6b1001696e08632c53f2f2ba00d402d82c395127b7a4d8952f37e57ef4f1ccbea5e10f95f784ab2adc5306b7f5bd9eef4793d1e9206a83362b
SSDEEP 12288:YssfdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:29nQ/tbw/2Mkjy6Fr7g0o+
TLSH
T11D65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 debebe23870ad456956f432a4b51a7f52b25322dadf5abb1d3eb596ecb4891ac
MD5 344777dc9866c87ddd0aa09f2e1fa8da
SHA1 97f8db123640f695d7a677e0b17d3d6b108a7940
SHA512 6cdacba92b3a1c2984ae7de44fdda6ba5e895c529b5032b50f52d29ae80de8fea5a35b7930378634fe611c4a54222688eb124923257e3182f5d46c145c2ef1cd
SSDEEP 12288:Xcy/eBqV46EdDM2s/fURxUCOJkUJ6R0oRIK:XneO2sXtCAkUMR0oRf
TLSH
T1064517107666CB4FC6A980321E32D5CCAB707C51FE046F0773C98B3F9576A59BAE2291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 221af95c5ac90be2583d99997048fa0bd9cd8d4ac935bb0a9c31e9aa43aa0a5a
MD5 87e64ec1e7db3fcead986b4aab774faf
SHA1 8ffeae35e7730664d0725044aa130fc7c1049fab
SHA512 6d485dcd7a22b58f64ec4892c9b38648ad7393d2d1be20f2c46b0174c182997d831b9d5f2b13e1e7d639638dcc18030794be36efb33d8ad295bcd2c40983bd0b
SSDEEP 12288:Tt2h1bt9GGy89ZJSvTDq/BTinT6k7pFxg8O9OY/VF:G1bttETPgZ/j
TLSH
T120750A415637A78FC1BB603203366B8DA774EC02BB056F2673C9053AD86AB45B1F97D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 004e189984478a162d2a79ae548981e6318dc365f3b4a6e9cb78f661339c01e1
MD5 0d411c80d8b25a75c9bbec93ab8f30cf
SHA1 9bf31a819b6b380e3006a49ee6c291b52dcc9f2a
SHA512 7ef1f556cddc298c6e793c37b78f61e81e4109fb4cdd24783741030f33755a51d9400e7b95b81c17100510ad382e2ab68b1f287bda33c5b7a19923f7f9a656d0
SSDEEP 12288:b671GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:CVnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T14D5523656668FD4BFA3B06B048928111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9262f0e2f98cf5ebca8992d09aa2c2bac58000bd7c5ba32d5a1a0e23cbbdc472
MD5 fdd6504c17c7535727039c0953efca3e
SHA1 a06ad5ca9a56fe7f01c6bd28b895241b233dd86d
SHA512 4c98fbbeb118d02807431730ffe17d8ee31fa7d9602e07b72ea4db8b9a41bd5b059e39e708c9b8afc63339a9c326a44d8f1ada4098327a6db5f4c684e681752a
SSDEEP 24576:lgb6bmBIi49WNNFpg1rSvFv7bYDnQ/tbw/2Mkjy6Fr7g0oo:lgb4mBIBhGFYQ/lFTjN4
TLSH
T11265AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 e51457653f7752459047cc64297657aa27dc8c8f67472534439de061e1d01849
MD5 46aeb01d6684b072ed9c1184f7ff35dd
SHA1 6e3b7d10f5899c29878e71fac49cabe617b723aa
SHA512 baf9c4d231fdad8260041b592c84a9bbeaaf8b60548dfe26ab72c6926607f32380c6d7c7079c4e06a8ce524fc702c418a879d11194b986a369b31791930a8097
SSDEEP 24576:rG88u8FpJqH1Qzria7/mInQ/tbw/2Mkjy6Fr7g0oi:q7ZFPqVva7/bQ/lFTjN4
TLSH
T1CC85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 54d4578c84fc5b0d4a166adfca236288f1e3c072538c9cce89fb9f8333702298
MD5 ccfdcde612c0ff54078aee1dacd12d0d
SHA1 74ef5adc6cf1e8c1f3c03ba0a89813726ea7282c
SHA512 3264b8f1e89158e78f6734385ea92cc6c53059d07e165ad963353c4e420b92a804a2d1a3cdd307f164fb3623927a967e1307e01ffa570415086eb4d2d257b87e
SSDEEP 49152:UBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjUQ/lFTjN4:3G05lO43beLm
TLSH
T11AD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e52d469b61ec72a211f86356f47263ec3636c17d83af179e2bd2aabd8580daeb
MD5 d7cbdcd7d90aedbdd806b5ddfe1d0b85
SHA1 623b745166bc9238fd01a12ee0b9b1c84ec02d84
SHA512 58c4c1e2c81ed800961f4b6ff4f6c41f2785dc56cd3a0a57001b52daa4d4d86968490f4da068a0ff099c32921dbd1f12e5ee25007bda07dd3761567cc438b02d
SSDEEP 24576:hfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnSnQ/tbw/2Mkjy6Fr7g0oh:ha5POZ3+Jt2pasx2+mcQ/lFTjN4
TLSH
T17965AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 408676983a7fd62b13d4c479e4d3b1986e253ab8d33fa3528aa554dd5ac66b8e
MD5 8139c3d6212da9a2cba4bde6b8c517ce
SHA1 566fba92c700b92d242aa267bfb2aec726bfbe1b
SHA512 74648ac56866b6d8ea4f45c5e367dcdc4a7067403c4524ca613754bb90836d7efd8750c6b2ce72f42c631a0e8636bca054b91be0c94113684d18310925d0a325
SSDEEP 24576:hNcwHdjbyQ4nLC18lb/EOjowL7FkQnQ/tbw/2Mkjy6Fr7g0oC:hNc/zEOVHF7Q/lFTjN4
TLSH
T112858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 28a37972aa9329bf7bbd03ec1ae02adf075a7e72bc5ffd423bf2dc235222c7a7
MD5 0e2869c2ba898ca8228a70804ca905f9
SHA1 11dcb4c9e8c5e24f84d6e984edbdcbb3f3a407d7
SHA512 6f488e03af4fbb9a3c7d4ef92df7edcd7b427c9db77dce7269a4a7431862ffbc2e0038c0ffddcab74ae179141e35c7bc7e84833348578b3396702a23b722c91e
SSDEEP 24576:L8kNvNnaFeYhJNtmZBmYnQ/tbw/2Mkjy6Fr7g0oG:L8MwBtOmYQ/lFTjN4
TLSH
