b3385ad58a640f19f12d2d9dfd101464eb054bb7701ac7807b9eca495468365e

Analysis

max time kernel
149s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 21:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_f1e02722783911d2a5834d1b3dacc3d1_elex_redline-stealer_rhadamanthys_stop.exe
Size 2.1MB
Sample261001-1ll2bszcqa
SHA256 b3385ad58a640f19f12d2d9dfd101464eb054bb7701ac7807b9eca495468365e
MD5 f1e02722783911d2a5834d1b3dacc3d1
SHA1 3b245f2c8644cd970bf3bc71d5710122b7aee3c0
SHA512 995cef5ce9cec79b7385a61668b6da8fea38f62f5520caeae717c0c3b496f99a9ccbc0facc66ef84a86b62b8eee7b23eba5cfc458b12f37495cbf1e66fa4f745
SSDEEP 24576:NI/GRDvhX/MKuWDsRddh/M/H9cgEX/QcuFK9vdqrifgGPpoo:NI/kDvh8MsT/MMXoKvkri4GPao
TLSH
T1A3A533127E42D073E02A73FA4EADC778521B5563023D9603F2498FB54F367D2E72A5A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
568	elevation_service.exe
3136	elevation_service.exe
2796	maintenanceservice.exe
5748	OSE.EXE
5460	PerceptionSimulationService.exe
4476	perfhost.exe
5868	ReFsDedupSvc.exe
2496	SensorDataService.exe
6088	ssh-agent.exe
2964	AgentService.exe
2300	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-01_f1e02722783911d2a5834d1b3dacc3d1_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\18fb356de4fea11e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-01_f1e02722783911d2a5834d1b3dacc3d1_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-01_f1e02722783911d2a5834d1b3dacc3d1_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-01_f1e02722783911d2a5834d1b3dacc3d1_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-01_f1e02722783911d2a5834d1b3dacc3d1_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-01_f1e02722783911d2a5834d1b3dacc3d1_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4884-6-0x0000000000400000-0x0000000000B81000-memory.dmp	upx
behavioral2/memory/4884-52-0x0000000000400000-0x0000000000B81000-memory.dmp	upx
behavioral2/files/0x0001000000009329-68.dat	upx
behavioral2/memory/4884-72-0x0000000000400000-0x0000000000B81000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-10-01_f1e02722783911d2a5834d1b3dacc3d1_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-01_f1e02722783911d2a5834d1b3dacc3d1_elex_redline-stealer_rhadamanthys_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6076	4884	WerFault.exe	89

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_f1e02722783911d2a5834d1b3dacc3d1_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000050260f13ee51dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f81e911ee51dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb968d12ee51dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000086212514ee51dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000072ac955ee51dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000697fa112ee51dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000579e3215ee51dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
568	elevation_service.exe
568	elevation_service.exe
568	elevation_service.exe
568	elevation_service.exe
568	elevation_service.exe
568	elevation_service.exe
568	elevation_service.exe
3136	elevation_service.exe
3136	elevation_service.exe
3136	elevation_service.exe
3136	elevation_service.exe
3136	elevation_service.exe
3136	elevation_service.exe
3136	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4884	2026-10-01_f1e02722783911d2a5834d1b3dacc3d1_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	568	elevation_service.exe
Token: SeBackupPrivilege	5868	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5868	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5868	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5868	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5868	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5868	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5868	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5868	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5868	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5868	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2964	AgentService.exe
Token: 33	2300	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2300	SearchIndexer.exe
Token: SeDebugPrivilege	568	elevation_service.exe
Token: SeDebugPrivilege	3136	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 4360	2300	SearchIndexer.exe	104
PID 2300 wrote to memory of 5804	2300	SearchIndexer.exe	105
PID 2300 wrote to memory of 3260	2300	SearchIndexer.exe	106
PID 2300 wrote to memory of 5096	2300	SearchIndexer.exe	107
PID 2300 wrote to memory of 3832	2300	SearchIndexer.exe	111
PID 2300 wrote to memory of 628	2300	SearchIndexer.exe	112
PID 2300 wrote to memory of 3792	2300	SearchIndexer.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-10-01_f1e02722783911d2a5834d1b3dacc3d1_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_f1e02722783911d2a5834d1b3dacc3d1_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 700
  2⤵
  - Program crash
  PID:6076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 244 -p 4884 -ip 4884
1⤵
PID:5984

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:568

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3136

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2796

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5748

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5460

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4476

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5868

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2496

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6088

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2964

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4360
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5804
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3260
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5096
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3832
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:628
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 df64198929f65d3327de011871b5c2146c234414fe6bde23209518366f731695
MD5 eac2ad3c9d732e47763d7ceef727ba06
SHA1 c1bc6b80b32aa8f3aecd0fe8fe4f775f13ef2f15
SHA512 15a4cd666aa61a773667633b07c259c82dfcaec32563572578a3bcd207cbe9516aab95513c0cb109077babbd427f331f04370604a029435f2f2b3945d162e11f
SSDEEP 49152:lb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnZ/kDvh8MsT:73q6sjB2QaT
TLSH
T1A2D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 921dd70145e09c8efc5b14679b9a27c0b59c3eb0556b8edae15239e25b5d9b7c
MD5 fc67744034b494f7810d5c5ae5d018d0
SHA1 5d878e5a1a588443e6d14dafbb4d5a88210ba806
SHA512 3c4bc69d52483d84e7f0d4ea0bb673827bd573e1004e136573f098b0177c671fee616f4b469071a1517e4026a9783d7c55d0a524572b740b88d40badb4dbdb3b
SSDEEP 12288:51XLsswWkxy2lRq2czAi/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOkqYJw:XXYfDtczAi/GRDvhX/MKuWDsRddhy
TLSH
T17B75F129B7D008F9ED67927CCDA28512DA327C554760E78B03E48A650F337D8AE3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 4b3fff83752649a415c6f8d19973da8181bd715e1c6d94e34165d916c34d726e
MD5 b6a2e741489755b83de9ffdd40d7dd87
SHA1 cc6c80e7268712ef4a0a6f4f19fcae8457711982
SHA512 86240e634cd33180cd19860b006c17d0b700f1c5bd7db6510eba9a0374e825581b6b44a563b87608d84b83ccc73fdf18db04b83a0024faf05d8e8aad93659265
SSDEEP 24576:+0Le5ji0hmxxrM0u/GRDvhX/MKuWDsRddhV:+Pji0Aj1u/kDvh8MsT
TLSH
T14C959E26F6748331D073C1B9C5D2A68AED71308657308ACB4286D77C6E67BE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a4334f2fdebf9bb62567294119e5cb90d182b76fce34d0eb7554c6fe347f4bf2
MD5 0903b137200854195ffadfee769c778b
SHA1 041519bbc63b52e5f628a5d6748171aa33a1e168
SHA512 cea9fd7aea597f65b53e084325ea5513e36c4fd4cc0f774074c6cb8d6e8b2c7b991e0fb7e45099a953732a4b6a04d58362be0946981ef1fc4da48b9240e4b191
SSDEEP 24576:9a7/ezSC6vUyD/aqgrvWn6q8wyuqu/GRDvhX/MKuWDsRddhB:0/ezSC6vUzPveHjyBu/kDvh8MsT
TLSH
T1C8755D25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b48700e07a3f34dea473d90a697e040f3671e11d9bbd220570364f36dda183ce
MD5 1b8e7d68c00c0eacfde4b788888b53e2
SHA1 c0119781efcd4adc5153f7577b3f1b0f549f1278
SHA512 6e3f52637be41e6837d28cb390611e8d53e0395624c4c49afacdd2a53bd40d5df645d64b99fc66bea9a3ecfe947a071f3273252d2a6a2e092a971b84655a0125
SSDEEP 24576:RVbqPb88hv/l+Y3u/GRDvhX/MKuWDsRddhX:RVO88hXl+Cu/kDvh8MsT
TLSH
T16255AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C2E67BD6D736731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 c905fec34552fc481502a9a8b08f5ddb93bc8bfec4376b7b4379c862ffa2dcbf
MD5 50e983eec9e2dfd7164d963aed8a7829
SHA1 fac98a40b63bba9be507e19f24f01d4384d41c70
SHA512 62a1dee768989765c2fa930862a206ba96280180f424351725240044b1877e08cdcc7e5f34f04cf0a703c8e9c9eea979060452e30fd36fbea7c1735054a5ae7e
SSDEEP 12288:0Lou/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOkqYJ:0Lou/GRDvhX/MKuWDsRddh
TLSH
T14555232BFF4150D2F36A7F744BE24F168A285E125628861BD540AFE40D36FD5FB228B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 eb10a071c7558e41eee6235522d2c727ebdc9242db38ccc15d64fd67884c4485
MD5 e3472e105f90ab274a9f0054e259c8be
SHA1 07d154d8474b341596410a06f1149ce965efb075
SHA512 e7c3dcc84178c323d41f16c571eab74898eb50c8fc499aad13ac01c187aaf36fd8ac3ff44caa388e4a1fd828f1241ba159a95b651b35553bbe2ec5a34edd9869
SSDEEP 12288:heBNUbTVO86Ufu/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOkqYJ8:hJIUfu/GRDvhX/MKuWDsRddhy
TLSH
T13575CF3BEE28FCD2C27A9DB85B918700D77278314B6193CBD165834E8E235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 381ba1d31b5f3f947592d2332ff9e290b3b4ade081372e02b70d530811697f5f
MD5 86253811984502a12d06c774a4372191
SHA1 3056bd5d880befe78d895466b79ffe9ae349954e
SHA512 bbcc455843dfdeca903815341d2328dfc445215bc5cbc0f0b672b828da019208646d10fa9091690abe6769ee12fb1204299184f4179c1a1acd44580bebf4f691
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH8:+QvGAdlCEL8c/DRNw5CvQaT
TLSH
T1F9267C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 fa8ed96df60cfcbc8e257d7f8e266620ddbbc4a9e50c5a0ca94726eb1e4b01c1
MD5 2504eaeb9f3fe84e7ec86366ab3b986a
SHA1 3f6a9b87935c00e973d53dff05e1efb4ba328a3a
SHA512 0c9b6459407a45bca96e0b5c7c670bff2ef01bc0e7267a7efcce53751f628140fc373742e5c350268ab7329affdd6059845e365b139cb65ff4ab27665e56c4ee
SSDEEP 12288:cAwSfxL/2Dc3RDLLmt0LDQewsAjlu/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOs:B0ewsAjlu/GRDvhX/MKuWDsRddh
TLSH