T1E455AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 5f8175c8ad573ef4963a2805e5657d9c6a38c01a5ed17aecedb6aa0079583692
MD5 5cff6841d2e734117071c6acfc9e8d2e
SHA1 723c31c026cb827001a1efde0466c40e3445a5f1
SHA512 bab88abaa033a8c2da8051c6778d778a0ec9dd4ec9a470a4cdba4fc6bc20f398864ae3890b99a5470ea7db43b2715225acb2cc49c445cf2949199e1b54b9d4eb
SSDEEP 12288:oHvUrBFrEjwaQEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:oPUr+NQknQ/tbw/2Mkjy6Fr7g0oB
TLSH
T15765E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 8391fda3699c82ba2cb1da0aa5014ed6a1573b28bfce1af7696d26ee840cb5ba
MD5 c32c79b3a0d817d592505c3c5e67e92b
SHA1 e36b4b004babbff07265462168cbc1fb46b5ec89
SHA512 536ba07f0a3c59415f9d3818d7346aafadf492472f24ca5ffb92068287fab40e0c407a3e0c64fdffb90aa8d08e63c9114901afa5606d0b9f0db8067d1a0889c5
SSDEEP 24576:5D3FHshBIYQgA5nQ/tbw/2Mkjy6Fr7g0oX:5DVHeBIAA5Q/lFTjN4
TLSH
T10075E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1288-49-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/1288-51-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1288-39-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/1288-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1288-47-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/1456-83-0x00000000009D0000-0x0000000000A36000-memory.dmp

Download

memory/1456-82-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1456-88-0x00000000009D0000-0x0000000000A36000-memory.dmp

Download

memory/1456-313-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1740-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1740-332-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1740-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1740-93-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1740-99-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1740-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2500-317-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2500-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2500-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2500-106-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2500-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2500-112-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3824-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3824-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3824-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3824-154-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4208-14-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/4208-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4208-21-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/4208-20-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/4208-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4284-7-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/4284-6-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/4284-1-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/4284-0-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/4284-58-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/4516-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4516-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4516-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4516-130-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4516-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5036-66-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5036-59-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5036-65-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5036-298-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5240-140-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5240-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5240-138-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5240-132-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5240-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5440-72-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/5440-70-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5440-78-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/5440-312-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5788-125-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5788-119-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5788-117-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5788-316-0x0000000140000000-0x00000001401E9000-memory.dmp

Download