T19975E031FE75E036C37B0EB61B76C716542C7A204B611AC3E3A88E9D49306D26776E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8c63a0d298e4f5935b714a27fc3b96578caf99d544e5777d14e974f2c44b4491
MD5 c75e6544a84a6a5464c17ef3bf650e13
SHA1 986a459535b241b46a7964617c23a6a37c7d3c41
SHA512 30be888567cb5bd9885b7c32e69e2e232a51a26a9c7197b1a3e63427c2bca8ad7b367b0cc57719a77f4d73d81ad074a489dfe881a58baa70b1d098b251b090d2
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHjaT:/UEtQevvqc2W1cpV2tI32jaT
TLSH
T17F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0f82c5a36de122064b0468a561f569ae5bfe61d16115b3f4b42043a8700a579c
MD5 8c472d9500e4a0349b06dc2f6a2bdf77
SHA1 f62114b32e0cf8a76e6031e7ffa15e8c335fe62f
SHA512 c68bf9c13b3dc0b03d9ee0dbcc53344f0ea68adadda6a3a252c8a9eb32fbdd544dd02d72fbc846c2810d2ab1c45b7edf4940684b3051cf3d516690f4cf55c5db
SSDEEP 49152:tCbRquA/m2yL5zQfFiV+XenmE3/zFu/kDvh8MsT:KoqtVjnmDQaT
TLSH
T103D58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2aa798efc6770f58f0ee14034bd4266abad02623864d66b0bf9c1dfafa8a4b4c
MD5 76ced6946362b1c877528ab73c479f1b
SHA1 19c197c97d87d2135ae93eaab169b3e5f4debf0c
SHA512 c98774e56e7c58860ae83a027d5a67c1bba2cbac271f826dd0655f02f57718d7ab041b3727c60f94437f69ead23bc4234ce6fd378234e3904f42c3b4973483e9
SSDEEP 24576:TAhGL3IFoiwtA5l7S53Gu/GRDvhX/MKuWDsRddhR:TAMUFoiq5Wu/kDvh8MsT
TLSH
T1F3359D81EBF955D4F5B3ABB899B68571EA76BCA65E30C20F2150C11F0E33E509D24B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 2.0MB
SHA256 e94d38e8c50eeeeb6c21766cfd181a9edbfe26ff889b3723d7ed1fdbef110142
MD5 d86c14a001bd4c180bfa40f9d421cf1d
SHA1 67e70f3f8f6d1be61b09fee2708e6db8a4e1b9fe
SHA512 c451669e34c4e519f7c24d57578733a6314fc811661292392fcc062fe043aeb05b70d8b3f0863aa62ba03617f6e757f62908013c8fb8710c472415bd17b5a3fb
SSDEEP 24576:dwukOWk/GRDvhX/MKuWDsRddh3lu/GRDvhX/MKuWDsRddha:dwLOr/kDvh8MsT1u/kDvh8MsT
TLSH
T114A5124A779508F9E66797388693C636E7B27C022634C71F5350C6AA4F33761FE29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 6f991419085c646a49ae59ba499c941cf2a2195b68772b6dcd27b9bd731878ef
MD5 82b351d46e6a807b6c265eae7c0354dd
SHA1 9e34695c31b3380088d98141a75c4b1ba6a623f5
SHA512 492704084a0f4c08c6731ae51549196ac4e16e509fe956fdda2d3da833f69cafef4961910d6f470f1f3e5ce73dc2fc0af3873a5d75ebf2c71bddabf930dc7995
SSDEEP 12288:NeZ1IyVu/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOkqYJO:oZu8u/GRDvhX/MKuWDsRddhs
TLSH
T1FC65125B37D420F6E2A7A778CAE14A06C7717862233583CF565446A90F33ED1AE3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 941464080f606e7b992afb9e59af01ff85a1eaadee30c4a1f976aead7ed0db55
MD5 7078381a1815093c781fb447bc626bee
SHA1 e9243f2f1f6897405cf45e9c9acdae398904b5f9
SHA512 4acde9c913ebed2e2060e458feecaff2906a287be189bf859f83202a7943abdafa3dc4a2c5e8d76d0765db96318abca769fb6f93340fefeab99aaf89597dfed7
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UY:5QRQyi36YOcPbLvw2gAf+PN36QaT
TLSH
T18D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e5980bcfa4eb20d711d4478ee15ca0f9014965d81617379f280c73abd9801b16
MD5 205266e1eecbfb12c408aef19836d321
SHA1 20d9d4245207e05d668a3bb8c3fc5f5cc7f4ae92
SHA512 5d16c35b2a65f07df2db86c77f01e653125e4a947950cd7e4c6d74664715d030c78535b90e1b5775a5d0f2f99b97775fd6b8d8d530ab101d065c2da84babbce3
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UY:TQRQyi36YOcPbLvw2gAf+PN36QaT
TLSH
T181667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 38503a94bf09d90683b931b3b935e8427590cb80cea618e0036393a8d6bc6437
MD5 3bc8e5609f92b1ffbe07d8f34a504f78
SHA1 743fb9c1a2edd6b7d9871348acd1ff109dcfeb44
SHA512 26ba2cd695f2e2ced6d34636d1b7ff8c79f8928af9c3f7b3487b67ccea184905858e0fe34ab7a3b5e8228da59a4af595ddb5a683c088de514940f00b131cd33d
SSDEEP 24576:/wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0Mu/GRDvhX/MKuWG:n68Qg55nhceWu7PNU3/1u/kDvh8MsT
TLSH
T16CB54933B2F200A9D44DE1769F4A872196D17C758FE0E3DB8501725A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ddcd8109f0d05b41a0807915143879647dbbea774bb4e7bcb167040f8f6af961
MD5 80da9bb8ba96957523d19748631aa9de
SHA1 3dfded0c8c86bb6dcc466c54e5f04ba52fa36805
SHA512 f928ff7635e11ae40493526a6cd2968ab891d96dfdfe2ff9e673bd5a297ac77bc72bac6f3c100c6ee491d4b3c3bc6bc8b636489e186085a89113303e2c225e0a
SSDEEP 49152:p3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99W:4y5112gYy5azzVvt69nLKnhZNQaT
TLSH
T14E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4952c0443f1b30fc3808ee1194d70c274b7f98ad219d360414774f3a330484fc
MD5 09773cef9a7cef074db40a6ef1b71a10
SHA1 a31aaeaee845d57a21f2ea21ec855c2e8f0cb041
SHA512 603a4a9ba223774043188967e6307172f0dd8195a96f52d724ed8c697d6faccd93010148cf42261cc2ef4915e995e0883c2fef56522b37a71f47a810b8d84e1c
SSDEEP 49152:oB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glS/kDvh8MsT:iu6Jmdxd2dSQaT
TLSH
T1F4D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073552E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 44152d05f1045bef7de9fd51e3bd6ae39c58c8fecc6f37422f97849f5477b93c
MD5 b982fe3b8f76833febbd1609335aa7d1
SHA1 39f7eff7478320d924def406f5f316bb3547e6b1
SHA512 39f03cd6fc45f1e407040bb7ddbccdcf3430f85a7fbccfdce9f80ef761604fb672a04eefcc912a97f5d91561028afacd70e750121913ee6dcfab52ebf10f1965
SSDEEP 49152:E1hpsNoJpF1A63U44CwH7R4x/u/kDvh8MsT:EmifPWRDQaT
TLSH
T1C2B5AE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 83a2b58ad49244dbe34c08c04e58003006516550abd5a7921e096506c2712e3e
MD5 b46fc21a7362741f70038e78064074a5
SHA1 d505579052c07bf8104e5b40340ab37f9e5cf6b5
SHA512 c5c1d6fe2407efd697e15b5bb4b8407ebb797f2d288237831518bb3064eda6b8913a475ae253ef3097a5e8a371aac09600e9d94598269cbb1a0258156987872e
SSDEEP 49152:ASuZQIY0Be2KcRVtOnks6NMHq8u/kDvh8MsT:a5dKii61ZQaT
TLSH
T1D7C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1ddc0340bb56ec31bb468163da1773e9ef25e320b6ff7d81e6c2e5b441a523ca
MD5 7564da99cb0faaab5381d255f81f5b39
SHA1 1f00ccbecfe7c442baca5fab921d6491b57053ed
SHA512 e16c31e0571a61c89073d503f9c8a18bca917a6e07f01018213bb36be293f1bff606c712082464944d789e37c54f8a704bd7de2fa0a2b34071b4a7954f2b5f55
SSDEEP 49152:9htSn8EApI0fig3giDn0AP5wju/kDvh8MsT:sX2imphXQaT
TLSH
T14595BE13F2D900E8D05ED178C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 d9dcc118c95ae69e1907f825b6ad018556de46d9755dec300dacdb7666f43a74
MD5 125154067edf6317070565e6949fdf33
SHA1 f2d41aec7326d2622826e75fd5ba0aba9687ffb2
SHA512 82dae6c7ba65958d3644576824f6a9732b57a805dafab7d98e560d4c1ff4aca031fe3f0629094f0a13d678d04964a28f5ceac9b5d18dd3905a9a6d05535dc102
SSDEEP 12288:Uwu/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOkqYJ3:Uwu/GRDvhX/MKuWDsRddhN
TLSH
T19B55232FFE8250D2F356BFB48BE14B15C91C1E576628411BE6488AE44E32FD5FB168B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 a0e4ab99bac84da77c19368b4ee8d80c32918d1b676a6b670571c507eb6ee26d
MD5 a9acd11e95aad51fa804bc0faa9fe01c
SHA1 ece015aad77410b7de41ea20387de6656601a5c0
SHA512 8581944501a5ca56a54bbb3f6970b91b758e2393e9f7342482690eed4cbda3a5af33ae10ae528985a63d1b6f9103752e3a151e836fba4a5376c869e5470ac73f
SSDEEP 12288:aZu/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOkqYJJ:aZu/GRDvhX/MKuWDsRddhn
TLSH
T15E55232FFE8250D2F355BFB48BE14B15C9181E176638425BE6488AE44E32FD5FB168B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 29dfa6dac2fbe1ce7a4c4052f80662f9310cc2ccfc67eb6559c37c3a8f8083d0
MD5 c2561d272c93f2c1fa149f59acda2a22
SHA1 cc08b11c89c2f4ecd85eaa86014c9094db4f6224
SHA512 607b2f1a938c48070f78912f786bf8301f74d7f4537002cf78836ee3659029817685cd81b88c876cf689fcaf719f6851629bd8b236cad534231f20f0ba01d12d
SSDEEP 12288:YHu/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOkqYJR:YHu/GRDvhX/MKuWDsRddhv
TLSH
T10255232FFE8250D2F355BFB48BE24B15C9281E176628415BE6488AE44E32FD5FB158F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 93f735426b4d212d6092c64b66a4a456da4a2c618554593b9cf7d1bb779aaa28
MD5 b1d60a1ee1f68d0bab7fd977cce50a1e
SHA1 658780d3f9b1baadf3b792c4dae5a8386159d3eb
SHA512 b3283505fb48da1445b7f688b5fbe4b47bc4bca920ed03d6b6f9de0b5bb688ee05342dc8e5f331c254b6f9dcf84dd737347c1baffc738930ff1b2b14afb789d0
SSDEEP 12288:zVmu/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOkqYJY:ku/GRDvhX/MKuWDsRddh+
TLSH
T19E55231BBB9240D2F266FB74CAA24A15C6787D566734835FD6404AE40E32BD4FE31EB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 0681fb4eae977d2071b81c6a6ca8070b2992853b2e3231f14b8a7351b2e81f12
MD5 92cf7ec356fdc10ce761da55db0fff54
SHA1 d738a9bf344df77a4c09f7ce5ca2cf70a3e9e1f2
SHA512 73dfe574d583fe519ba9e4411ee13de33d54135f91aefa9753b657ef82488c7ea8b561d40d6e5dce7455ea1d7e9bbd3af3d1b9565d2f49f6d6c9e814cfd99dd4
SSDEEP 12288:h+u/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOkqYJS:h+u/GRDvhX/MKuWDsRddh0
TLSH
T1CF55231FFE8250D2F355BFB48BE24B15C9281E176628415BE6484AE44E32FD5FB158F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 388fda016266593730554a6c8412cc3c99696a5e9dab15b76ca5aad01ec10945
MD5 ad42ab691410ec485a216b1bbc99f662
SHA1 0c17b2230304f3f2d7ee514cf73f7cb9af620a42
SHA512 5d68a81f00e31e138b3f48bb1756f8b32b698296fd2ff702ae188ca798946ae06760ef5fb7689e049d8d55ae09f1c5eb255c2e2d077a5f33b8cd0bb2eeedf26b
SSDEEP 12288:itu/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOkqYJX:itu/GRDvhX/MKuWDsRddhV
TLSH
T1E955232FFE8250D2F355BFB48BE14B15C9181E176638425BE6488AE44E32FD5FB158B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 856b25610e9acfd14a955558bb0ad4395682492cc37663193bcc96bbba7355f2
MD5 c4b889b9634294caa96432bad1afdc3a
SHA1 3547b82d0e200b99c854a547c9e5995fe0f0aabd
SHA512 eb0963d1a204973d89c1a0e14a0c405b61f12370035a89f1df3fe73f423df05dfb1bf3e48eb6066d903f5c78a74ed1d7a6e357d9798aae1b8e7c8073cb171b4f
SSDEEP 12288:Qxu/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOkqYJ2:Qxu/GRDvhX/MKuWDsRddhs
TLSH
T12955232FFE8250D2F355BFB48BA14B15CA181F576638421BE6488AE44E32FD5FB158B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 f7781ecc91a824edc4c7930b858f940a6477efa6b28b1fba361c454fe67388c8
MD5 bf5fb1dad3d0d8953c3a4da8d75c3722
SHA1 f165bc398d867343ff4094bb1b1ea83744641c3d
SHA512 bd24473e0157650c5e02a3c0487b621ec6d3723b628e583d2137c28555959cdbd7845adaa048f5be6a4561c7f17bb30265d971bfbe560eee661b3af36399fba2
SSDEEP 12288:niZwbVzzFEoS2cPvy5u/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOkqYJO:iZMRzFVSO5u/GRDvhX/MKuWDsRddhk
TLSH
T16E7501A9B39018F4ED67863ECD618906D6B27C1A0B70C61F03A436664F337A15D3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 97c605c071c09a092cad78d312cf6dabb7c90f90c151518361e02722451d60f9
MD5 16809b45bdb6b8bdf2e2cbfda8ca681a
SHA1 e009b875e75107edab4060bcb5f277d348cad978
SHA512 29182d5fdcfb9e7b730039df0ef7a7da96f9eafb26bc713863b6ec98d90ed79a459e765e24a8eb36321d00bff82331ab22ea9ec907f28ea9f59bc4cbe3676160
SSDEEP 12288:wsu/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOkqYJg:wsu/GRDvhX/MKuWDsRddhS
TLSH
T1B755232FFE8250D2F3557FB48BE14B15C92C1E176628425BE6488AE44E32FD5FB168B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 e4e53d2059e7beab8afbaa6e5e58411c8936bc364a237564687190e4775966c3
MD5 7cede12f0757b9d409f86299b4bfad1d
SHA1 ef85b38e85de257147e2e48352d49999c144dfb6
SHA512 a10c140eb27a75a864e75a47d60c51fb5e7dcfc13bad9136f253b570a546f347cf9c60c08a55032d62b4488bfc29211118c891f181f873b0d71caa40cd9b325b
SSDEEP 12288:tYu/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOkqYJ8:tYu/GRDvhX/MKuWDsRddhG
TLSH
T18855232FBE8250D2F355BFB48BE14B15C92C1F176628425BE6488AE44E32FD5FB158B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 5495580343a08ab7a98a1b5b390aea5422633ccba2123307474a77b36905e2ae
MD5 ef0ded49a47800b7a95402ab455b85fa
SHA1 c667970670c17046faff4d897c89c2a82965ed03
SHA512 bd62afaa70df3a4ca128259910bf0f20623e716cf5dc23413302edb0c637c25b0d4935521d5a5c0b192b48f9ad8aeffaa5e6e1ebe1e109adb17d9c5bd72707bd
SSDEEP 12288:UyPz5L8Vu/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOkqYJV:NzyVu/GRDvhX/MKuWDsRddh3
TLSH
T1B265021B779130F9E2669338C9A20A02E775783617348AAF575447B51F337D0AE3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 79b5d1823cb7635d53abc55bbbe8160af5e04a9c05e920f61015bcf6fca89612
MD5 89c864613abb25d07251e364a234bed2
SHA1 9c7e2fb711a04a20df2e95517c71d8b8fd6d08ee
SHA512 19de3db4e1de079fe57bc5ca572ff7fa8ee564acfd8dab75a14b733d14212301f5d26172d6c50117cd490333d3a9b9765a4f264ecc2e96e9d230d8dea47ed692
SSDEEP 12288:dsu/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOkqYJH:dsu/GRDvhX/MKuWDsRddh5
TLSH
T1FA55232FFE8250D2F3557FB48BE14B15C92C1E176628425BE6488AE44E32FD5FB168B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 016dfa7a731d30cd75d256e298331717ee50c3a399cc56a613ed39da610a8414
MD5 cde53c2cca2fd7f53b73510eed8d63ac
SHA1 6ca842b5df60582c417dca93566b8d90653407c8
SHA512 6d4e47ab00777b5a818bc63045ef0b7a57c156cdd267027a055cde2157b55be6c19ee13872d05ff6fbd2d9bcf9de3643ac6822382100eda1780f2b984f41734c
SSDEEP 12288:Wsu/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOkqYJz:Wsu/GRDvhX/MKuWDsRddhB
TLSH
T12B55232FFE8250D2F3557FB48BE14B15C92C1E176628425BE6488AE44E32FD5FB168B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 78b8185758831f03496876473affaa26a10edb236b54dc88a7ae472de2789761
MD5 d9d0eaa2e8cbd5fd4bd6d41bcac1dff6
SHA1 248e11836c96a01a7774036ee1b17e5cfbcf5f4c
SHA512 c92cbbfa5a91fdf524b192becbbbbfa735d8142096c643f7634c9f0c36bac0f83d242e8dc3454c648d8dc71bb2bba390b2356fdab1c51789cb3bce007f6b558e
SSDEEP 12288:ByPz5L8Vu/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOkqYJP:QzyVu/GRDvhX/MKuWDsRddhd
TLSH
T11565021B779130F9E2669338C9A20A02E775783617348AAF579447B51F337D0AE3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 252030aecfa24b22f9ba17478c001ebca7a0db0969a5c7100bf8fce67e529051
MD5 48317095f8b9efc0439b06f82aa6a6f7
SHA1 a50d017508f9567778a7819692dde6317f2baaa1
SHA512 1badafdb1b49cad338d5bc5bb6743ba48ed51e5514a4c0b26b349e4d2aee34bcced2a7d56783eedb8dd0ca7ff9a41a2414b38c80991bb7fa83bd84dcfced2cc6
SSDEEP 24576:7TDaLl3z0zDXu/GRDvhX/MKuWDsRddhW:7TuLljqu/kDvh8MsT
TLSH
T1DE7502A9B39018F8ED67963ECD618906C6B27C1A0770C61F03A436664F337A15D3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 51d8164f79506f6de36fcbdafb2cded35c662b61247e06ce242879688be59893
MD5 c722871b1c7f55bb5c1c4ce37357c8e3
SHA1 943d2e0622752160adb571841c7d081a396a3e4b
SHA512 4ca18b63c55edc97b5b9bd5ca2ce7c95d5cf98e3e4d1a238cef270bfda83661f7a5b7dc31513eb358c846f2a9d7151578bd2c1c08d2cad9a3bed3b8c156dc29a
SSDEEP 24576:M3vd9CHKy7GZru/GRDvhX/MKuWDsRddhQ:2vd9CHKyadu/kDvh8MsT
TLSH
T14985CF91F3E410E4F1B79A358D724512CA767C5A1B31CA8F03A8665A1F33BD19E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 94708684654f701f1639dc2eabb1118947dcf9c816a0c8875aec1d565239429f
MD5 70a8ab9ae2da310eac35a268c587abee
SHA1 947000ed1a749dd816c978ec8ee57adb1dd453e3
SHA512 ac84e8a1b6187c7d59850305ba15775c3e8851da530172795bc5cefcca50759344583e7c22528acc6478f1fea372e13ea14b139af187fec07c0c4d6409757a47
SSDEEP 12288:Tnu/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOkqYJw:Tnu/GRDvhX/MKuWDsRddh+
TLSH
T19655232FFE8250D2F3557FB48BA14B15C9281E176628415BE6488AE44E32FD5FB168F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 f219124494e1126cb3fdc0e2bb3a1c4928301164bcbadcd1709f0c3ef8fcab0d
MD5 d4e3bc8a22761e188a7063e0ea44d09f
SHA1 5957c8d91f2ba6f33ee6ea27aa1433a03a5185c9
SHA512 16f3a3d288327ff1ff524b7d0fae916f8a0ae15d4fd20e38d653c025433f37354d2b92ec760186406fab4a3ef3642f0e2435c32f6ec146fe97eca1e4000d71df
SSDEEP 12288:I1u/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOkqYJL:I1u/GRDvhX/MKuWDsRddh9
TLSH
T12C55232FBE8250D2F359BFB44BE24B15CA181F176638421BE6444AE44E36FD5FB158B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 478c1ea442e43ec904657647672412515b2ae766ce7a3cc1f9413a11f6827d69
MD5 33cb11e1acc25845ad97a7e2fd55d9e0
SHA1 b8ca04d7fe090f587103d8cf7032e83aa35e83bb
SHA512 a7e5100b65ce5878383740e8cd22d178cc5f1c6dc040c9c29db3aa32fdf01b6fe44c8ed2571ed77219981bccb196d6cfc6a566111fcb48a7e3a7904511dcf24c
SSDEEP 12288:6iu/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOkqYJn:6iu/GRDvhX/MKuWDsRddhp
TLSH
T12355232FFE8250D2F355BFB48BE14B15C9281E576628421BE6488AE44E32FD5FB158B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 bcdc65dc1f8bda49ef4dcb842b7b0dab00bbeb5a73153c6f9b43f6eb3b05c811
MD5 4dedfa29e669807e6c50e43651f97de1
SHA1 12499f22b605e7b2adc70ca568841a80cbbcc37a
SHA512 f011862237e736184e2fbec1e19e75f581029055c44a97e2de641abde7828e79437f63cab331d96ca2f435290d34b745a84cbdd118d03794e6a8047f22eb064e
SSDEEP 12288:1su/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOkqYJN:1su/GRDvhX/MKuWDsRddh/
TLSH
T1A955232FFE8250D2F3557FB48BE14B15C92C1E176628425BE6488AE44E32FD5FB168B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 ddc2d076f3d54c14ee3dcd28a1095b3ea3d6a31d435aa8ed83c81293b79c1076
MD5 a2a868f82281bb207e7b1e2e70f80ab0
SHA1 5952c7d51df6c44744dde7322113209c7387e76b
SHA512 c76ce73f2ed9bfe4ae7de19ec862ecac9ccaf464115e5d7f7c2020bf025e08308b790653160942d0ad0072f8d488fb63ef98ef09fdee04f94cec3bf90edcb0b2
SSDEEP 12288:Tnu/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOkqYJJ:Tnu/GRDvhX/MKuWDsRddhD
TLSH
T14755232FFE4250D2F355BFB48BA24B15C9281E176638415BE6488AE44E32FD5FB168F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 615dcb1286b4124baca7ae96208c4a9fbc71c6a093e620f5c05fc40d7ca546a5
MD5 40779d615ec1058ea19c76e379e7ed2c
SHA1 7245650e2924c4e092a576a2e664cf6f79940dba
SHA512 979442897fad0b51dd87e2c5e7932bd8231d66a8577161ab5f65a2d2517e2d4e7f497a531c819be75fb4215039f5cca47249bb82e32e55a7594d958caea8ab3d
SSDEEP 12288:8Eu/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOkqYJ4:8Eu/GRDvhX/MKuWDsRddh+
TLSH
T19C55232FFE8240D2F355BFB48BE14B15C91C1E576628425BE6488AE44E32FD5FB168B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 e300742a88f6f75ea1ff6e87f00d69ea23a3e014eafbd1394bacbb2abfc1e065
MD5 2fae20fd4d7525428798422be8d50b4d
SHA1 aa69423c8f6f2bcb77077b581deb497676277eba
SHA512 9053e0a3319ba893fe006e3930bf84a3bf2445beb414725b8c892a7f43d9eb651e2d1630373471d2f3b66e9adacbe4abbdd2e3e675cc02a9956497a15b272842
SSDEEP 24576:afwvUk9RX6wkyAIIu/GRDvhX/MKuWDsRddhw:KMnYIIu/kDvh8MsT
TLSH
T1FE85D029EBD844E5E177923C8DB3460AF6B178591B31C2CF125A53AD0E37ED4AE39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 64c223c2d0ef16b55f1321862796112f2d26b944595f7c654db04480d2c935ca
MD5 ef7661d7ebb9e0e3cbb2f2fbd2f533be
SHA1 40bcd4b62707f764ea3e0d99045ff4684cea4d1d
SHA512 48672f223becf90c7b5d2b0042c8c951b39d24919796da344e1460d85ac100f8ef20341ea9405e601fa42ec58eabf01fc74aeda8a6c468b50b2dccca0ec252ac
SSDEEP 49152:GYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Du/kDvh8MsT:FySzPaQaT
TLSH
T1A0066C56A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6eb85d909f24487cd6ceebb982c5cfba2e2188eeb78b784979918dd844e8ba71
MD5 232a804562d28f7381ef6b0b1cf473fc
SHA1 b0a9f5b7927d41ebb599f0f81c5e9d8882f31237
SHA512 e838fd39149115d0318660e7fd64569ba772eb9e4f06ef6549cdd659d72fd90bf00580d30de65aebb5294d40f8e49e7c554c0fa0102ba6935188c6d78db94be1
SSDEEP 24576:J47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYpu/GRDvhX/MKuWDsRddhw:J47JUQjTirIhCnDHUPfF/zu/kDvh8MsT
TLSH
T1A365AE1EA3EC01E5E1BA927885554A1AEA71742E1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 6d342cfb33ff4c8d9136078854d4360ba0fff3a011d15d66dcb4384c0f6297a9
MD5 135535bd86254b32b763dece25d8ebb5
SHA1 6da14d276f3414d4929ff9cad9bc4320837d3d7e
SHA512 b2d474ddc29e363ef888663fb7349f7f71196f36ceb3d785a30b449cfbd1453cca86935e63c26edfa07223a3e7e842a01b9d58c0983227fcd664d3e28f3ef6a6
SSDEEP 12288:Ubsf8u/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOkqYJF:L8u/GRDvhX/MKuWDsRddhf
TLSH
T1AB65F11AE29401E5D16E6675CB924A01F7373C2693E0D3CB52C0F57D0F36AD0AEEAA53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 ae4523dcd593a2460feb5fd44d64054819a49d588cfbcc61616ce2db44f32030
MD5 b2396c449d01b91c688aa0926cf89291
SHA1 819de74e179587c3d033c7b560d74e268912a6c0
SHA512 aa4e2c5e93d056a31321285319d8224c6b61f773f44924ddc23835f55d0788c8ac2ff7eb1562211c38385751131bb3aa70ebe769aeda7b391ff0e0b08dbe9acd
SSDEEP 12288:5Drjz5U3f1q0m1w6Iei3pZTwgOVZt5tpXT0O/DgLZ1bBjzYJX:5fj1UP1q0bTTeh/Z0mDsZ1bBjz
TLSH
T19E4527007626DB8FC66940325E36D6CCA770BD41FE49AF0772C9873F8476659BAF1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 989KB
SHA256 54ace2b259460fee88ad469788b8d878644627f554a01002eddef5e0ccf1f366
MD5 a3b85c268c063137dd5a397163148234
SHA1 8b10148b924beeb3181f4324fe404410e3969b87
SHA512 adff5d6941ad165099a592684c6d32667b10cb7a3bacbfdc014921b7aa7a246c6111e23142e3e9b66e35525a54c31bcfe03798375d5ec8966a2b80ec848f868d
SSDEEP 12288:hYghJ4iwyyAXcGG7iwm97eDa+1XbdkZofMJLF/2Wj9pR:BgicAM7LMau0m2GR
TLSH
T12725E90095B7EB4FC97E5037033286CDABA49C06B7893F057345893D9867A6EB5E22D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 9621cb738749a62b4f8943baed2c0b0dbad4188605171530e0daa38eaaa98c0d
MD5 160ec3c07d71d4be4b0122a39a3daad3
SHA1 fe132659d84d06c481f451fe1dcb3cd46fff0e21
SHA512 b87348c183e4afcd837bd26f10bb224a231e32cfec198e356dd481294ca74886772372639b03612aa588c63920b1741693c831c24da983dd89e6a3f877b2166e
SSDEEP 3:OlH/lwbB+dR2/ZObuBl3y9Gxtg3mCllltGlslslslslslsl63pggllX:KibB+d8ZOb2QK0mCtEEEEEEEmpl
TLSH
T1818192813B500A10CE2EA935202747946317DA8826A083B7060AA2A99CE21984D96BA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 eaa4c38b3853bb646aa8637661349e534f78e337b30b6092ea19a7ec0c263e8e
MD5 8456b2f2d364eda1b61f62e30cecf481
SHA1 1e636d59c210a82fc86178f0bcc1743a4f739d4a
SHA512 7b81250f5be657f32c3c525eb5165df7707fb28ad86aa01cab1c935f09ef59c3211ee35add13e1f5ef55f18d9e8f9b5b69daf1f8d4806754760abd770830fd67
SSDEEP 12288:2M7Uu/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOkqYJ:zUu/GRDvhX/MKuWDsRddh
TLSH
T1F355232BFB855482F37A7FB44AA28B25861C7F265B2481DBE5444BE40D32FD0EF31961
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 fe85aec4741d8c90d7166d07b252b1d6e4b77490481c209f922286b448a7f959
MD5 e42ed7deb8d94cc0cb76ad56eada66b8
SHA1 88c557bdbab7ca675590d158fe572df9ce61fa0e
SHA512 9bf48019b96140db432a042d06857698dc7babd978eb6eae3f8bf78da2c75017a1c3bdfbbb7b817706723fcd000d6b72a43b7931ae711715452f5a319fced6df
SSDEEP 24576:rgb6bmBIi49WNNFpg1rSvFv7bYqu/GRDvhX/MKuWDsRddh3:rgb4mBIBhGFpu/kDvh8MsT
TLSH
T1F065AE1E22E802F5E1FAE2B8CDA64417D6B278160731D2DF1251427D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 2c778ae8cd460e889c9a235ca3c761c36095a2e7ed90ddbbfbc44a4f3212ce30
MD5 06aa703b634a4b4afed8b028ca409b01
SHA1 e24694c4e0db31b24d27e03ecb8268903e1b33a9
SHA512 d9289dafdc5b883be6277d75b0466abd62d1ead1261a690c48da65712a3e9169476af5f641e705aeaae7eaa814b81816f6874377e264975f611c214bd5ea6010
SSDEEP 24576:1G88u8FpJqH1bzria7/m5u/GRDvhX/MKuWDsRddh1:47ZFPqVea7/Cu/kDvh8MsT
TLSH
T15895F16677E101F1D47BE1388A824663F6B1B8251324EBDF07988B551F23BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 f74b2652eaf4ccfe9f6804300e485709b4986e14404f8453d309a75c9ef8f233
MD5 369d7e63044b496316ad4c533be1d489
SHA1 cbce1234e7979deaec085289eba90eeab96e1ec9
SHA512 612fb1bc43f953b4b1f0981cefa91d481049457dc1f0d5fec1a33e6d4fe4e99a93b21458d2bfb1747fdc3e6fc9297915f7a587025ca0bdc49d3d71f8fe41f069
SSDEEP 12288:PHvUrBFrEjwaQdu/GRDdTKjMntaWXJbySb+zKuHGrVkgsRsUOkqYJ1:PPUr+NQdu/GRDvhX/MKuWDsRddhH
TLSH
T19E75E12F769918E5F676E27C89828719E77178621711D2CF02D0817E4F27EE8BD39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1705553f89e2ed304c68cbe9cbdec1cdefe80725df75f5799eeb7c94dd267939
MD5 81cd7c5e74f3cffe53235dbd97666aa9
SHA1 455102fdcc7ee4402f29a1af5de868819f573644
SHA512 8e4a192c32e27e9c620635f8963bd9f8787cb8455f2bf46c04e61e0db629a423efc22d0880349ee38c00d1488db2163fcf0d090af058264d5bacd800ebc53d3f
SSDEEP 49152:vBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjtu/kDvh8MsT:gG05lO43bVQaT
TLSH
T1A1D5BF6E62EC11F5D1BBD17CCAC64A0BEBB23815033556CB02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ca3fccce2c210c08c650827cc6d288dc82ceab997997aec995c518afb0eca61b
MD5 e1dff2da3c1cef2865c43128241ece33
SHA1 aa507afb109f99d69272ae84c88df4bb58f2827b
SHA512 c8ab183a0694f38f46b585c53a10eb5d00485b5ee80d133c1139980ba3e4823d3559047e6b10912df098c22151bceb540a68d194d547b724f7ce68366cf83c21
SSDEEP 24576:kfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnDu/GRDvhX/MKuWDsRddh4:8a5POZ3BJt2pasx2+m1u/kDvh8MsT
TLSH
T12965AF5EA7F801D5E1B9D17DC583461AE5B1342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c71d92c29ddffeb906477a23c3c0138f3cc1de45bb1f97695bd4ff7b07e1b9ab
MD5 6905d6dae83de6ff400475896226008f
SHA1 dd47d9c60bb90d288a3c93f9742c53615c582b99
SHA512 9ce49bed0b6909df12170d0cf7a9de07cd6e8d27ff466363a38b067a85b9c3787c6b44a76c396dcdf9bdf47082e078e3178ed31b4cd28847797d7df2ee0b3b23
SSDEEP 24576:BNcwHdjbyQ4nLC18lb/EOjowL7FkBu/GRDvhX/MKuWDsRddhR:BNc/zEOVHFiu/kDvh8MsT
TLSH
T1E7857B2623E901E4F1BBE1BE89779646FA717865133486CF0291851B1E73BF46C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 2861588500adec182cf9d34d6e7c40121a11e3af4fdb7d148a6d25c1a56fb84a
MD5 83912a593628f1d9fdfed85e567f34fe
SHA1 967fe79e59beae35b1f072516ef968911ec59de9
SHA512 0788c0fa72c0803a01361ff04ca018a3c8658eb0079b05a2d953250b843dde88006098da595c5f01f689f7ac4ecbab64d9a8b732bd44f6e6d1fdba5ce0fdef01
SSDEEP 24576:76DIXM/H9cgEX/QcuFK9vdqrifgGPpoo:76DIXMMXoKvkri4GPao
TLSH
T14025021D336A10F9E03BD17E96930115E1B2B0B1831666DF06A8C6794FA3FD8B93CE52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 b05ee7b979beb88e12ffef132cfa56b5abf02cc9cebbb82b3f51a24a7857a537
MD5 05eed670c0cae29e1f0d9f3803787819
SHA1 4cc5ca1b1436b811cf32153f83cd36228631b9ee
SHA512 72a0b7766c359836a97ed06ebbcb1699f19abc586cdf5e53a8357d88ff0b449d92925e744efd539b47aeb699a9c7ff97f74be6b003c1267b9d7d9c802b9cf73a
SSDEEP 24576:SD3FHshBIYQgAQu/GRDvhX/MKuWDsRddhH:SDVHeBIAAQu/kDvh8MsT
TLSH
T14885E13EEA9904E4E57BD2BCCA638A06E77138A9033155DB02D481B51F2BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
Size 2.0MB
SHA256 ee057c4ceeeaec19c94ac6963130294346335f692a8368ec3107be93b6fa32fb
MD5 170dabb7f8c83050b9ad961bb01854ed
SHA1 233874b95c134cb927bfde422bce5a6ac278602f
SHA512 0cd3ef2107dd1fd4d5070228d6fababeed3742251184cb053d383c7bc2876108737253944599cf6255d990a98985074a5786c62f02551bdf2649c34dae1d77f5
SSDEEP 24576:8wukOWk/GRDvhX/MKuWDsRddh3lu/GRDvhX/MKuWDsRddha:8wLOr/kDvh8MsT1u/kDvh8MsT
TLSH
T14FA5124A779508F9E66797388693C636E7B27C022634C71F5350C6AA4F33761FE29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/568-34-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/568-35-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/568-33-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/568-27-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/568-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2300-166-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2300-338-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2300-165-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2300-172-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2496-123-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2496-335-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2496-336-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2496-333-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2496-122-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2496-129-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2796-53-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2796-64-0x0000000140000000-0x000000014023C000-memory.dmp

Download

memory/2796-62-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2796-148-0x0000000140000000-0x000000014023C000-memory.dmp

Download

memory/2796-59-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2964-161-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2964-158-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2964-155-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2964-156-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2964-149-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3136-40-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3136-47-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3136-48-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3136-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3136-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4476-100-0x0000000000400000-0x00000000005FE000-memory.dmp

Download

memory/4476-101-0x0000000000930000-0x0000000000997000-memory.dmp

Download

memory/4476-319-0x0000000000400000-0x00000000005FE000-memory.dmp

Download

memory/4476-106-0x0000000000930000-0x0000000000997000-memory.dmp

Download

memory/4884-13-0x0000000003730000-0x0000000003797000-memory.dmp

Download

memory/4884-18-0x0000000003730000-0x0000000003797000-memory.dmp

Download

memory/4884-52-0x0000000000400000-0x0000000000B81000-memory.dmp

Download

memory/4884-6-0x0000000000400000-0x0000000000B81000-memory.dmp

Download

memory/4884-8-0x0000000000EC0000-0x0000000000F92000-memory.dmp

Download

memory/4884-5-0x0000000001120000-0x00000000011A5000-memory.dmp

Download

memory/4884-0-0x0000000001120000-0x00000000011A5000-memory.dmp

Download

memory/4884-72-0x0000000000400000-0x0000000000B81000-memory.dmp

Download

memory/5460-303-0x0000000140000000-0x0000000140232000-memory.dmp

Download

memory/5460-88-0x0000000140000000-0x0000000140232000-memory.dmp

Download

memory/5460-95-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/5460-89-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/5748-261-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/5748-76-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/5748-83-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5748-77-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5868-110-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5868-349-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5868-351-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5868-117-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5868-111-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5868-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6088-337-0x0000000140000000-0x00000001402A5000-memory.dmp

Download

memory/6088-137-0x0000000140000000-0x00000001402A5000-memory.dmp

Download

memory/6088-138-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/6088-144-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download